Does Cloudflare Geo Key Manager Keep Your Traffic in the Same Region?
A European customer asks you to keep their traffic in the EU, and you already use Geo Key Manager. Does that cover where requests are decrypted and where logs end up?
- Regional key controls do not replace controls over HTTPS processing and log storage.
- Regional Services can receive traffic globally while limiting where it is decrypted.
- The new post-quantum design is not an announcement that every CDN deployment has migrated.
Key location is only part of the answer
If a customer asks whether its HTTPS traffic is processed inside the EU, pointing to an EU key setting is not enough. Geo Key Manager controls private-key location. Regional Services determines where HTTPS traffic is decrypted and serviced.
Logs introduce a third location. The Customer Metadata Boundary, or CMB, covers Customer Logs such as request URLs, timestamps and firewall events. Those are different requirements from the location of a TLS key or the processing of a request.
Global delivery does not have to mean global key access
Cloudflare’s October 23 post-quantum GeoKey Manager design distributes encrypted customer private keys globally while supplying the regional root keys needed to unwrap them only to authorized regional servers. Possessing a wrapped key is not enough to use the underlying private key.
The described Cloudflare One path combines ML-KEM-768 with X25519. The associated One regionalization capabilities remain a future announcement, and integration with existing CDN key controls is a separate development effort. Existing geographic controls should not be mistaken for general availability of this new post-quantum CDN integration.
An overseas edge can receive the connection without decrypting it
Regional Services accepts traffic across Cloudflare’s global network, then restricts HTTPS termination to the configured region. In the documentation’s example, a US request for an EU-regionalized hostname travels encrypted to an EU data center before decryption.
The initial edge can apply network- and transport-layer DDoS protection without reading the encrypted content. Functions that need decrypted traffic run inside the selected region. Consequently, “processed in the EU” does not mean packets never touch an edge outside the EU.
A region supported for traffic may not be supported for logs
The official region table, checked on October 26, lists the products separately. South Korea illustrates why the distinction matters:
| Region | Geo Key Manager | Regional Services | Customer Metadata Boundary |
|---|---|---|---|
| South Korea | Supported in v2 | Supported | No Korean boundary |
| European Union | Supported | Supported | EU boundary supported |
The v2 qualification describes key-region support, not the release status of the new post-quantum CDN integration. Account entitlements and product-specific availability also need to match the intended configuration.
CMB uses its own setting and documents EU and US boundaries. Without a boundary, logs may be stored in Cloudflare’s core data centers globally. Selecting South Korea for HTTPS processing therefore does not establish Korean log residency; selecting EU processing does not automatically configure the EU log boundary either.
Write the deployment requirement as three statements: where keys may be used, where HTTPS may be decrypted and inspected, and where Customer Logs must remain. Map each statement to its control before promising a location to a customer.
Frequently asked questions
Has the new post-quantum design shipped to all CDN customers?
The October 23 announcement describes CDN integration as work in progress and invites existing DLS customers to register interest in testing before general availability.
Does EU traffic processing automatically keep logs in the EU?
No. CMB has an independent regional setting. Configure the processing region and log boundary separately.