Cloudflare

Through Project Galileo, Cloudflare provides free information security services to minority and human rights organisations, independent media outlets, arts groups and democracy and voter protection programmes.

No evidence could be found of leading practices in this area.

Cloudflare follows industry best practice by reporting on government requests for personal information by country, including with how many of such requests it complied. It also demonstrates significant efforts to protect children online.

Cloudflare continues to support open innovation by participating in international standards programmes and by publishing the code from its projects on a dedicated website.

Cloudflare should report on its financial and in-kind contribution to Project Galileo, together with the number of people that benefitted from the programme. There is an opportunity for Cloudflare to support digital inclusivity for women and girls and disclose efforts in making digital technologies accessible. The company should also report on how the economic value it creates is distributed among its stakeholders.

Similar to last year, no evidence could be found on Cloudflare’s activities supporting digital skills development or school connectivity. There are opportunities for the company to support basic, intermediate and technical digital skills development, as well as school connectivity.

Apart from the evidence that Cloudflare’s information security management system is certified by internationally recognised certifications, there is no information on how the company manages information security. The company should publish a privacy policy that applies the same conditions across the group. Cloudflare could also strengthen its efforts on child online protection by integrating the commitment to protect children online into its operating policies.

There is an opportunity for Cloudflare to demonstrate its commitment to sustainable and inclusive innovation by supporting non-profit research on sustainability topics and showing how it supports inclusive and ethical research and development. The company could also contribute to technology innovation ecosystem development through start-up support.

Cloudflare does not disclose a high-level commitment to respect human rights or the ILO core labour rights. Furthermore, the company does not disclose a process to identify, assess, and take action on salient human rights risks its operations and business relationships. Moreover, the company does not engage with stakeholders whose human rights could be impacted by its operations. Finally, while the company has a human rights focused grievance mechanism, it is not available to stakeholders in all relevant jurisdictions.

Cloudflare publicly commits to respecting the health and safety of its own workers, but does not require its business relationships to commit to respecting the health and safety of their workers. While the company provides a breakdown of employees in different employee categories by gender, it does not report against any other indicators of diversity per employee category. Cloudflare lacks disclosure on the topic of working hours, but it does commit to paying a living wage. However, the company does not disclose how it calculates living wages for its relevant jurisdictions.

Cloudflare has a policy prohibiting bribery and corruption, but does not include anti-bribery and anti-corruption clauses in its contracts with business relationships. Furthermore, while the company has a policy statement setting out its approach to lobbying, it does not have a policy for political engagement, nor does it specify that it does not make political contributions. Cloudflare lacks any relevant disclosure on the topic of tax. The company discloses income taxes in three categories – federal, state and foreign – but it does not disclose income tax payments for individual tax jurisdictions.

The below datasheet disaggregates scores within the three core social measurement areas and by specific indicators.