Cloudflare

No evidence was found of the company having leading practices in this area.

No evidence was found of the company having leading practices in this area.

Cloudflare follows industry best practice by reporting on government requests for personal information by country, including information on the number of such requests it complied with. It also demonstrates significant efforts to protect children online.

Cloudflare continues to support open innovation by participating in international standards programmes and by publishing the code from its projects on a dedicated website.

Cloudflare could report on its financial and in-kind contributions to Project Galileo, together with the number of people that benefitted from the programme. There is an opportunity for Cloudflare to support digital inclusivity for women and girls. The company could also report on how the economic value it creates is distributed among its stakeholders.

No evidence was found on Cloudflare’s activities supporting digital skills development or school connectivity. There are opportunities for the company to introduce relevant initiatives in this area.

Apart from evidence that Cloudflare has internationally recognised certifications for its information security management system, there is no further information on how the company manages information security. The company could publish a privacy policy that applies the same conditions across the group. It could also strengthen its efforts to protect child online by integrating a commitment towards child online safety into its operating policies.

There is an opportunity for Cloudflare to demonstrate its commitment to sustainable and inclusive innovation by supporting non-profit research on sustainability topics and showing how it supports inclusive and ethical research and development (R&D). The company can also contribute to the tech innovation ecosystem by providing support to start-ups.

Cloudflare has a high-level commitment to respect human rights and the ILO core labour rights. However, the company does not disclose a process to identify, assess and act on salient human rights risks associated with its operations and with its business relationships. Moreover, the company does not engage with stakeholders whose human rights could be impacted by its operations. Additionally, though the company has a grievance mechanism for reporting human rights concerns, the mechanism is not available to stakeholders in all relevant jurisdictions.

Cloudflare does not publicly commit to respecting worker health and safety and does not place an expectation on its business relationships to commit to respecting the health and safety of their workers. While the company provides a breakdown of employees in different employee categories by gender, it does not report employee figures against any other indicators of diversity per employee category. The company has at least 30% women in its highest governance body. Cloudflare lacks disclosure on the topic of working hours, but it does commit to paying its workers a living wage. However, the company does not disclose how it calculates living wages for the different jurisdictions in which it operates.

Cloudflare has a policy prohibiting bribery and corruption but does not include anti-bribery and anti-corruption clauses in its contracts with business relationships. Furthermore, while the company has a policy statement setting out its approach to lobbying, it does not have a policy for political engagement, nor does it specify that it does not make political contributions. Cloudflare lacks any relevant disclosure on the topic of tax. The company discloses income taxes in three categories – federal, state and foreign – but it does not disclose its income tax payments for individual tax jurisdictions.