ResidencyYour receipts live where you put them.
Every workspace has one data location, chosen when it is created: any of the locations on offer (the seven data regions plus more AWS locations). Your data is stored there. Receipts and quota counters are processed in the product region that serves it; a location that is not one of the seven uses the nearest. Each receipt is signed in its region, with that region's own AWS KMS key. This page says exactly what is regional, what is not, and what a region does and does not promise.
Region choice depends on your planFree: see plan limitsA workspace never moves
- Product regions
- 7
- Under the EU jurisdiction
- 3
- Receipt signing keys, one per region (AWS KMS)
- 7
- Silent fallbacks to another region
- 0
Seven regions, one service each
Each region is its own service and its own database. The pins on the map are approximate. They are not a claim about which building holds the database.
- Paired AWS region
- Stored under Cloudflare's EU jurisdiction
- Stored with a Cloudflare location hint
- Account plane and front door: Dashboard, sign-in, billing and the API front door
Schematic map. Coastlines are simplified; pin positions are approximate.
| Region | Code | Paired AWS region | Jurisdiction | Storage |
|---|---|---|---|---|
| US East | enam | us-east-1 N. Virginia | ENAM | Location hint |
| US WestFree plan region | wnam | us-west-2 Oregon | WNAM | Location hint |
| Europe Central | weur-1 | eu-central-1 Frankfurt | WEUR-1 | EU jurisdiction, enforced |
| Europe West | weur-2 | eu-west-1 Ireland | WEUR-2 | EU jurisdiction, enforced |
| Europe North | neur | eu-north-1 Stockholm | NEUR | EU jurisdiction, enforced |
| Asia-Pacific | apac | ap-southeast-1 Singapore | APAC | Location hint |
| Oceania | oc | ap-southeast-2 Sydney | OC | Location hint |
The codes are the values of region in your workspace status. For the three European regions Cloudflare keeps the data inside the EU and chooses the datacenter, so no city is named for the data. For the other four the database is created with a location hint, which is a placement request, not a guarantee.
Cloudflare's own description of D1 jurisdictions and location hints, as of October 2026: Cloudflare D1 data location ↗
What stays in the region, and what does not.
Only the data plane is regional. The account plane is served from the United States (US West), whichever region you pick. A call is authenticated against US-hosted account data, then handed to your region, where it is processed and stored.
- Receipts and their stored bodies, where retained
- Quota counters for the month
- The receipt signing key (AWS KMS) and the write-once Object Lock copy of receipt hashes, both in the region's AWS region
- Retention, auto-purge and redaction jobs for your data
- The dashboard and the website
- Sign-in, sessions and account details: name, email, memberships
- Billing, through Avonao Billing
- API-key and token checks, and rate limiting, at the front door
- The control plane and the account audit log
- The public status page
A region says where data is stored and processed. It does not say that traffic never leaves a network edge: Cloudflare accepts a connection at the location nearest the caller, which can be anywhere, and the content of a request passes through the front door that receives it. The dashboard and account data are in the US in every case. For a contractual statement, read the Data Processing Addendum and the Privacy Policy, or ask us.
Data Processing Addendum →Privacy Policy →Ask the privacy team →
How a call reaches your region.
The front door knows the data region of the workspace your credential belongs to and forwards each call to that region's service, which reads and writes only that region's database.
Four rules that do not bend
No silent fallback
If your region's service cannot be reached, the call fails. It is never answered from another region, because that would store your data somewhere you did not choose. Nothing was processed.
No unknown regions
A region value that is not one of the seven is refused before any work is done.
One signing key per region
Each region's receipts are signed by that region's own AWS KMS key. No region signs with another region's key.
Verification needs no region
Checking a receipt is public-key cryptography over the receipt you hold. It needs no account, no region and no call to us.
| 503 | workspace_region_unavailableThe workspace's region is not available; nothing was processed. Retry later. |
| 503 | workspace_region_unknownThe workspace's region value is not one of the seven. |
| 503 | signing_unprovisionedThe signing key (KMS) could not be reached; the receipt waits as Receipt pending and is retried. |
| 400 | region_requires_paid_planAsked for a region your plan does not include. |
Receipts are signed in the region, by Trustvice.
Trustvice signs its own receipts. Each is signed with Ed25519 by an AWS KMS key that Trustvice holds in the receipt's data region; the private key never leaves KMS.
Published by Trustvice
Trustvice publishes its public keys as a key set at https://trustvice.com/.well-known/receipt-keys.json. A receipt names the key that signed it in signatureKeyId.
One key per region
Each of the seven regions has its own receipt signing key in AWS KMS, in that AWS region. The Worker holds only a sign-only credential.
Old receipts keep verifying
Retired keys stay in the published key set, and old receipts keep naming the key that signed them.
/.well-known/receipt-keys.json{
"kty": "OKP",
"crv": "Ed25519",
"x": "…",
"kid": "…",
"alg": "EdDSA",
"use": "sig"
}- What it proves
- The signature on a receipt is checkable by anyone against Trustvice's published key set.
- What it does not prove
- A region says where Trustvice processes and stores your data. It does not prove where data is stored at rest, or where sub-processors or backups hold it.
What crosses regions.
Three kinds of data leave a region, and each one is listed here. Nothing moves from one region to another.
Nothing
One region's service has no access to another region's receipts. Each reads only its own database.
Account and metering
The metadata the front door needs to authenticate you and meter your plan, and everything served from the US.
Hashes to sign and to lock
Each receipt is signed by the region's KMS key in the same AWS region. Every hour, the closed hours' receipt hashes are written to that region's Object Lock bucket. The content, the workspace and the account are not.
How a workspace gets its region.
You pick the region when you create the workspace. One account can hold workspaces in several regions.
- At sign-up
The form preselects the nearest of the seven from your location and lets you change it.
- Every later workspace
The workspace-create form has the same picker, so a team can keep EU work and US work apart.
- Then it is fixed
There is no move. To use another region, create a workspace there and issue new receipts from it. Receipts you hold stay verifiable wherever they were issued.
Regions by plan
Which regions you can choose depends on your plan. Check the pricing page for what your plan includes; asking for a region your plan does not include is refused.
Need EU residency?
Choose Europe Central, Europe West or Europe North. The three European regions store data under Cloudflare's EU jurisdiction: Cloudflare keeps it inside the EU but chooses the datacenter, and a Cloudflare database cannot be pinned to a named city. What differs between the three is the service that handles your calls and the key that signs your receipts.
The preselected region, by location
Only a default for the sign-up form, read from the request's location. You can always choose another.
| If you sign up from | Preselected |
|---|---|
| The Nordics and the Baltics | Europe North neur |
| The British Isles, France, the Benelux, Iberia, Italy and Iceland | Europe West weur-2 |
| Central and eastern Europe, the Balkans, the eastern Mediterranean, the Middle East and Africa | Europe Central weur-1 |
| The western US states and Canadian provinces, Mexico, and the US or Canada when no state is known | US West wnam |
| The eastern US states and Canadian provinces, Central and South America and the Caribbean | US East enam |
| Asia | Asia-Pacific apac |
| Australia, New Zealand and the Pacific islands | Oceania oc |
When the location cannot be read at all, the form preselects US West.
Latency
Work is done close to the data, but every call goes through the front door first. We have not published latency figures for the regions and do not state any here.
- Caller
- Nearest Cloudflare location
- Front door
- Regional service
- Regional database
Measure from your own network with your own client.
The documents behind a region
This page explains. These documents bind. If a regulator or a customer needs a contractual statement about where data is, they are the ones to read.
Data Processing Addendum
Section 11 on international transfers: where account and workspace data are stored, and the Standard Contractual Clauses.
Read →Sub-processors
Cloudflare and AWS with the locations each region uses, and 30 days' notice before any change.
Read →Privacy Policy
What personal data is processed, where, for how long, and how to exercise your rights.
Read →Enterprise
Residency requirements, custom retention, the SLA and the procurement paperwork, agreed per contract.
Read →Hear when a region changes
One email when a data region opens, or when what a region stores changes. Nothing else.
Residency is a requirement? Tell us which one.
Sales can walk your team through the regions, the documents and what a region does and does not promise.