Cloudflare One Review Australia 2026
Sourced SASE/ZTNA — USD annual seats, US/EEA control plane, self-managed tunnels
Cloudflare One is for sale to Australian organisations in USD with a genuine Free cap (50 users) and a Pay-as-you-go seat whose public billed figure is US$84/user/year — not US$7 cancellable monthly. The product is private-resource Access via tunnels you run, plus Gateway internet filtering on Cloudflare’s network, which advertises several Australian cities. Those cities are not data residency. SOC 2 Type II / ISO / PCI exist as vendor announcements with dashboard-gated reports. No independent speed or leak tests were run. This listing is not CDN Pro, Workers, Magic WAN as the starting SKU, Email security, or consumer WARP.
- Best for
- Australian organisations that can read per-user USD annual billed totals, will deploy cloudflared (or clientless Access), already use an IdP or Cloudflare login, and accept a US/EEA-hosted control plane plus gated audit reports.
- Not ideal for
- Anyone budgeting the US$7 teaser as cancellable monthly, teams that need vendor-confirmed Australian data residency or a public inspectable SOC 2 PDF before paying, buyers who need Magic WAN/email security on self-serve, or anyone expecting a no-logs consumer VPN or a CDN zone plan.
SoftwareHQ does not currently have an affiliate arrangement with Cloudflare One. The review is independent of commercial relationships. Affiliate disclosure
Overview
Cloudflare One is a business remote-access product. Ownership, logging, control-plane hosting and private-resource access are recorded separately. Public internet egress is not Australian data residency.
Feature highlights
These highlights come from vendor documentation and editorial analysis of public sources. They are not firsthand test results or a claim that every listed capability was exercised in a trial.
- US$7/user on PAYG is billed annually
AU Chrome on 12 Sep 2026 printed Pay-as-you-go US$7 per user/month (paid annually). Hand check 7×12=84. Do not budget US$7 as cancellable monthly. No public monthly PAYG SKU was printed.
- Free for 50 users is a real tier
Zero Trust Free is US$0 forever up to 50 users, with community support and 24-hour logs. It is the documented proof-of-concept path, not a 14-day trial.
- Tunnels are yours; the control plane is Cloudflare’s
cloudflared makes outbound-only connections from your infrastructure. Cloudflare hosts the control plane. Advertised Sydney/Melbourne/Brisbane/Perth/Adelaide/Canberra/Hobart PoPs are not data residency.
- Gateway is public-internet filtering on the starting SKUs
SWG (DNS, network, HTTP) is included on Free and PAYG. That is Cloudflare-network egress, not a consumer country-picker VPN. Dedicated egress IPs are an add-on. Email security and Magic WAN are Contract add-ons.
- SSO, MFA, posture and Access policies on Free and PAYG
Access policies, IdP SSO (including SAML/OIDC), OTP MFA and device posture are on the Zero Trust platform table for these SKUs. Clientless Access for web/SSH/VNC is documented.
- SOC 2 / ISO / PCI are dashboard-gated
Trust Hub names SOC 2 Type II, ISO 27001, ISO 27701 and PCI DSS. Downloads require a Super Administrator account and a confidentiality tick. No public PDF was inspected.
Ownership and jurisdiction
Legal entity and jurisdiction are not the exit-server map.
- Legal entity
- Cloudflare, Inc.
- Jurisdiction
- United States
- Parent company
- Unknown
- Five Eyes
- Yes
Privacy Policy effective 4 Nov 2025: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Our Story: founded 2009 (Prince, Zatlyn, Holloway); public 13 Sep 2019 NYSE: NET. Self-Serve Subscription Agreement is cloudflare.com/terms/. Cloudflare Australia Pty Ltd is listed as a group company (privacy contact block: 333 George St, 5th Floor, Sydney NSW 2000; About office list: 388 George Street, Sydney NSW 2000 — dual public street numbers, left unresolved). The United States is a Five Eyes member. This listing is Cloudflare One / Zero Trust, not CDN Pro/Business zone plans.
- https://www.cloudflare.com/privacypolicy/ · checked 2026-09-12
- https://www.cloudflare.com/terms/ · checked 2026-09-12
- https://www.cloudflare.com/our-story/ · checked 2026-09-12
- https://www.cloudflare.com/about-overview/ · checked 2026-09-12
Logging and retained data
A vendor no-logs claim is not proof of zero retained account or payment data.
- Logging policy
- Activity logs
- Retained service data
- Documented retained service data
Not a consumer no-logs VPN. Privacy Policy: End Users of Cloudflare Zero Trust generate Customer Logs (IP addresses, traffic routing data, system configuration, traffic to and from Customer properties). Administrative User activity is logged. Zero Trust log docs: Admin logs 18 months on all plans; Access/DNS/Network/HTTP retention is 24 hours on Free and 30 days on Standard/PAYG (Access logs 30 days on Standard; 24 hours on Gateway-only Free rows). Contract/Enterprise extends some logs to 180 days and Logpush. Consumer 1.1.1.1 Application has a separate privacy policy and is not this product.
- Customer Account Information (admin names, emails, configuration)
- Administrative User audit logs (18 months)
- Access authentication and request logs
- Gateway DNS, network and HTTP logs (plan-dependent retention)
- device posture results and DEX logs
- payment and billing identifiers when Cloudflare is controller
- website analytics and cookies on cloudflare.com
A no-logs claim would not apply. Log Explorer stores selected Zero Trust datasets in an R2 bucket as an add-on. Customer Metadata Boundary / Data Localization Suite can restrict metadata region on Enterprise. This is not proof of zero retained data.
Privacy Policy: Cloudflare primarily stores information in the United States and the EEA and may transfer worldwide. International transfers use DPF certifications and SCCs. This product processes End User traffic as a processor for Customers.
- https://www.cloudflare.com/privacypolicy/ · checked 2026-09-12
- https://developers.cloudflare.com/cloudflare-one/insights/logs/ · checked 2026-09-12
- https://www.cloudflare.com/sase/products/access/ · checked 2026-09-12
Locations and hosting
Advertised exit countries, physical-versus-virtual evidence, control-plane hosting and account data residency are separate. An Australian exit IP is not Australian data residency.
- Advertised exits
- AU
- Australian exit
- Advertised — not proof of Australian data residency
- Exit location evidence
- Advertised
- Physical vs virtual
- Unknown
- Control-plane hosting
- Overseas
- Account data residency
- Unknown
- Legacy data_hosting field
- Unknown
Default Cloudflare One Client traffic-and-DNS mode routes device internet and private-network traffic through Cloudflare Gateway on the anycast network. Network map 12 Sep 2026 lists Australian data-center cities Adelaide, Brisbane, Canberra, Hobart, Melbourne, Perth and Sydney (Oceania also lists NZ and Pacific cities). Those advertised cities are not Australian account data residency. Privacy: primary storage United States and EEA. Data Localization Suite is Enterprise-only. Dedicated egress IPs are a Gateway add-on. Physical versus virtual of each PoP unknown. This is not a consumer country-picker VPN.
- https://www.cloudflare.com/network/ · checked 2026-09-12
- https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/ · checked 2026-09-12
- https://developers.cloudflare.com/data-localization/ · checked 2026-09-12
- https://www.cloudflare.com/privacypolicy/ · checked 2026-09-12
Per-platform features
Protocol, kill switch and split tunnel are recorded per platform. Missing documentation stays unknown or not tested.
| Platform | Protocols | Kill switch | Split tunnel |
|---|---|---|---|
| Windows | WireGuard, Other | Yes | Yes |
| macOS | WireGuard, Other | Yes | Yes |
| iOS | WireGuard, Other | Yes | Yes |
| Android | WireGuard, Other | Yes | Yes |
| Linux | WireGuard, Other | Yes | Yes |
| ChromeOS | WireGuard, Other | Yes | Yes |
Windows: Cloudflare One Client stable Windows 2026.7.1376.0 (28 Aug 2026). OS: Windows 10 LTSC, Windows 11, Windows 365 Cloud PC on Windows 11; AMD64 or ARM64. Default tunnel protocol MASQUE (HTTP/3, TLS 1.3); WireGuard optional. Lock device client switch can prevent user disconnect (default Disabled; all plans). Split Tunnels Exclude/Include on all plans. Not leak-tested. Distinct from consumer WARP (developers.cloudflare.com/warp-client/).
macOS: macOS Sonoma 14.0+, Sequoia 15.1+ (15.0.x not supported), Tahoe 26.0+; Intel or Apple silicon. MASQUE default, WireGuard optional. Lock switch and Split Tunnels documented. Not leak-tested.
iOS: App Store Cloudflare One Client / WARP. MASQUE and WireGuard documented from client 1.7 / 2.0-class versions. Split Tunnels on mobile apply at tunnel start; wildcard domain split-tunnel support is limited. Lock switch documented for all systems. Emergency disconnect is desktop-only.
Android: Play Store client; Chromebooks after 2019 use the Android app. MASQUE default. Split Tunnels and lock switch documented. Not leak-tested.
Linux: Package repository pkg.cloudflareclient.com. Documented: RHEL 9/10, Debian 12/13, Fedora 43/44, Ubuntu 22.04/24.04/26.04 LTS; AMD64 or ARM64. warp-svc daemon + warp-taskbar GUI. MASQUE default. cloudflared is a separate Linux connector for private resources, not the user client.
ChromeOS: Chromebooks use the Android app. Chromebooks made after 2019 should fully support it; older devices need the Chromium OS Android-apps list. Same protocol/split-tunnel caveats as Android.
Device limits and free tier
- Devices
- Unknown
- Concurrent connections
- Unknown
- Free tier
- Available
- Free-tier data cap
- Unknown
Zero Trust Free: up to 50 users; community support; log retention up to 24 hours; up to 3 physical locations for network-level DNS policies; CASB up to 2 read-only API integrations; DLP limited predefined profiles; no RBI, email security or Magic WAN. Seats are consumed by Access authentication or Cloudflare One Client enrollment. PAYG has no user cap. Device-per-user cap was not printed on the public pages opened.
Business controls
Some controls are plan-dependent. Do not infer them from a consumer tier.
- SSO
- Yes
- MFA
- Yes
- Device posture
- Yes
- Access policies
- Yes
- Audit logs
- Yes
- Private resource access
- Yes
- Public internet egress
- Yes
- Minimum seats
- 1
Reviewed starting paid SKU is Zero Trust Pay-as-you-go (US$7/user/month paid annually). Private-resource access via customer-deployed Cloudflare Tunnel plus Access policies is on Free and PAYG. SSO: Cloudflare login plus enterprise/social IdPs, generic SAML/OIDC, multiple IdPs concurrently — on the Access feature table for the Zero Trust platform. MFA: one-time PIN and IdP-provided methods. Device posture via the Cloudflare One Client and third-party EPP integrations, all plans. Public internet egress is Gateway SWG (DNS/network/HTTP filtering) on Free and PAYG, not a consumer country VPN. Email security and Magic WAN start as Contract add-ons. RBI is a PAYG/Contract add-on. No 5-seat minimum printed. Do not buy CDN Pro/Business or consumer WARP for this. Do not treat this as NordVPN.
Audit register
unknown
Trust Hub: Cloudflare publishes posture around SOC 2 Type II (also ISO 27001, ISO 27701, PCI DSS and others). Compliance documentation is downloaded from the dashboard by Super Administrators after a confidentiality statement. Auditor name and current report date were not printed on the public pages opened on 12 Sep 2026.
- Report date
- Unknown
- Availability
- Announcement only
- Inspection
- Not independently inspected
Dashboard-gated reports were not opened (would require an account Super Administrator and I Agree). A vendor SOC 2 claim is not an inspected independent report.
unknown
Trust Hub names ISO 27001 and ISO 27701 among certifications. Same dashboard download path as other compliance docs. Auditor and certificate date not printed on the public compliance-resources page.
- Report date
- Unknown
- Availability
- Announcement only
- Inspection
- Not independently inspected
No public PDF was inspected. An ISO badge is not an opened certificate.
unknown
Trust Hub and compliance-docs mention PCI DSS among Super-Administrator downloads. Not opened.
- Report date
- Unknown
- Availability
- Announcement only
- Inspection
- Not independently inspected
A named PCI row is not an inspected report.
When this was checked
Status as of (page snapshot) against a 90-day review target. Checked dates are not updated when the site is rebuilt.
Editorial article date: . That is not proof that pricing, hosting, or compliance was re-checked.
- PricingVerified
Verified — checked 12 September 2026.
USD. Free US$0 (50 users). PAYG US$7/user/month paid annually (7*12=84). Tax additional. AU Chrome no GST/AUD line. Checkout not started.
- HostingUnknown
Unknown — checked date 12 September 2026 is not field-level evidence on its own.
Advertised Australian PoPs only. Primary storage United States and EEA. Unknown is not AU.
Subscription pricing
Prices below are in USD, not AUD. ex GST. An effective monthly equivalent is not a cancellable monthly price. Verified — checked 12 September 2026. Source: cloudflare.com/sase/products.
Free forever on 12 Sep 2026: up to 50 users. Community forums and Discord. Log retention up to 24 hours. ZTNA, SWG, DEX, device client and application connector included. CASB up to 2 read-only API integrations; DLP limited predefined profiles. No RBI, email security or network services for SASE. Get started href dash.cloudflare.com/sign-up/teams was not clicked. Genuine free tier, not a timed trial.
- Introductory billed total
- 0.00 USD
- Term
- 1 month
- Bonus months
- None
- Effective monthly equivalent
- 0.00 USD effective monthly equivalent — not a cancellable monthly price
- Renewal
- 0.00 USD / 1 month
- Month-to-month option
- 0.00 USD
Checked 2026-09-12
AU Chrome Access card 12 Sep 2026: US$7 per user/month (paid annually). Official SASE/Zero Trust pricing markdown matches $7 /user/month. Hand check 7*12=84 (US$84/user/year billed). US$7/mo is not cancellable monthly. No public month-to-month PAYG SKU was printed. No user cap. Chat and ticket support. Log retention up to 30 days. 100% uptime SLA. RBI and Log Explorer are add-ons (Log Explorer: first 10 GB free then US$1/GB/month). Email security and Magic WAN/network services for SASE are Contract add-ons. Tax additional. Checkout not started. Contract custom annual per user was not stored.
- Introductory billed total
- 84.00 USD per user
- Term
- 12 months
- Bonus months
- None
- Effective monthly equivalent
- 7.00 USD effective monthly equivalent — not a cancellable monthly price (per user)
- Renewal
- 84.00 USD / 12 months per user
- Month-to-month option
- Unknown
Checked 2026-09-12
Compare Cloudflare One subscription cash outlay
Observed price changes
Recorded when a listed price changed. This is not a complete vendor timeline.
- First capture from cloudflare.com/sase/, /plans/zero-trust-services/ and /sase/products/access/ (AU Chrome + curl). Free US$0 (50 users). PAYG US$7/user/month paid annually (7*12=84). USD; tax additional. AU Chrome no GST/AUD line. Checkout not started.
Pros & Cons
Pros
- Public SASE and Access pages loaded in an Australian session on 12 Sep 2026 without a bot challenge
- Free US$0 (50 users) and PAYG US$7/user/month paid annually are printed on the Access cards (tax additional)
- Private-resource Access via customer Tunnel plus Gateway SWG are on Free and PAYG
- SSO (IdP/SAML/OIDC), OTP MFA, device posture and Access policies are documented on those SKUs
- Cloudflare One Client on Windows, macOS, Linux, iOS, Android and ChromeOS; MASQUE default, WireGuard optional; Split Tunnels and lock-switch documented
- Network map lists Adelaide, Brisbane, Canberra, Hobart, Melbourne, Perth and Sydney
- Clientless Access for web/SSH/VNC; Terraform/API documented; seats can be cancelled in-dashboard for the next cycle
- Self-Serve Subscription Agreement, DPA and subprocessors list are public
Cons
- US$7/user/month on PAYG is billed annually (7×12=84); no public month-to-month PAYG SKU was printed
- USD with tax additional — not an AUD GST-inclusive grid; sales-tax docs do not name Australia; checkout was not started
- Email security and Magic WAN/network services are Contract add-ons, not PAYG
- Advertised Australian PoPs are not Australian data residency; primary storage is US and EEA
- SOC 2 Type II / ISO / PCI reports are dashboard-gated and were not inspected
- Default client lock-switch is off; emergency disconnect is fail-open and desktop-only
- Fees for a paid term are non-refundable; Free logs are 24 hours; PAYG logs 30 days
- Docs SPA can keep an unrelated hash in the address bar; no independent speed or leak tests
How this review was made
Reviews separate vendor documentation, editorial analysis and firsthand records. They are not interchangeable.
- Vendor documentation — Public pages from Cloudflare One and other sites. Recorded HTTP(S) URLs are listed under Sources. A source URL is a document we recorded, not a claim that every sentence on this page was checked against that URL.
- Editorial analysis — SoftwareHQ's written verdict and scores for Australian buyers. The header score is an editorial assessment, not a user-review average, not a lab result, and not a number derived from how many evidence records exist.
- Firsthand records — This review has no firsthand observation records, trial walkthroughs, or screenshots from a logged-in SoftwareHQ account. Missing tests stay not tested.
This page does not rank products by speed or security from documentation or from evidence count.
Checked by SoftwareHQ Editorial Team. There is no named author profile for this page; attribution stays with the SoftwareHQ editorial team. How we test and the editorial policy for scoring, independence and affiliate rules.
Sources
Public pages recorded when this review was compiled. They are not a checklist that every claim was verified, and they are not evidence of hands-on product testing.
- Cloudflare Sase (cloudflare.com)
- Cloudflare Products
- Cloudflare Access
- Cloudflare Vpn Replacement
- Cloudflare Zero Trust Services
- Cloudflare Plans
- Cloudflare Privacypolicy
- Cloudflare Terms
- Cloudflare Website Terms
- Cloudflare Cloudflare Customer Dpa
- Cloudflare Subprocessors
- Cloudflare Trademark
- Cloudflare Press Kit
- Cloudflare About Overview
- Cloudflare about
- Cloudflare Network
- Cloudflare Trust Hub
- Cloudflare Compliance Resources
- Cloudflare Transparency
- Cloudflare Cloudflare One
- Cloudflare Setup
- Cloudflare Replace Vpn
- Cloudflare Getting Started FAQ
- Cloudflare Account Limits
- Cloudflare Seat Management
- Cloudflare Cloudflare One Client
- Cloudflare Download
- Cloudflare Modes
- Cloudflare Settings
- Cloudflare Split Tunnels
- Cloudflare Cloudflare Tunnel
- Cloudflare Cloudflared
- Cloudflare Identity Providers
- Cloudflare One Time Pin
- Cloudflare Posture Checks
- Cloudflare Policies
- Cloudflare Logs
- Cloudflare Data Localization
- Cloudflare Sales Tax
- Cloudflare Billing Policy
- Cloudflare Compliance Docs
- Cloudflare pricing
- Cloudflare Sase (developers.cloudflare.com)
- Cloudflare Warp Client
- Cloudflarestatus official site
Cloudflare One Alternatives
If Cloudflare One doesn’t quite fit your needs, consider these alternatives for Australian businesses:
- NordLayer — Business remote access with per-seat USD plans; private gateways start on Core. From $10/user/mo.
- Tailscale — WireGuard mesh overlay with hosted coordination; public internet egress is opt-in. Free plan available.
- Twingate — Hosted ZTNA overlay; self-managed Connectors; USD seats, not a browsing VPN. Free plan available.
Buyer guide
Source-based VPN guides for Cloudflare One: what a VPN encrypts, billed-term cash, free versus paid caps, how intro differs from renewal, how to read audits, how kill switch, split tunnel and protocols vary by OS, and when a consumer exit is the wrong product for company resources. Not a ranking.