Security · Zero Trust
What Zero Trust is and why it’s the best protection for a data workspace
Zero Trust means “never trust by default”: every request is checked against the user’s identity, not against being “on the network”. Cloudflare Access does this on Cloudflare’s network — before a request ever reaches your server.
How it works
Checks happen at the network edge, not on your server
- 01
The user opens the workspace
For example app.yourdomain.com. The request first hits Cloudflare’s network, not your server.
- 02
Cloudflare verifies identity
One-time email code, Google / Microsoft, corporate SSO — plus MFA and device checks if needed.
- 03
Access policy
Only allowed people or domains (e.g. @yourcompany.com). Everyone else never even sees the app’s sign-in page.
- 04
Signed token (JWT)
Cloudflare forwards the request with a signed JWT. The backend verifies the signature and audience (AUD) — headers can’t be forged.
Why it’s top-tier
What your business gets
No exposed sign-in form
The server isn’t visible from the internet: nothing to brute-force, scan or password-spray.
Checked before the server
Unauthorized requests stop at Cloudflare’s network and put no load on your infrastructure.
Per-user policies
Access by email, group, country or device; revoke with one click, no password resets.
Access logs
Who signed in, when and from where — for oversight and investigations.
MFA and SSO
Google Workspace, Microsoft Entra ID, Okta and other providers, with multi-factor auth on their side.
Combine layers
With VPN / IP allowlists, TOTP (Google Authenticator) and roles inside the workspace — defense in depth.
Getting started
Cloudflare Zero Trust Free plan
- $0 forever
- A free plan with no time limit.
- Up to 50 users
- Fits teams under 50 people or a proof of concept.
- Logs up to 24 hours
- Standard Zero Trust log retention on the Free plan.
Verified on Cloudflare’s official pricing page as of October 2026; terms may change.
Cloudflare Zero Trust plans ↗Cloudflare Access documentation ↗
Let’s protect your workspace the same way.
I’ll set up Cloudflare Access for your domain, policies and identity provider — and combine it with roles and TOTP in the workspace.
Or reach me directly:
Open the demo →