Cloudflare
28 named things its latest annual report says its results depend on, each in the company's own words. 18 of them are also named by other companies we've read.
Customers
U.S. government
earns fromnamed as a riskSelling our products to the U.S. government, whether directly or through channel partners, also subjects us to certain regulatory and contractual requirements, including expanded compliance obligations under the Federal Acquisition Regulations.Risk factors (Item 1A)
Also named by ADI, AIR, APH, ASTS, ATI, AVAV, AWK, BA and 46 more
Suppliers
Co-location provider (single company)
depends onnamed as a riskMoreover, a significant number of our important co-location agreements are with a single company and if our arrangements with this company were to change in a manner adverse to us, we could face difficulty in maintaining or growing our network on commercially viable terms.Risk factors (Item 1A)
Workers KV third-party storage infrastructure
depends onnamed as a riskFor example, in June 2025, the underlying third party storage infrastructure used by our Workers KV service failed and caused us to experience a service outage for several hours that impacted a portion of our services and the customers using such services.Risk factors (Item 1A)
Partners and platforms
Internet Service Providers (ISPs)
depends onnamed as a riskOur relationships with ISP partners and other vendors that provide co-location services for our network infrastructure and the pricing and other material contract terms we have with these vendors are important for the maintenance, development, and expansion of our global network.Risk factors (Item 1A)
Also named by NFLX
JD Cloud
depends onnamed as a riskOur ability to continue to offer an integrated network presence that includes China currently is dependent on our commercial relationship with JD Cloud.Risk factors (Item 1A)
Places
International customers (outside United States)
earns from · 51%named as a riskWe derived 51%, 49%, and 48% of our revenue from our international customers for the years ended December 31, 2025, 2024, and 2023, respectively.Risk factors (Item 1A)
China
operates innamed as a riskA lack of network presence in China would represent a significant loss of utility to many of our customers and could materially harm our business, financial condition, or results of operations.Risk factors (Item 1A)
Also named by A, AA, AAOI, AAP, AAPL, AB, ADI, AEHR and 261 more
Russia
subject tonamed as a riskRussia, for example, has blocked designated virtual private networks since December 2021, and included one of our products, Cloudflare WARP, in its list of banned services.Risk factors (Item 1A)
Also named by ALSN, ATR, AVY, AXP, BKR, BSX, C, CDNA and 50 more
Portland, Oregon
concentrated innamed as a riskIn addition to these global facilities, much of the infrastructure for our global network and for our business and operations is maintained through a core co-location facility located in the greater Portland, Oregon area, a second core co-location facility located in Amsterdam that provides certain redundancy to the U.S. core facility, and through a limited number of other U.S. co-location facilities that provide limited subsets of our network support.Risk factors (Item 1A)
Also named by WSM
Amsterdam
concentrated innamed as a riskOur corporate headquarters is located in the San Francisco Bay Area and one of our core co-location facilities is located in the greater Portland, Oregon area, both regions known for seismic and/or volcanic activity, and we also have a second core co-location facility in Amsterdam.Risk factors (Item 1A)
Japan copyright litigation
subject tonamed as a riskFor example, in October 2025, a court in Japan held us liable for damages in a case alleging infringing content on websites using our services, which decision we have appealed.Risk factors (Item 1A)
Hazards
Earthquakes and volcanic activity (San Francisco Bay Area / Portland, Oregon)
concentrated innamed as a riskOur corporate headquarters is located in the San Francisco Bay Area and one of our core co-location facilities is located in the greater Portland, Oregon area, both regions known for seismic and/or volcanic activity, and we also have a second core co-location facility in Amsterdam.Risk factors (Item 1A)
Commodities and inputs
Servers
depends onnamed as a riskFor example, we generally rely on a limited number of suppliers for the servers that we use in our network and we ordinarily purchase these components on a purchase-order basis, without any long-term contracts guaranteeing supply.Risk factors (Item 1A)
Also named by ZM
Memory chips (DIMMs), SSDs, CPUs and HDDs
exposed to its pricenamed as a riskFor example, we expect significant component shortages that may impact our server supply chain during the current year, particularly in memory products such as Dual In-line Memory Modules (DIMMs), as well as enterprise Solid State Drives (SSDs), Central Processing Units (CPUs), and high-capacity Hard Disk Drives (HDDs).Risk factors (Item 1A)
Regulators
Italy online content regulation
subject to · approximately €14.2 millionnamed as a riskFor example, in December 2025, an Italian regulator issued an administrative fine of approximately €14.2 million against Cloudflare for alleged failure to comply with its regulatory scheme.Risk factors (Item 1A)
Laws and programs
OECD Pillar Two global minimum tax
subject to · 15%named as a riskThe Inclusive Framework includes provisions related to the taxation of the digital economy and the establishment of a 15% global minimum tax under Pillar Two.Risk factors (Item 1A)
Also named by ABNB, ACN, ADI, ADM, ADSK, AKAM, ALB, AMAT and 70 more
Revolving Credit Facility (SOFR)
exposed to its price · $400 millionBorrowings under the Revolving Credit Facility will bear interest, at our option, at either the alternate base rate or an adjusted term SOFR rate (each as determined from time to time in accordance with the credit agreement), plus a margin of between 1.75% and 2.50%.Market risk (Item 7A)
Also named by AAON, BRO, BX, CG, CRGY, FIVE, FIX, HEI and 22 more
U.S. tariffs
exposed to its pricenamed as a riskAdditionally, future tariffs could cause the costs of the equipment we use to operate our global network to increase, corporate spending to become delayed or curtailed, increase rates of inflation, reduce economic growth rates, create an economic downturn or recession, or result in other similar or unexpected adverse effects on our business, financial condition, or results of operations.Risk factors (Item 1A)
Also named by A, AAPL, ACHR, ADI, AEHR, AEP, AIOT, AKAM and 170 more
General Data Protection Regulation (GDPR)
subject tonamed as a riskFor example, the EU’s General Data Protection Regulation (GDPR) imposes stringent data protection requirements and provides for penalties for noncompliance of up to the greater of €20 million or four percent of worldwide annual revenues.Risk factors (Item 1A)
Also named by A, AB, ABNB, ADBE, ADP, AGX, AIOT, AJG and 100 more
EU AI Act
subject tonamed as a riskAs we continue to see efforts to regulate this new technology, we have incurred and will continue to incur costs to address the impact, if any, of these laws and regulations regulating AI on our products and practices.Risk factors (Item 1A)
Also named by ACN, ADBE, AMD, AXON, CGNX, CRM, CRWD, CTSH and 36 more
Investment Company Act of 1940
subject tonamed as a riskIf the exemptive order were revoked or we are unable otherwise to rely on the exemptive order or another applicable exemption, we may be required to institute burdensome requirements to comply with the 1940 Act, which may restrict our activities in a way that could adversely affect our business, results of operations, and financial condition.Risk factors (Item 1A)
Also named by ABR, AMG, AMP, ARCC, ARES, BAM, BCSF, BEN and 28 more
FedRAMP
subject tonamed as a riskincreasing numbers of U.S., European, Asian, or other government certification and audit requirements potentially applicable to our network, including FedRAMP in the United States, are often difficult and costly to obtain and maintain, and failure to do so will restrict our ability to sell to government customers in the applicable jurisdictions;Risk factors (Item 1A)
Also named by ADSK, CRWD, DDOG, DOCU, FTNT, GTLB, MSTR, OKTA and 9 more
EU Data Act
subject tonamed as a riskWe may incur substantial costs to comply with the EU Data Act, as well as become subject to substantial fines or civil litigation in the case of noncompliance.Risk factors (Item 1A)
Also named by ADBE, CSGP, DDOG, IOT, KVYO, MSFT, NOW, PLTR and 6 more
Digital Millennium Copyright Act (DMCA)
subject tonamed as a riskIf we are found not to be protected by the safe harbor provisions of the DMCA, CDA or other similar laws, or if we are deemed subject to laws in other countries that may not have the same protections or that may impose more onerous obligations on us, we may owe substantial damages and our brand, reputation, and financial results may be harmed.Risk factors (Item 1A)
Communications Decency Act Section 230
subject tonamed as a riskMany policymakers in the United States have called for a re-examination of CDA section 230 and copyright law.Risk factors (Item 1A)
Also named by GDDY
Export Administration Regulations (EAR) / BIS Affiliates rule
subject tonamed as a riskAlthough the Affiliates rule was suspended for a period of one year on November 10, 2025, the Affiliates rule, if implemented, would significantly raise the bar for compliance with EAR by imposing an affirmative responsibility to know the ownership of the foreign companies that are parties to any transactions.Risk factors (Item 1A)
PADFA and Executive Order 14117
subject tonamed as a riskWe have incurred additional costs and invested resources in addressing these new regulations, and as we continue to monitor the impact these new regulations have on our and our customers’ business, we may incur additional costs and may need to invest additional resources in order to make changes to our practices as may be required under these regulations.Risk factors (Item 1A)