vs Cloudflare
Cloudflare is a superb, massive edge network — 330+ city PoPs we do not claim to match. Our edge is different: origin, object store and CDN on one sovereign control plane, so object-to-edge egress is free by construction and the whole stack is governed under one tenancy and audit chain.
Capability by capability
| Capability | Edge Cloud | Cloudflare |
|---|---|---|
| DNS & traffic steering | GeoDNS + DNSSEC, 99.999% serve-stale (SS-25) | Authoritative DNS + DNSSEC |
| CDN & tiered cache | Owned PoPs, tiered cache, edge WAF (SS-27) | Global CDN + tiered cache |
| Edge compute | Functions: versions, rollback, http/cron/cache-miss, r2/kv/env bindings, WASM (SS-27) | Workers |
| Object storage | S3-compatible buckets/versioning/multipart + SigV4 wire gateway (SS-02) | R2 |
| Object → edge egress | $0 — intra-edge, zero-rated by construction | $0 R2 egress (their headline) |
| Zero Trust / SASE / SD-WAN | Mesh + WireGuard + SASE + SD-WAN + UPO compiler (SS-26) | Zero Trust / SASE (Cloudflare One) |
| PoP footprint | Sovereign PoP fleet — smaller, honest; not 330+ cities | 330+ cities worldwide |
| Origin cloud on same plane | Yes — Nexocloud origin + edge, one control plane | No origin/IaaS cloud; edge only |
| Sovereignty | Sovereign by construction: mesh, tenancy, Vault keys, no cloud KMS | US-headquartered; regional controls available |
| Signed audit chain | Vault-Transit-signed, 7-yr retention (ADR-0014) | Audit logs (plan-dependent) |
Where we win
Cloudflare has no origin/IaaS cloud — it fronts someone else's. Edge Cloud runs on the same sovereign control plane as Nexocloud, so origin and edge share one identity, one tenancy and one bill. No cross-vendor peering.
R2's headline exists to escape S3 egress fees across a vendor boundary. We have no boundary: SS-02 and SS-27 are the same platform, so object→edge egress is classified intra-edge and zero-rated — not a discount, a structural property.
mTLS mesh, hierarchical tenancy (cross-tenant reads return zero rows, pen-tested in CI), Vault-held keys with cloud KMS forbidden, per-class data residency, and a Vault-Transit-signed audit chain. These are platform properties, not enterprise add-ons.
The UPO compiles one authored policy to ztna, sdwan and firewall rulesets and applies with a diff — a single source of network intent across enforcement points, rather than three consoles that drift.
Honest gaps
We would rather you hear this from us. These are real, and we do not paper over them.
Cloudflare has 330+ city PoPs. We do not, and don't claim to. The SS-57 fleet is deliberately smaller and grows toward customer demand and residency zones rather than chasing raw city count.
SS-27 runs a real WASM datapath alongside a deterministic reference model. It is newer than Workers' battle-tested isolate fleet; the control plane (versions, rollback, placement, bindings) is complete, the datapath is still maturing.
Cloudflare has a vast marketplace, years of edge tooling and third-party integrations. Our advantage is depth on one governed platform, not breadth of a third-party ecosystem.
Cloudflare capabilities are summarised in good faith and change often — check Cloudflare for current details. Edge Cloud's differentiator is the sovereign, single-plane origin+edge and zero-egress object storage, not global PoP parity.