Products, billing and availability may depend on the selected country.
Domains, security, performance and connected services for the systems your business relies on.
Explore all services →Cloudflare services, delivered by Silurian
Cloudflare One · SASE and workspace security
Bring workforce security, private connectivity and data protection together with Cloudflare One. Choose Free or Paid online. Already using Free? Workspace offers an upgrade of your existing subscription, keeping your team and security configuration. Separately scoped services require an agreed quote before contracting.
Cloudflare One, explained
Your website is only one part of your business. Employees also sign in to private applications, browse the Internet, use SaaS and work from different locations. Cloudflare One applies access and security policies to those connections.
An employee or contractor signs in with their identity. Access checks your policy before letting them reach an internal application; Tunnel connects that application without exposing inbound ports.
Start with a workforce plan ↓Gateway filters malicious or unwanted destinations. The One Client on a device routes the relevant traffic through your policies, so protection can follow the user outside the office.
Compare workforce plans ↓DLP checks traffic for sensitive information. CASB examines connected SaaS services for security risks. Basic capabilities are included with the limits described below. Full DLP and detailed CASB findings are not part of the plans offered here.
Explore data protection ↓Digital Experience Monitoring helps investigate device and application connectivity. Combine that view with Access and Gateway logs to distinguish a policy decision from a network problem.
See what is included ↓Cloudflare One is the platform. Zero Trust is the approach to checking identity and context instead of trusting a connection just because it is inside your network. The Free and Paid workforce plans below provide the security services offered here. Enterprise licences and Enterprise-only network products are not sold through this catalogue.
Start small: choose a plan and team size, complete your order, then configure identities, applications and device policies. A subscription alone does not protect traffic until those policies and connections are set up.
What the family contains
Cloudflare One™ is an account-level SASE platform and does not require a Cloudflare DNS zone. Only an Access application published on a public hostname needs an active zone for that hostname; private applications, identity, Gateway and network services remain account-level.
Apply least-privilege access and secure-web policies to people, devices, private applications and Internet traffic.
Inspect DNS and web traffic to block phishing, malware and destinations that conflict with company policy.
Use outbound Cloudflare Tunnel connectors to reach private applications without opening inbound firewall ports.
Use the basic DLP profiles and limited CASB capabilities included in workforce plans to assess sensitive data and SaaS risks.
Connect users to private networks using Tunnel and One Client, with access controlled by your workforce policies.
Plans and pricing
Each Cloudflare product has its own billing unit and included allowance. Your Silurian workspace keeps the selected service, configuration and billing context together.
Start Cloudflare One with the Zero Trust Free workforce plan. No DNS zone is required.
Grow your Cloudflare One deployment with the Zero Trust Pay-as-you-go workforce plan, billed annually.
Explore Cloudflare One
Order a Free or Paid workforce plan online, including the capabilities marked below. Separately quoted services are not included. Enterprise licences and Enterprise-only network products are not offered.
Core services for workforce access, device connectivity and safe Internet use.
Identity-aware access for self-hosted, SaaS and non-web applications, with contextual policies and service tokens.
Choose Cloudflare One ↓DNS, network and HTTP filtering for threat protection, acceptable-use policy and controlled Internet egress.
Choose Cloudflare One ↓Outbound-only connectors for private applications and networks without exposing inbound services.
Choose Cloudflare One ↓Device client for protected DNS, network and HTTP traffic plus private-network routes and posture context.
Choose Cloudflare One ↓Troubleshoot workforce connectivity with device and application experience monitoring. Seven days of DEX log retention are included.
Choose Cloudflare One ↓Network traffic visibility and alerts, scoped to the account and required traffic sources.
Request monitoring →Understand the data controls included in your plan and scope any Silurian deployment assistance separately.
Workforce plans include predefined financial and identification-number profiles. Custom profiles and full DLP are not included in the plans offered here.
Choose Cloudflare One ↓Find SaaS security risks with CASB. Free supports up to two integrations; individual finding details are not included in these offers.
Choose Cloudflare One ↓Architecture, deployment and operational assistance for a contracted Cloudflare One programme.
Request delivery scope →Connect supported devices and private networks using Cloudflare One.
Encrypted device-to-device and network-to-network connectivity without a central concentrator.
Review mesh design →Your service, your preferred view
Use Cloudflare's own dashboard when you want the complete native view and your assigned role allows direct access.
Manage supported zones and settings beside your domains, hosting, orders and support, without moving between suppliers.
Both views refer to the same managed service. Available controls depend on the Cloudflare product, your permissions and the actions supported by Silurian Workspace.
No. Cloudflare One belongs to your account, not to a DNS zone. A public-hostname Access application does need the relevant Cloudflare DNS setup; private-network and SaaS use cases do not require buying a website plan first.
No. Web Security protects the public website and its delivery. Cloudflare One protects workforce access, user traffic, data and connected networks. You can use either service independently or combine them.
No. The workforce plan includes Access, Gateway, Tunnel, One Client and monitoring, plus the limited DLP and CASB capabilities described above. Silurian deployment and consulting services are scoped separately. Enterprise-only extensions are not offered.
The displayed amount is per active user for a full year, excluding VAT. The commitment is twelve months. Your team size and the full annual total are shown in the cart before you confirm; it is not a monthly charge.
Free and Paid workforce plans can be configured and added to your cart directly. Eligible services labelled as scoped quotes need confirmed availability, scope and price first. Enterprise-only products are not offered. Requesting a proposal does not purchase or activate them.
Cloudflare One has its own account-level area in Silurian Workspace, separate from your domain zones. Native inventories and available actions are shown there; advanced configuration opens the Cloudflare One dashboard using your account permissions.
Cloudflare Agency Partner
Silurian designs the service, configures the controls and remains your direct support contact. Cloudflare supplies the eligible network, security and developer capabilities behind it.
Cloudflare, the Cloudflare logo, and Cloudflare Workers are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions.
Privacy, in context
You can still read the complete privacy policy in a new window.
Privacy choices
We use essential storage to keep this website secure and remember your choices. Anything optional stays off unless you allow it.
ⓘ You can change this choice at any time. Read our website and cookies policy