Security and Compliance
Last updated: May 21, 2026. This document is a practical product/legal draft and should be reviewed by counsel before relying on it for regulated enterprise contracts.
Security model
AdClaw Host runs customer workspaces on Cloudflare Containers and Workers. Cloudflare states that each Container instance runs inside its own VM, providing strong isolation from other workloads running on Cloudflare's network.
Workspace lifecycle actions are explicit: launch, wake, sleep, and backup are customer or operator actions controlled by the Host dashboard and lifecycle APIs. The dashboard avoids starting a runtime for cheap account and health checks.
Cloudflare compliance foundation
Cloudflare states that its services are designed to satisfy GDPR requirements. Cloudflare provides a customer DPA, uses SCCs and supplementary measures for international transfers, and participates in applicable Data Privacy Frameworks.
Cloudflare maintains ISO 27001, ISO 27018, and ISO 27701 certifications. ISO 27018 addresses protection of personal data in public cloud processing, and ISO 27701 addresses privacy information management aligned with GDPR-style requirements.
Data residency controls
Cloudflare provides data-residency controls that can be used to scope customer workspace runtime and AdClaw-managed storage for enterprise deployments where supported. These controls are the basis for AdClaw's EU-ready enterprise hosting option.
EU-ready hosting is available by request for enterprise customers. It should be scoped in writing because optional managed services and customer-selected providers may create separate data flows outside the core AdClaw workspace.
Optional services boundary
Bundled Host AI messages, Citedy credits, content publishing tools, third-party LLM providers, search providers, analytics integrations, and customer-configured API keys may involve separate processors. Customers with strict requirements can disable optional managed services and bring approved enterprise providers.
What we can document for enterprise customers
- Cloudflare-based runtime and storage architecture.
- Container isolation and lifecycle model.
- Workspace backup and retention assumptions.
- Optional service boundaries for Host AI, Citedy credits, LLM providers, search, analytics, and publishing integrations.
- EU-ready deployment plan where supported by Cloudflare jurisdiction controls.