Cloudflare, Inc.

Overview

Cloudflare is a San Francisco internet-infrastructure company whose network sits between millions of websites and their visitors, providing content delivery, DDoS protection, security, and a developer platform. That position — a private company operating a critical layer of the public internet — is what makes Cloudflare interesting: it has repeatedly been forced to reckon with the power it holds, whether by cutting off extremist customers, by being held liable in a Tokyo court for manga piracy on its network, or by taking itself offline through its own configuration errors (TechCrunch; The Straits Times; Cloudflare Blog).

From an anti-spam side project to internet infrastructure

The company was founded in June 2009 by Matthew Prince, Lee Holloway, and Michelle Zatlyn (ZDNet). The origin story, as told by the Harvard Business School alumni club: during a 2009 HBS class trip to Silicon Valley, Prince described an open-source project tracking online fraud and spammers; Zatlyn saw the opportunity not just to track the bad actors but to stop them; the two sketched the business model on a napkin that evening, recruited their friend and programmer Lee Holloway, and won the HBS Business Plan Competition (HBS Club of NY). Prince had co-created Project Honey Pot, a community tracking online fraud and abuse, which seeded the idea (HBS Club of NY).

By the October 2020 telling, the network processed requests from 1 billion unique IP addresses daily and protected 25 million websites and applications against 72 billion cyber threats a day, spanning more than 200 cities in over 100 countries (HBS Club of NY). At the IPO a year earlier, the figures were 20 million-plus websites served through 193 data centers, with 2018 revenue near $193 million on more than $320 million raised across six private rounds (ZDNet).

Cloudflare filed its draft S-1 registration statement with the SEC on 24 May 2019 (SEC), priced its IPO at $15 per share, and began trading on the New York Stock Exchange under the ticker NET on 13 September 2019 (Business Wire). Buried in that S-1 process was a less-told detail: the SEC’s comment letter notes the prospectus disclosed that Cloudflare had self-reported to the U.S. Treasury’s Office of Foreign Assets Control possible noncompliance with economic sanctions programs involving entities under counterterrorism sanctions or affiliated with comprehensively sanctioned governments — Iran, Sudan, and Syria (SEC).

The neutrality problem

For years Prince’s stated position was that Cloudflare should not police its customers: in a 2015 interview he said he never wanted to be making “moral judgments on what’s good and bad” and would defer to the courts (TechCrunch). The company broke that stance twice. In 2017 it terminated the neo-Nazi site the Daily Stormer — its first-ever customer cutoff — after the site claimed Cloudflare secretly supported it. In August 2019 it cut off 8chan, an anonymous message board linked to the El Paso and Dayton shootings that killed 31 people and to the New Zealand shootings that killed 50 (TechCrunch).

Remarkably, Cloudflare disclosed those terminations in its IPO filing as a risk factor, warning investors that the activities of its customers could cause “significant adverse political, business, and reputational consequences” — and that some prospective customers had already declined to subscribe partly because of the actions of other customers (TechCrunch). The filing thus framed content moderation not as corporate virtue but as a business liability. The company has also faced reports that it provided web protection to sites linked to sanctioned entities including al-Shabaab and the Taliban, responding that it tries “to be neutral” (TechCrunch).

When the infrastructure fails itself

On 18 November 2025 at 11:20 UTC, Cloudflare’s own network began failing to deliver core traffic, showing users error pages across customer sites (Cloudflare Blog). The cause, in the company’s post-mortem: a change at 11:05 to a ClickHouse database’s permissions caused duplicate rows in a “feature file” used by its Bot Management system; the file doubled in size, exceeded a hard limit of 200 machine-learning features (normal use was ~60), and panicked the Rust proxy code with an unhandled error — producing HTTP 5xx errors network-wide (Cloudflare Blog). The team initially misdiagnosed the symptoms as a hyper-scale DDoS attack. Core traffic was largely flowing by 14:30 and all systems were normal by 17:06 UTC; affected services included the core CDN, Turnstile, Workers KV, dashboard logins, Access, and Email Security (Cloudflare Blog). It was not a cyberattack — it was the internet’s bodyguard tripping over its own shoelaces.

Copyright liability in Tokyo

A day later, on 19 November 2025, the Tokyo District Court ordered Cloudflare to pay ¥500 million (S$4.2 million) to four major Japanese publishers — Kodansha, Shueisha, Shogakukan, and Kadokawa — for copyright infringement over servers hosting manga-piracy sites (The Straits Times). The publishers, who filed suit in Tokyo in 2022, said Cloudflare provided servers for two massive piracy sites distributing more than 4,000 manga titles without permission and drawing 300 million views a month; they had previously reached a settlement with the company in 2019 over an earlier takedown request but said it kept serving piracy sites (The Straits Times). Cloudflare planned to appeal, according to Japanese media (The Straits Times).

What this profile does not claim

• It does not assert a current network-scale figure; scale numbers are dated to their sources (2019, 2020) because the company’s claims change and are self-reported.
• It does not report the outcome of the Tokyo ruling appeal, which was not verified.
• It does not resolve the OFAC self-disclosure beyond noting the 2019 disclosure itself; no penalty or clearance was verified.
• It does not independently verify the technical claims of the November 2025 post-mortem; they are the company’s own account, presented as such.
• It takes no position on whether Cloudflare’s content-moderation decisions were right or wrong — only on what the company said and did, as reported.