To be even more clear: if the CF servers had any plaintext in memory, that plaintext might have been compromised. Plaintext could be anything from HTML pages to

To be even more clear: if the CF servers had any plaintext in memory, that plaintext might have been compromised. Plaintext could be anything from HTML pages to GET and POST request data (containing auth keys, passwords, JSON blobs, etc.) If CF decrypts information you send to it before encrypting it to your users, that's a step where plaintext might have been present in their servers' memory. (Please correct me if I'm wrong.)