> Encrypted: As Cloudflare makes all connections secure with HTTPS there is no need for a VPN. If Cloudbleed has taught us something, it's that cloudfare idea

> Encrypted: As Cloudflare makes all connections secure with HTTPS there is no need for a VPN. If Cloudbleed has taught us something, it's that cloudfare idea of "fully encrypted" doesn't fully include what's happening inside their own (virtual) walls. Some may still consider the way they do it ok for websites. I don't, encryption between my customer and me, not between them and cloudflare, opening their data to another actor they have to trust without even knowing it, especially since most of my customers and myself are in Europe not the USA, so I don't want any US authorities to be able to intercept my stuff through them. But for your company internal stuff ? I get that most companies don't really get pressured to take good care of users data because leak usually hurt the consumers themselves the most, not them, and they don't get blamed for it much. But surely it's not hard to see how opening your own internals is asking for troubles ... You give all access to cloudflare, you give all access to bugs in cloudflare's software (like cloudbleed), you give all access to any authorities with influence over cloudflare, you give all access to hacker who can get inside cloudflare (even if they only get one small opening into where you data comes through), ... And this time it's not your customers' stuff, it's yours (not saying it doesn't matter when it's theirs, but it's easier to dismiss by Mr Bean Counting Project Manager). If I am wrong in assuming this and the connection is made user to final endpoint without decryption at cloudflare level I couldn't see it when looking at that page.