If Zaraz is operated by an independent non-US entity, then the answer is definitely no, and these protections would seem sound. If Zaraz is operated by Cloudfl

If Zaraz is operated by an independent non-US entity, then the answer is definitely no, and these protections would seem sound. If Zaraz is operated by Cloudflare, a US entity subject to US law, then I am uncertain that this offers sufficient protection to earn a favorable GDPR ruling. Could Cloudflare be subject to a FISA (or other) court order by US authorities, that orders the alteration of the Zaraz product to divulge PII in violation of GDPR?