Why We Build on Cloudflare: Security, AI and the Edge

Here is the short answer. We build on Cloudflare® because one platform gives us the safety, the AI tools, the data and the global network our work needs. Our own site, our Readiness Check and HQ, the app we use to run client work, all run on it. That lets us spend our time on the job in front of us, not on servers.

Cited in this note

95%

This note walks through the three reasons. First comes the safety you get by default. Next are the AI tools, and last is the platform itself, with what it costs. Each claim links to a Cloudflare page, and we say plainly which tools we use today and which we only plan to use. If you want to know whether your business is ready to put AI to work, the Readiness Check takes five to seven minutes.

What do we actually run on Cloudflare?

Every app we run lives on Cloudflare Workers®, which is code that runs on the Cloudflare network instead of on one server.¹ Our marketing site is a Worker that serves its pages and talks to a second Worker for the chat. The chat uses Workers AI® for speech to text, Durable Objects™ to hold each chat, and Turnstile to keep bots out.

The Readiness Check is its own Worker. It keeps results in a D1 database and hands longer reads of a website to a queue, so a big job does not hold up the page. HQ is a Worker too. It uses D1 for its records, R2 to store files, and Workers AI and AI Gateway for its AI calls. The agents behind HQ are built on the Cloudflare Agents SDK. If you want the full story of how work moves through HQ, read how client work moves through HQ and our AI agents.

What safety comes built in?

Most of it is on before we write a line of code. Cloudflare finds and stops DDoS attacks on its own, and its docs say this is on for all plans.² A DDoS attack is a flood of fake traffic meant to knock a site over. When the site sits behind Cloudflare, that flood hits the Cloudflare network first.

The WAF, or web app firewall, checks each request against sets of rules and filters out the bad ones.³ You can turn on managed rules that Cloudflare keeps up to date, and add your own rules and rate limits. Bot tools sort real people from scripts that scrape content or try stolen passwords.⁴ Free plans get a simple bot switch, and Enterprise plans get a score for each request.

TLS is the lock in your browser bar. Cloudflare issues free certificates through Universal SSL, so traffic between visitors and the site is encrypted.⁵ For our chat we use Turnstile, which checks that a visitor is a person without making them solve a puzzle.⁶ The chat asks for a Turnstile pass when it opens, and a fresh one before each voice call.

For tools only our team should reach, there is Zero Trust. Cloudflare One checks who you are before it lets each request in, instead of trusting anyone who is already inside the network.⁷ Its Access tool guards the private tool server that HQ connects to, and HQ shows a service token to get in.

Which AI tools does Cloudflare offer?

Cloudflare now has a full set of AI tools that run on the same network as the app. Workers AI runs open models on Cloudflare’s GPUs, and you pay for what you use.⁸ We use it in HQ and in our chat. AI Gateway sits between an app and the models it calls. It logs each call, shows cost, caches answers, limits rates, and can retry or fall back to a second model when one fails.⁹ HQ sends its AI calls through it.

The Agents SDK is how we build agents. Cloudflare says each agent gets its own lasting identity, its own SQL storage, live connections and scheduled work.¹⁰ That is a good fit for agents that keep working on a task over days, which is what ours do.

There are more tools we reach for when a job needs them. We do not use these in our own stack today. Vectorize is a vector database, which stores what text or images mean so an app can find close matches.¹¹ AI Search, which used to be called AutoRAG, was renamed in Cloudflare’s changelog.¹² It lets an app or an agent search its own files in plain words, with keyword and meaning search turned on together.¹³ Browser Run, which used to be called Browser Rendering, runs real browsers on the network so code or agents can read pages, take screenshots and fill in forms.¹⁴¹⁵

AI Crawl Control works the other way round. It shows which AI services are reading your site, lets you allow or block each crawler, and tracks which ones follow your robots.txt file.¹⁶ That matters for AI search, and it ties into the work we do on AI visibility and files like llms.txt.

Why Workers, D1, R2 and Durable Objects?

Each one does a plain job, and they all plug into a Worker with a few lines of setup. D1 is a SQL database that the docs say you can roll back to any minute in the last 30 days.¹⁷ R2 stores files and does not charge to send them out to the web.¹⁸ Durable Objects pair a bit of code with its own storage, so a chat or an agent keeps its state in one place.¹⁹ Queues let one Worker hand a job to another and make sure it gets done.²⁰

This is how the Readiness Check handles longer reads of a website, so they do not make you wait. The page hands the job to a queue, and Workers pick it up in small parts. The results land in D1, and the page reads them back as they come in.

How fast is the network?

Cloudflare says that 95% of people online are within 50 milliseconds of one of its data centers.²¹ That is Cloudflare’s own figure, not one we measured. What we can say is how it shapes our work. Our code runs close to the visitor by default, so we do not pick a region or move servers when a client grows.

What does it cost?

It starts small. The Workers paid plan has a minimum charge of $5 a month per account, with usage above that billed as you go.²² The same page says requests for static files, like images and pages, are free, and there is no charge for data sent out. The free plan also includes some use each day. Prices change, so check the pricing page before you plan a budget.

For our clients, the point is that cost tracks use. A new tool does not need a big server bill on day one. It can start small and grow, and the bill grows with it.

Should your business build on Cloudflare?

If you need a custom app, an AI assistant, or an agent that does real work, it is a strong place to start. We build custom apps, AI assistants and agents, and one bill for many AI models, and we build them on the stack in this note. If you are still deciding between a product and a build, read off-the-shelf AI or custom software.

The first step is knowing where you stand. The Readiness Check takes five to seven minutes. It looks at the jobs that eat your week, whether your data and workflow can support real work, where new customers come from, and how well answer engines can find and quote your public site. You get a band, four scores and three suggestions in each section, plus a thirty-minute working session if you want one. Take it, then start a project or write to houdini@abra-ca-dabra.app, and we will look at the results with you.

Cloudflare, the Cloudflare logo, Cloudflare Workers, Workers AI and Durable Objects are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other places. This note is our own view and is not endorsed by Cloudflare.