Cloudflare adds post-quantum Geo Key Manager for regional key control

Cloudflare has launched a closed beta of a post-quantum Geo Key Manager using hybrid ML-KEM-768 and X25519 for regional key access control.

Cloudflare has put a post-quantum upgrade of its Geo Key Manager into closed beta, extending its data-localization tooling with hybrid cryptography aimed at keeping private-key access inside selected geographies. According to a report by Quantum Computing Report citing Cloudflare materials, the new service is part of the company’s Data Localization Suite and is scheduled for general availability in the first quarter of 2027.

What was announced

The new offering, called Post-Quantum Geo Key Manager, is designed to let enterprises specify where private TLS and transport decryption keys can be unwrapped across Cloudflare’s global network. The company positions the product as a way to address both regional data-sovereignty requirements and long-term cryptographic risk, including so-called harvest-now, decrypt-later threats.

Cloudflare’s documentation says the Data Localization Suite is an enterprise-only paid add-on for customers that need control over where data is inspected, stored and decrypted while still using Cloudflare’s global infrastructure. Existing Geo Key Manager documentation also shows that the earlier version supported three regions — the U.S., E.U., and a set of high-security data centers — and that customers seeking other country or region options can apply for the closed beta of the new version.

The technical details

According to the report, the post-quantum design replaces a previous architecture based on ciphertext-policy attribute-based encryption with a hybrid public-key encryption approach. The new system combines ML-KEM-768, identified there as NIST FIPS 203, with X25519 under Hybrid HPKE as specified in RFC 9180.

The reported rationale is practical: standardized, production-ready post-quantum attribute-based encryption is not currently available, so Cloudflare reworked the design around HPKE. In the hybrid construction, confidentiality is intended to hold even if one of the two underlying mechanisms is broken later.

The report says the service uses AES-256-GCM and HKDF-SHA-256 for symmetric encryption and key derivation. It also describes a hierarchical model built around a 256-bit regional root key and service key pairs, intended to limit the blast radius across services and regional epochs.

On the infrastructure side, Cloudflare reportedly separates globally distributed ciphertext from the regional key material needed to unwrap it. Wrapped customer private keys are distributed globally through Quicksilver, Cloudflare’s distributed key-value store, while regional root keys are provisioned through a secured control-plane service backed by on-premises HashiCorp Vault clusters.

Before a server can receive a regional root key, the report says it must authenticate with its TPM, while Cloudflare’s Zinc inventory system verifies the machine identity and physical data-center location. Root keys are then loaded only into volatile Linux kernel keyrings rather than persistent storage, so a reboot clears them from memory.

Access controls and rollout

A notable design point is the enforcement model. According to the report, Cloudflare uses a strict fail-closed policy: if an edge server in an unauthorized geography does not have the required regional root key, it drops the request instead of attempting cross-border decryption.

The closed beta is initially aimed at enterprise users of Cloudflare One Zero Trust products including Magic WAN, Tunnel and Gateway. Full integration with Cloudflare’s content delivery network is planned before the Q1 2027 general release, according to the report.

Why it matters

For enterprise buyers, the announcement sits at the intersection of post-quantum migration and data-residency compliance. The key point is not merely using new algorithms, but tying cryptographic access to physical geography and hardware attestation. That combination could appeal to organizations facing strict regional handling rules for encrypted traffic and key material.

What to watch next is whether Cloudflare broadens the regional granularity beyond the currently documented options, and how quickly customers move from the existing Geo Key Manager to the post-quantum version as the 2027 launch approaches.