GDPR checklist for infrastructure tools.
Network and security providers process traffic and request metadata for every visitor. Compare 3 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Cloudflare | Usually a processor | Set per account or project | Published by the vendor |
 ngrok | Usually a processor | Set per account or project | Published by the vendor |
 ZeroTier | Usually a processor | Set per account or project | Published by the vendor |
What to check for infrastructure tools
- Check which services are enabled and what logs they keep.
- Review log retention and any regional processing options.
- Record IP addresses and request metadata in your policy where relevant.
- Record transfers outside the EEA and their safeguard.
All infrastructure tools
Questions, answered.
What should I check before using an infrastructure tool under the GDPR?
Check which services are enabled and what logs they keep. Review log retention and any regional processing options. Record IP addresses and request metadata in your policy where relevant. Record transfers outside the EEA and their safeguard.
Do I need a data processing agreement with an infrastructure provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which infrastructure tools does Privacyboard cover?
Cloudflare, ngrok, ZeroTier. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.