Cloudflare has introduced a post-quantum version of its geographically restricted encryption-key management system, allowing protected keys to be used only within authorised regions while preparing for future threats to conventional public-key cryptography.
The company published the technical design on October 23.
The new GeoKey Manager is available in closed beta, with general availability planned for the first quarter of 2027.
The system forms part of Cloudflare’s Data Localization Suite, which provides controls for organisations handling information subject to geographic restrictions.
Encryption keys remain tied to authorised regions
Cloudflare operates servers across many countries.
For some organisations, regulatory or contractual requirements restrict the locations where protected information may be decrypted.
GeoKey Manager addresses part of that requirement by controlling access to the private keys needed to decrypt protected traffic.
The new design separates globally distributed encrypted key material from regional root keys.
Only servers authorised for a particular region can obtain the corresponding regional root key.
A server outside the authorised region cannot use the protected key merely because it receives a copy of the encrypted material.
Two cryptographic mechanisms work together
Cloudflare’s implementation combines ML-KEM-768 with X25519.
ML-KEM-768 is a post-quantum key-encapsulation mechanism standardised by the United States National Institute of Standards and Technology.
X25519 is an established classical key-agreement mechanism.
Using the two mechanisms together is intended to preserve confidentiality if one component remains secure.
The system also uses established cryptographic components for key derivation and authenticated encryption.
ML-KEM-768: Post-quantum key-encapsulation mechanism.
X25519: Classical cryptographic component.
AES-256-GCM: Authenticated encryption used in the implementation.
Closed beta: Current availability.
Q1 2027: Planned general availability.
Unauthorised decryption attempts are rejected
Cloudflare says its system is designed to reject requests when the required regional key is unavailable.
For example, a server outside the region authorised to use a particular key should not be able to decrypt material protected by that key.
The company uses hardware-backed server identity and internal inventory information to determine which servers may receive regional keys.
Regional root keys are loaded into the operating system’s kernel keyring rather than stored permanently on disk.
When a server restarts, it must authenticate and obtain the appropriate keys again.
Cloudflare says this arrangement reduces the risk of persistent key material remaining available after a machine is restarted or removed from service.
Key location is different from data location
The company’s technical documentation distinguishes regional key management from other forms of data localisation.
GeoKey Manager controls where protected keys can be unwrapped and used.
It does not independently determine every route taken by network traffic.
Nor does it establish that every related processing operation takes place within the same region.
Cloudflare identifies separate services responsible for regional traffic handling and related processing controls.
Businesses assessing data-residency requirements must therefore consider the configuration of the wider service rather than assuming that regional key protection alone establishes complete data localisation.
Full commercial rollout remains ahead
Cloudflare has previously offered geographic controls for encryption keys.
The October announcement concerns the introduction of post-quantum protection into the newer regional key-management design.
The company is also preparing additional integrations for existing content-delivery services.
23 October 2026
Post-quantum GeoKey Manager technical design published.
Current stage
Closed beta testing.
First quarter of 2027
Planned general availability.
Further development
Additional integrations with regional services and content-delivery infrastructure.
The company has not claimed that its new system makes every service on its global network resistant to all future quantum-computing attacks.
The announcement describes a particular cryptographic architecture and its intended deployment within selected products.
The wider rollout will determine when customers can use the new protection outside the present testing programme.
Cloudflare Engineering, Post-Quantum GeoKey Manager, 23 October 2026
