Cloudflare Launches Post-Quantum GeoKey Manager in Closed Beta

Cloudflare begins closed beta

Cloudflare has launched a closed beta of a post-quantum version of GeoKey Manager, a service designed to restrict where customers’ private encryption keys can be unwrapped. The release is part of the company’s Data Localization Suite and is intended to give organizations a technical control for keeping key use within selected countries or regions.

The closed beta is not generally available. Cloudflare said it begins with the beta, while general availability across its network is planned for the first quarter of 2027.

How regional key boundaries operate

GeoKey Manager distributes wrapped customer keys across Cloudflare’s network, while the regional root keys needed to unwrap them follow a separate provisioning path. Before receiving location-authorized root keys, an edge server must prove its hardware identity and regional membership, according to Cloudflare.

The company said the root keys are loaded into the Linux kernel keyring rather than stored persistently on disk. Requests are rejected if a required regional root key is missing or the service context, region or key epoch does not match. The design therefore operates on a fail-closed basis, with correct provisioning remaining important to availability.

Hybrid post-quantum cryptography

For the Cloudflare One path, Cloudflare said the system combines ML-KEM-768, a NIST-standardized post-quantum algorithm, with the classical X25519 scheme through Hybrid Public Key Encryption. HKDF-SHA-256 is used for key derivation and AES-256-GCM for authenticated encryption and application-specific key wrapping.

The reports describe the release as an early-access milestone rather than a generally available deployment option across Cloudflare’s products. They also identify the intended use as regional key control for services such as Gateway, Tunnel and Access, while noting that the reviewed reporting does not establish production deployment or customer procurement beyond the closed beta.

Scheduled general availability

The next verifiable milestone is general availability, which Cloudflare plans for the first quarter of 2027. The reviewed reporting does not provide a more specific launch date or confirm that the service has entered general availability.