Architecture and ownership

CFsend is a BYOC email platform. Free, Pro and Business all deploy the sending path into the customer’s Cloudflare account.

Data path

Your application calls your Runtime URL with a scoped key. The Worker validates requests and policies, D1 stores messages and operational state, Queues process delivery, R2 stores attachments, KV stores selected configuration, and Durable Objects coordinate operations. Secrets remain in your Cloudflare account.

The CFsend control plane handles sign-in, organization and billing, Cloudflare OAuth, installation, verification, managed upgrades and repair. It is not a shared email relay. A deployed Runtime continues processing its own traffic if the control plane is temporarily unavailable.

Ownership by plan

Free is still customer-owned and can send through the deployed Runtime. Pro adds managed Runtime updates and rollback. Business adds Campaigns, Audiences, chunked CSV imports and Automations. Cloudflare infrastructure and Email Service usage are separate from the CFsend subscription.

Security boundary

Create one API key per application and environment. Applications need the Runtime URL and key, not CFsend login or Cloudflare access. Runtime data is not stored in the Business Mail database and CFsend does not provide employee mailboxes, Webmail or an IMAP gateway.