top | item 34639212

Small SaaS banned by Cloudflare after 4 years of being paying customer

730 points| tardis_thad | 3 years ago

Hi, small SaaS founder here (tardis.dev) - I've been heavy Cloudflare Workers user (currently 4 billions requests & 1PB of data per month) for about 4 years already and today at 00:00 UTC without any warning my account was restricted, both website and APIs are down or very very slow to respond/time out, customers are angry obviously. I confirmed with support that "hmm, I see that your zone seems like being restricted due to 2.8 Limitation on Serving Non-HTML Content, see that there's high JSON data transfer". - which is bit strange as I'm using workers which have different terms - https://news.ycombinator.com/item?id=20791660 (confirmed by their CTO)...anyways I get it, perhaps I pay too little and should be on enterprise plan already, but when I got approached by Cloudflare sales team I explicitly asked if I can still be on pay as you go/self server model and reply was: "Enterprise wise, that's up to you and you could likely get away with utilising self-serve as you go, but if you did choose to go enterprise (without R2) I might be able to have something approved in the xx/month range."

I would fully understand that I am required to upgrade, but why not sending me an email before shutting down my business completely? I even asked about such scenario on zoom meeting I had with their Sales and they said it will never happen - few weeks forward and here we are...anyways going back to replying to my customers emails regarding service outage.

316 comments

order
[+] plesiv|3 years ago|reply
OP, you have garnered a lot of sympathy by the HN community which I believe in part contributed to your problem being resolved. I think it would be fair to provide more info about what the issue was in the end. It's not OK to be like "HN I had a bad experience with Company X" and then be like "k, thx @jgrahamc, bye" when your complaint gets resolved due to the attention it received.

There are so many questions this leaves unanswered:

- Was this a one-off error in Cloudflare's processes? (These things happen on a big enough scale.)

- Were you violating a specific clause of Cloudflare's T&C? How clear was the clause? What did you do to fix this?

- Was the issue that Cloudflare estimated that you're not paying enough given the bandwidth you're consuming? Did you end up signing up for the Enterprise plan?

Transparency would benefit both Cloudflare (in not making people unnecessarily apprehensive about becoming/remaining a customer) and you (in demonstrating that you're handling this issue in a professional and responsible manner).

[+] tardis_thad|3 years ago|reply
I'd be happy to provide more info but I have none. First I communicated with support which told me that my account was restricted most likely due to 2.8 clause violation (non html content) and suggested to contact with sales which I immediately did.

Sales over the phone (was fastest) told me that it's good I contacted as otherwise in 24hours my account would be fully banned(whatever it means) and that they will prepare me an offer in 15 minutes, but it was taking longer (no response after an hour or so) and in the meanwhile I wrote Twitter and HN post which CTO of Cloudflare noticed and then after a while I've got another phone call from sales that I should update my ticket to ask unbanning my account as it was approved now by CTO which I did and that solved the issue at least for now - and that's it - no further info what the issue was, still waiting on Enterprise plan quote for me.

[+] runnerup|3 years ago|reply
Would be nice if any parties which end up “using” HN to solve their customer service issues were somehow obligated to provide the community with a candid postmortem.

That would be the right way to give back for customers using us as an amplifier and for corporations relying on us to be a shibboleth (a prefilter so providers know that this is a true issue unsolvable through existing support channels they have established for customers).

Sharing these learnings with other potential founders would also be in line with the raison d’etre of HN. It would provide other founders with lessons they can takeaway and apply to their future startups to maybe do a few of these things right the first time around.

For both sides, HN is “picking up slack” in the system and it would be right to support the community with candid postmortems.

[+] nullcaution|3 years ago|reply
> It's not OK to be like "HN I had a bad experience...

That is rather aggressive?? Maybe thry live in another time zone and are asleep, or have other obligations like school pickup. Given them at least 24 hours to respond. sheesh...

[+] dezb|3 years ago|reply
oh it is 100% entirely OK to share that you got screwed by a company .. this crap happens all the time.. companies like this get away with ZERO shits give about customer support all the time.. it is insane..
[+] NicoJuicy|3 years ago|reply
Cloudflare is really transparant about things ( eg. outages).

Reality is that Cloudflare serves 60% of the internet and this issue popped up. They are checking it internally what happened, as I understand from jgrahamc.

[+] byteofbits|3 years ago|reply
The comments here have mainly focused on the issue of instant suspension - which is obviously deeply concerning - but I also feel like there is a huge issue at Cloudflare regarding their Enterprise pricing model.

Cloudflare's sales team and Enterprise pricing model are one of the least effective sales organisations I have encountered in this space. Given the technical nature of their product, it's extremely hard to explain even basic uses of the tool and things like Workers are near impossible to discuss with them. I was really unsurprised to see that OP had a failed Enterprise negotiation with them as I have had the exact same conversation at three different companies now and can imagine perfectly what you were told.

The current offerings of Enterprise and Enterprise Lite simply do not map to the reality of how people use the tool and scale businesses on top of it. I think in part due to Cloudflare's history essentially selling bandwidth and caching, the model is fixated on high binary traffic workloads and simply cannot comprehend the SaaS service model that runs on it and tools like Workers.

This is mostly a rant and hopefully a small +1 signal that this area needs major improvement - but I would also love to hear if anyone else has had interactions with Cloudflare Enterprise and how they found that process?

(Disclaimer: I'm a massive fan of Cloudflare, a user of their products and hold their stock)

[+] tardis_thad|3 years ago|reply
I'm also a massive fan of Cloudflare in general, love their Workers and related products, just that one aspect of account suspension without warning could be improved a little bit :)
[+] bob1029|3 years ago|reply
> Cloudflare's sales team and Enterprise pricing model are one of the least effective sales organisations I have encountered in this space.

I have seen this everywhere. Any large software company seems to operate with 2 completely different heads when it comes to technical sales support.

The "best" experience I've had was with GitHub Enterprise sales, but mostly because they just gave me access to the docs/binaries without much frustration. If I had a bunch of questions about the technology vs cost vs how we actually want use their product, it would have been a substantial nightmare.

[+] asmor|3 years ago|reply
I've been in a sales call with a German CF representative, and it just seemed to be a third party being excited about the features using the demo account half for their hobby and half for demonstrations with almost every feature set up and demoable. They even hosted their own toy AS on Cloudflare Magic Transit.

It was pretty novel and refreshing.

[+] IanCal|3 years ago|reply
What even is the restriction on returning JSON? One of the examples is explicitly how to return JSON

https://developers.cloudflare.com/workers/examples/return-js...

From the terms

> 2.8 Limitation on Serving Non-HTML Content

> The Services are offered primarily as a platform to cache and serve web pages and websites. Unless explicitly included as part of a Paid Service purchased by you, you agree to use the Services solely for the purpose of (i) serving web pages as viewed through a web browser or other functionally equivalent applications, including rendering Hypertext Markup Language (HTML) *or other functional equivalents, and (ii) serving web APIs subject to the restrictions set forth in this Section 2.8*. Use of the Services for serving video or a disproportionate percentage of pictures, audio files, or other non-HTML content is prohibited, unless purchased separately as part of a Paid Service *or expressly allowed under our Supplemental Terms for a specific Service*. If we determine you have breached this Section 2.8, we may immediately suspend or restrict your use of the Services, or limit End User access to certain of your resources through the Services.

Supplemental terms

> The Cloudflare Developer Platform consists of the following Services: (i) *Cloudflare Workers*, a Service that permits developers to deploy and run encapsulated versions of their proprietary software source code (each a “Workers Script”) on Cloudflare’s edge servers; (ii) Cloudflare Pages, a JAMstack platform for frontend developers to collaborate and deploy websites; (iii) Cloudflare Queues, a managed message queuing service; and (iv) Workers KV, Durable Objects, and R2, storage offerings *used to serve HTML and non-HTML content.*

I can't quite figure out how to parse this such that workers would be deemed unusable to just run an API.

I'd absolutely have gone ahead with using it for an API.

[+] tardis_thad|3 years ago|reply
Seems like my account was restricted due to https://www.cloudflare.com/en-gb/supplemental-terms/#cloudfl...

2.Cloudflare may, with or without notice to you and without liability of any kind, temporarily limit your storage and/or the number of requests you can make or receive using the Developer Platform for any reason (in its sole reasonable discretion), including without limitation, if processing such requests would put an undue burden on the Cloudflare network, adversely impact the Service, or otherwise threaten the integrity of Cloudflare’s networks.

To be fair I'm using lots of requests and bandwidth so could be reason, just if only I got an email about that before shutting everything down.

[+] vishalchandra|3 years ago|reply
Cloudflare has non-transparent pricing, unlike AWS, which will charge you for every thing with detailed usage tracking.

When ever there is non-transparent pricing, it's scary to try and use an infrastructure related service.

The sales teams can't go around saying that you are not a profitable customer, and they can't argue with the marketing team to be more honest about pricing on the pricing page.

So, end result, let's bump of these small free loaders. Large enterprise deals is what gets us the bonus anyways.

I like fly.io pricing in that sense. And I am sure there might be others offering a more transparent pricing, otherwise like me still stuck on AWS.

[+] vb-8448|3 years ago|reply
Very similar to this other one https://news.ycombinator.com/item?id=34235237

I just repost the same comment I put in the above thread

> The thing that scary me most is that his business get shut down without any notice period (at least the author not mentioning any previous communications from Cloudflare team about the issue).

> This is really a shitty thing from Cloudflare, you cannot shut down an already running business without any notice/grace period.

[+] mynameisvlad|3 years ago|reply
I disagree. The other one was a clear case of someone knowingly breaking the TOS (same non-HTML content but in that case they were hosting a service which almost exclusively returns non-HTML content). The OP even admitted in the comments that they knew very well they were breaking the TOS but wanted some notice.

I don’t really feel any sympathy for that poster. They knowingly broke the rules, they had to have known that CF could come and shut them down at any time, and they still went ahead and threw the pity party knowing that they are pretty much entirely in the wrong. It’s very much a “play dumb games, win dumb prizes”.

Would it be nice for CF to give a heads up? Sure. But I don’t think it’s required, and especially not in an egregious case like that one.

[+] tardis_thad|3 years ago|reply
Around 12:00 UTC today ban has been lifted for my account thanks to @jgrahamc - thanks!
[+] cultofmetatron|3 years ago|reply
Literally just sent an email to my devops guys to move off cloudflare asap. This cavalier lack of respect is a diservice and insult to all the people who rely on my product for their livelihood.
[+] rexreed|3 years ago|reply
From an earlier comment I made regarding Stripe shutting merchants down, and those merchants resorting to posting on HN and getting someone on HN to advocate for them to resolve their problem [0]:

"The main issue is not that [COMPANY] is working hard to protect itself and its customers, but that customers feel very powerless in these situations. When it takes a massive effort to get attention, especially if you're small and powerless, you feel that you have no control, and that your issues will go unanswered. What can the average, powerless customer who doesn't have the weight of social media, HN, @dang, or others on their side do when their hard-earned money or business is being held, locked, or otherwise prevented, and when the cause is not fraudulent, or if the customer is unaware of that activity? The problem is that accounts are just shut down, moneys are held, and there's no quick or clear communication, with customer support simply saying it's not in their control. It's this feeling of powerlessness that's the issue, regardless of whether or not [COMPANY] is in its rights or doing what it feels is in its and its customers best interests.

What can you do to help empower the powerless customers when their livelihoods are at stake? Can you provide some way to not instantly assume fraud or malicious intent on behalf of the customer and provide some quick and direct way for the customer to feel empowered?"

Having to resort to HN to get major problems resolved that are major customer service and potential legal / liability issues causes me a lot of stress when I realize that I have don't have nearly the same sort of power or influence as some of the others here do on HN. I worry that my complaints would simply go ignored.

@jgrahamc would love you to comment on what we can do to avoid people having to resort to HN for a solution to these problems, which favors the well-connected and squeaky wheels and disfavors everyone else.

[0] https://news.ycombinator.com/item?id=34274456

[+] Dowwie|3 years ago|reply
4 Billion requests per month involving 1 Petabyte of traffic doesn't seem like a "small SAAS", at least packet-wise. If its small revenue-wise, addressing that is a business concern as important as having your platform throttled for using the cheapo economy edition tier of whatever you've signed up for with Cloudflare. Did Cloudflare issue any formal communication with you warning about usage and how it violates contractual terms, or did they "ban" you out of nowhere?
[+] tiew9Vii|3 years ago|reply
Sounds like OP has spoken with cloudflare previously about their usage/cloudflare services, likely looking to upgrade by the sounds of it but sales maybe gave the impression OP was ok on current level of service.

> I would fully understand that I am required to upgrade, but why not sending me an email before shutting down my business completely? I even asked about such scenario on zoom meeting I had with their Sales and they said it will never happen

[+] tardis_thad|3 years ago|reply
No formal communication at all as mentioned before if Enterprise plan is a must for my account I'll sign up on it, just was told before it was not required - I'm not using or need any enterprise level features.
[+] twawaaay|3 years ago|reply
I worked for a large bank, my internal backend would receive couple orders more requests from other internal apps and users and probably similar traffic.

It is very easy (relatively) to build a SaaS platform that serves this amount of traffic and this can be done by even a one determined individual or a small startup team.

I don't think it is useful to measure the size of the company in the amount of requests they are serving. Revenue/number of employees are much better measurements saying more about the type of things that are/can be happening. They may have relatively low margins per request and need to get to 4B to get by to pay for couple salaries?

[+] thejosh|3 years ago|reply
So them just banning the customers service with no explanation until they raise a stink here is okay?
[+] danuker|3 years ago|reply
[+] wrldos|3 years ago|reply
Wow that's a whole lot of ire, rivalling some other large tech firms. Definitely worth investigating. I consider Cloudflare to be an annoyance generally but I hadn't put it in context to what they ultimately have control over.
[+] jamespo|3 years ago|reply
All of that is well known surely, it's still the site owners choice, including whether to block tor traffic which is often the source of these issues.
[+] genewitch|3 years ago|reply
that site needs an editor. Like a human editor, so that everything is consistent looking.

And whatever happened to ngate?

[+] jgrahamc|3 years ago|reply
I've asked internally to understand this.
[+] throwaway6845|3 years ago|reply
I would really like you to clarify your intentions on serving non-HTML content.

I say this slightly nervously as a Cloudflare customer who serves some amount of binary data. One message is "it's ok if you're on a paid plan". Another is "it's not ok at any time". My suspicion is that "it's ok unless we notice you".

If you could come up with consistent understandable messaging that would help a lot. I don't mind paying (stay competitive against AWS and Hetzner and that's all I need) but the uncertainty is not good.

[+] rafaelturk|3 years ago|reply
I really curious about how this unfolds, I was planning to migrate from `AWS Lambda` to `Cloudflare Workers` as a paying customer. I'm basicaly an API with lots of JSON.

Why Cloudflare cancel paying Workers customers? Makes no sense to me.

[+] nickcw|3 years ago|reply
Can you clarify the terms an conditions about Cloudflare R2 please?

On the R2 page https://www.cloudflare.com/products/r2/ we see:

> No more egress charges. You shouldn’t have to pay to access your data. Pay no egress charges for data accessed from R2. Our affordable and consistent pricing means no more surprise bills.

Whereas I think the non-HTML traffic terms still apply to R2. Or do they?

[+] archon810|3 years ago|reply
Will you come back and tell us what happened here?
[+] tlonny|3 years ago|reply
[flagged]
[+] asmor|3 years ago|reply
I've recently dropped and then readded (a few months later) a zone to Cloudflare for a domain only I ever owned. And they refused to add it for "policy" reasons, so I had to wait a week or so until Cloudflare just unlocked it without providing any rationale.

It's not a company I trust to not randomly screw me over out of the blue anymore.

[+] sgarg26|3 years ago|reply
i'm about to move a significant amount of traffic to cloudflare. holding off until i see how this is handled. Can you please update this to reflect the total time of service outage and time to resolve. As a busy tech company, this is an unneeded problem. We pay cloudflare to be fast. Not make our sites slow and unresponsive.
[+] tardis_thad|3 years ago|reply
Outage started around 00:00UTC today.

I was able to contact via support chat to confirm it's indeed Cloudflare related issue as wasn't sure as it's not displayed in any form on Cloudflare dashboard that indeed account is restricted. That was around 8AM UTC.

Since then I also contacted with sales team (got the details already as they approached me in last few weeks as mentioned before) in order to upgrade to Enterprise plan as it seems like the only solution, but did not get the quote yet and account is still restricted.

[+] is_true|3 years ago|reply
By now most SLAs are already breached
[+] majestic5762|3 years ago|reply
I stopped paying for cloudflare after their support team was unable to debug why one of my rewrite conditions wasn't working. I provided them full details like for kindergarden, but they replied after days saying it's working on their end, lol. I deeply respect the cloudflare tech and the dev team, but support sucks and i don't trust cloudflare anymore. I won't pay even a single cent, even if they would have stellar support from now on. After reading all these cloudflare stories lately, and knowing how they treated me, i don't care about them anymore. Someone should write a "you probably dont need cloudflare" article. I'm disgusted by these kind of companies that grow large and they stop caring for the people who were there with them from day 1.
[+] genewitch|3 years ago|reply
just make your own CDN by installing an old raspberry pi on the network of every house you visit. Simple!
[+] andrewstuart|3 years ago|reply
"The large print giveth, the small print taketh away" has never been more true than with Cloudflare.

None of Cloudflare's marketing or technical documentation makes any explicit reference to "permitted usages" for Cloudflare services such as R2 and Workers.

This page for example means one thing without any reference to permitted usages and would mean something entirely different if the permitted usages were promoted with the same level of visibility as the benefits.

https://www.cloudflare.com/products/r2/

Nothing here tells me I cannot write my own video serving code with Workers:

https://workers.cloudflare.com/

You might even believe "whatever you need" from this paragraph from the above link:

"Static assets with dynamic power. Say goodbye to build steps which pre-generate thousands of assets in advance. Harness the unrivaled raw power of the edge to generate images, SVGs, PDFs, whatever you need, on the fly, and deliver them to users as quickly as a static asset."

This developer documentation would takes on an entirely new meaning if a link to "acceptable uses" was prominent at the top of each page (not fine print).

https://developers.cloudflare.com/r2/get-started/

https://developers.cloudflare.com/r2/data-access/workers-api...

https://developers.cloudflare.com/r2/examples/demo-worker/

Have built an entire application around assuming there were no such limitations I now need to rebuild elsewhere.

Humph.

I now no longer even understand what "no egress fees" means - in a way that's worse than the big cloud providers where at least you know they are charging you 9 cents per gigabyte.

[+] Roark66|3 years ago|reply
Looking at this with interest as I've multiple projects on cloudflare now and in development.
[+] matvp|3 years ago|reply
While I agree HN shouldn't be used as a way to get direct customer support, I don't think it's fair to grab and point our pitchforks to @jgrahamc over a one sided story. There's not nearly enough information from both sides to create fair judgement (these things happen, unfortunately, at larger scale with automated processes). What matters is the afterthought and actions taken of what's going to prevent a similar situation in the future (which I'd love to read from both OP and @jgrahamc if possible). HN is my go to stop for well formulated opinions written by people way smarter than me and I think we dropped the ball here, HN can do better. That said, happy that your issue got resolved OP and goodluck with your project!
[+] mathattack|3 years ago|reply
My experience with the Cloudflare sales team is they were woefully disconnected from any ability to make good on their promises, and that it didn’t matter to them at all. It was a strange narcissism -bit wasn’t that they were deliberately lying, it was as if the notion of truth and lies didn’t matter. That if they kept blabbering assumed that they’d get the sale.

In general you can’t trust salespeople and need to get everything in writing. Cloudflare is a prime example of why.

And I’d add in my case because we were keeping track of their promises, we caught them before the sales process completed. It cost them seven figures a year. But maybe it doesn’t matter - their sales approach still has them worth $20 billion.

[+] iinnPP|3 years ago|reply
I recently signed up to CloudFlare for their Yubi key deal that was still being advertised on their website. A week later I received an email saying only customers subscribed by a certain time could claim the offer.

I asked them to delete my data or provide the Yubi offer and they did neither. So they sit in an email folder known as bad companies. Because my data has value and they lied to obtain it for their own gain (aka fraud).

In Canada we have private prosecution/rules about falsely acquired data. Every bad story on HN puts me closer to opening that folder up and ensuring my data costs at least 100k.

Enough is enough.