They do have a process for securing other services behind Access, including arbitrary traffic and custom protocols like SSH, RDP, and SMB (although I'm not sure how much dogfooding is going on; @jgrahamc might be able to comment on that):

https://developers.cloudflare.com/cloudflare-one/application...