However, these countries are now increasingly using Cloudflare Workers without realizing that this creates total uncertainty about where their data and business logic might end up—including potentially adversarial countries like Russia and China.
Data in transit and data at rest can be encrypted. But Clouflare Workers is neither. It's data being processed in-memory where it will be unencrypted.
Unless it's below L7/HTTP, the possibility of doing it securely is very questionable.
Up until very recently it was very trivial to conduct "domain fronting" of sorts but with colocations in hostile locations. So Chinese or Russian servers decrypting your TLS traffic no questions asked, and that was with their premium (DLS) offerings.
I suspect that if you're in a hostile country where CF announces their prefixes locally, it's still doable. Unfortunately that's a bit more difficult to test than it was before.
Workers run everywhere. On every location shown on that map. Granted, you need a special license and Enterprise feature to use the China ones.
Cloudflare's Data Localization Suite gives you some control over where things run: https://www.cloudflare.com/data-localization/
Durable Objects specifically support jurisdiction restrictions, to keep your data strictly inside EU (for GDPR) or FedRAMP-compliant locations. https://developers.cloudflare.com/durable-objects/reference/...
The current set of locations supporting Durable Objects is mostly a function of where we have the resources available to operate the distributed database which we use as the storage back-end for first-generation DOs. We recently announced a new storage backend for Durable Objects, which is based on SQLite and a lot of in-house tech instead of an off-the-shelf distributed database. This new backend gives us a lot more flexibility in terms of locating data. There's a lot of work to do, but I would expect that we'll have more than just EU and FedRAMP as jurisdictions eventually. https://blog.cloudflare.com/sqlite-in-durable-objects/
Not specific to Workers: China is special. Your site will not be served from China at all (and your Workers will never run there) unless you've explicitly signed up for China network access. (I think the Chinese government requires a special licence for it? But I'm not an expert on this.) https://www.cloudflare.com/application-services/products/chi...
I don't personally know the current situation in Russia, or how physical security is managed in general (it's not what I work on, personally). I've heard some talk of trying to get the team to write a blog post about it, which I too would be interested to read!
For cloudflare to refer to encryption in transit is quite something, given that cloudflare is the largest MITM service in the planet. SO much traffic goes through them and they have it all in cleartext due to terminating TLS.
Remember "Encryption removed and added here".
Notably, while Cloudflare has CDN edge locations in countries like China and Russia they don't appear to run workers there.
EDIT: I was wrong - I misinterpreted the map. A solid border circle around a location indicates "Worker-only Datacenter" (see the map legend) and there are indeed locations with those solid borders in Russia (including Moscow and Yekaterinburg) and China (Haidong, Lanzhou and more).
I doubt we could get them on the record for this, but I suspect this may be very deliberate. Maybe CDN edge locations can be run completely securely with forwarded encrypted traffic, while workers are at a higher risk of physical attack.