Regardless of whether or not you provide your own SSL certificates, cloudflare still uses their own between their servers and client browsers. So any SSL encrypted traffic is unencrypted at their end before being re-encrypted with your certificate. How can such an entity be trusted?
In regard to enterprises, they don’t give a rats ass about any potential intellectual property theft. That risk has been written off. What matters is compliance and security.
Not having DDOS protection in place can potentially have legal consequences and can be very costly. DDOS protection is either investing millions of dollars in equipment or offloading that responsibility to a company like Cloudflare.
That’s not true. It’s a mitigated risk through contract.
That’s true, I didn’t specify the circumstances.
In the case of overt IP theft, the contract is the mitigating factor.
However in the case of convert IP theft through systematic, transparent surveillance of traffic (what OP is alluding to), it’s something that you cannot really mitigate apart from just not being digitally present. Cloudflare is a player there, but so is any ISP and nation state who is curious enough. To be on the internet, you have to accept the risk that systematic surveillance can impact your intellectual property.
In some cases, your mitigating factor is the law. But it’s really difficult to prove that Cloudflare might be sniffing your data and using the IP unlawfully and it’s downright impossible to prove that the NSA or foreign intelligence is using your IP.
Let’s remember that Cloudflare is engaged in business with USG, so if they were doing that kind of nefarious stuff, it’d result in a bad time for a whole lot of folks.
i think you are completely wrong here. big corporations do cost assessments of security vs costs of security breaches. if security is more expensive than data breach, they will accept the breach.