KAEMI × Cloudflare One
Cloudflare One: deployed, operated, done.
Zero Trust and SASE/SSE from one console – access, web security, private applications and data protection policies. KAEMI plans, deploys and operates the platform for you – without a risky big-bang rollout.
- Cloudflare One Specialized
- Cloudflare One ASD
- MSSP
Controlled rollout
Discovery, tenant setup, identity integration, policy design, pilot and handover – as an orderly process instead of a fire drill.
Grows with the risk
Start with access control, then add Gateway, CASB, DLP, Browser Isolation and Email Security – whenever it becomes necessary.
An end to tool sprawl
Access, internet security, data protection policies and logs in one policy model instead of five separate products.
Partner-led deployment
KAEMI is a Cloudflare Powered+ partner with Cloudflare One specialization, ASD and MSSP status – architecture, rollout, tuning and operations included.
Use cases
This is what it’s built for
Replace the VPN
Replace the classic VPN step by step with application-based Zero Trust access – no big-bang cut-over risk, pilot group first.
Migrate the secure web gateway
Move existing proxy/SWG solutions to Cloudflare Gateway: DNS, HTTP and egress policies centrally in one rule set.
Greenfield / new build
A new environment without legacy baggage? Zero Trust from day one – identity, device posture and policies set up cleanly instead of retrofitted.
Managed vs. DIY
Anyone can buy a license – operations make the difference
Do it yourself (DIY)
- –Your own team has to build platform and Zero Trust know-how
- –Policy fine-tuning and exceptions eat up internal time
- –Operations, monitoring and user support stay in-house
- –Misconfigurations often only surface in an emergency
- –Buying licenses alone does not solve any security problem
With KAEMI (managed)
- Architecture, policy design and rollout from a single source
- Pilot groups, change support and hypercare included
- Ongoing operations: tuning, updates, exceptions, reporting
- Experience from real Cloudflare One projects (ASD-certified)
- One point of contact – from license to operations
Managed plans
The official Cloudflare One bundles – as a managed service
Cloudflare One Essential
from €7.90 / user / month*
+ Cloud Email Security in the bundle: on request
- Zero Trust Network Access (Cloudflare Access)
- Secure Web Gateway (Cloudflare Gateway)
- Cloud Access Security Broker (inline)
- Cloud Email Security (Essential package)
- Cloudflare Tunnel, WARP client & mTLS
- Onboarding, operations & reporting by KAEMI
Cloudflare One Advanced
from €9.90 / user / month*
+ Cloud Email Security in the bundle: on request
- Everything in Essential
- Remote Browser Isolation
- Cloud Access Security Broker (multimode)
- Cloud Email Security (Advanced)
- Onboarding, operations & reporting by KAEMI
Cloudflare One Premier
from €12.90 / user / month*
- Everything in Advanced
- Data Loss Prevention (Cloudflare DLP)
- Cloud Email Security (Premier package)
- Onboarding, operations & reporting by KAEMI
The right service package for every bundle
The service package defines the service level for recurring services and the features provided – every bundle comes in three tiers.
Service package 1
License, provisioning & Basic Support
- Cloudflare bundle license and provisioning included
- Basic Support (L2/L3) with SLA on ticket responses
- Monitoring of up to 2 connectors
- Changes are ordered separately
€ / user / month*
Service package 2
License, provisioning & Premium Support
Everything in service package 1, plus:
- Premium Support: changes per RACI matrix included
- Monitoring of up to 5 connectors
- One onboarding day included (from 500 users)
€ / user / month*
Service package 3
License, provisioning, Premium Support & policy management
Everything in service package 2, plus:
- Policy management included
- Monitoring of up to 10 connectors
- Onboarding day included from just 300 users
€ / user / month*
€9.90 / user / month*
Monthly total: €990.00
Cloudflare One Advanced · Service package 1 · 100 users · incl. license & KAEMI service
Request this package – no obligation
* All prices in € per user per month, plus 19% VAT. Included are the Cloudflare bundle license and the KAEMI service in the selected service package (1–3); all bundles include WARP, Cloudflare Tunnel and mTLS. Prices may be adjusted at the end of a quarter to reflect €/$ exchange-rate fluctuations. We quote the PLUS variants with Email Security as well as environments with special requirements individually. Talk to us.
In detail
Feature comparison of the plans
| Feature | Essential | Advanced | Premier |
|---|---|---|---|
| Zero Trust Network Access (Access) | |||
| Secure Web Gateway (Gateway) | |||
| Device Client (Cloudflare WARP) | |||
| App Connector (Tunnel) + mTLS | |||
| CASB (inline) | |||
| Cloud Email Security (tier) | Essential | Advanced | Premier |
| Remote Browser Isolation | – | ||
| CASB (multimode) | – | ||
| Data Loss Prevention (Cloudflare DLP) | – | – | |
| + Cloud Email Security in the bundle | Bundle | Bundle | – |
| Guided onboarding (KAEMI) | |||
| Managed operations & tuning | |||
| Reporting & posture reviews |
Bundle = optionally available as a bundle variant with Cloud Email Security (Essential and Advanced). The integrated Cloud Email Security tier grows with the bundle (Essential → Advanced → Premier package). You can find details on the individual building blocks – from Access to Email Security – on our Cloudflare product page.
How deployment works
Productive in five steps
Discovery
Capture applications, user groups, identity providers and compliance requirements.
Tenant & identity
Set up the Cloudflare One tenant, connect the IdP (e.g. Entra ID, Google, Okta), define device enrollment.
Policy design
Design access, web and data policies – at the whiteboard, before they go live.
Pilot
Take the pilot group live, incorporate feedback, handle exceptions cleanly.
Rollout & operations
Staged rollout to all users; then operations, tuning and reporting by KAEMI.
FAQ
Frequently asked questions
Does Cloudflare One completely replace our VPN?
In most environments, yes – step by step. Individual applications are moved to Zero Trust access first, while the VPN keeps running in parallel. Only once all access flows cleanly through Access is it switched off. A big-bang cut-over date is not necessary.
How long does deployment take?
That depends on your application landscape and identity provider. The pilot with the first applications and user groups is typically up and running within a few weeks; the full rollout follows in stages.
Do we need new hardware?
No. Cloudflare One is a cloud platform – connected via the WARP client on end devices and Cloudflare Tunnel for private applications. Existing firewalls and appliances can be phased out step by step.
What happens to our existing security tools?
Cloudflare One typically consolidates VPN, web proxy/SWG, CASB and parts of the DLP landscape into one policy model. What gets replaced and what stays is clarified during discovery – consolidation is an outcome, not a prerequisite.
Who operates the platform after the rollout?
KAEMI – in every plan. Managed operations, policy tuning, exception management and regular reporting are always included. As a Cloudflare One ASD- and MSSP-certified partner, we cover the complete lifecycle – from the first pilot to steady-state operations.
How is pricing structured?
Per user per month, all-inclusive: the price covers the Cloudflare bundle license and the KAEMI service. The scope is set by the service package – from service package 1 (license, provisioning and Basic Support) to service package 3 (Premium Support and policy management). We quote the bundle variants with Cloud Email Security individually.
Ready for Zero Trust without the big bang?
In an analysis workshop we clarify your application landscape, identity provider and the right plan – no obligation, and concrete.
Request an analysis workshop