Skip to content

Tenant-Deployed Cloudflare SaaS - Edition v1

Edition metadata

Targets: Cloudflare Pages · Workers · resource bindings · Wrangler · GitHub Actions · optional Pages Functions/D1 Reviewed: 2026-07 · Next review due: 2027-07 Status: latest · Pin as: tenant-deployed-cloudflare-saas@v1 Canonical URL: https://vibecodeqa.online/standards/tenant-deployed-cloudflare-saas/v1/

This edition captures the gold standard for a tenant-scoped SaaS deployment model on Cloudflare. It focuses on the seams between tenant resources, preview exposure, binding and secret scope, promotion gates, data-resource state, provisioning, observability, and audit.

Rule shape

Each rule has a stable ID (R-<AREA>-<n>), one checkable statement, the reason it exists, a vcqa signal, and primary references.

The rubric

# Area Code What it governs
1 Suitability and shape FIT / SHAPE when this stack is justified and how deployable surfaces are named
2 Tenant resources RESOURCE / DOMAIN / OWNER tenant manifests, resource ownership, shared-resource exceptions
3 Environments, secrets, and bindings ENV / SECRET / AUTH scoped bindings, secret lifecycle, server-side authorization
4 Preview access and aliases PREVIEW / ALIAS / INDEX preview safety, protected aliases, public indexing posture
5 Promotion, data resources, and rollback PROMOTE / DATA / ROLL deploy evidence, migration order, code rollback vs data restore
6 Provisioning and runbooks PROV / DOC / SMOKE repeatable tenant lifecycle and acceptance checks
7 Observability and audit OBS / AUDIT / INCIDENT tenant context in logs, mutating-operation audit, incident evidence

Non-negotiables

  • R-FIT-1 - tenant deployment boundaries are justified by a real operational need.
  • R-RESOURCE-1 - every production tenant has a manifest of Cloudflare resources, environments, owners, and runbooks.
  • R-ENV-1 - bindings are scoped by tenant and environment.
  • R-PREVIEW-1 - preview deployments are access-controlled or explicitly public-safe.
  • R-PROMOTE-1 - promotion gates name the tenant, environment, commit, deployment, and migration set.
  • R-DATA-1 - tenant data-resource isolation is the default; shared resources require documented risk and tests. D1-backed variants also apply the D1 App rubric.
  • R-ROLL-1 - rollback and fix-forward treat code and data state separately.
  • R-PROV-1 - tenant provisioning is repeatable from documented steps or automation.
  • R-OBS-1 - logs carry tenant, environment, deployment, and target-resource context.
  • R-AUDIT-1 - mutating tenant operations create audit evidence.

Reports and scans should cite this pinned edition URL: https://vibecodeqa.online/standards/tenant-deployed-cloudflare-saas/v1/

Reference baseline