A private redaction tool with no servers and no VPN.

The requirements

The tool was meant for a defined subset of users. There was no on-prem infrastructure to host it, remote users still needed secure access, and exposing an app stack with APIs, storage and document processing to the public internet wasn't an option. A basic login prompt isn't meaningful security: SSO helps with identity at the application layer, but doesn't address network exposure or enforce access decisions before traffic hits the app.

• Access limited to authorized users only
• Secure remote access without VPN dependency
• Identity-based controls beyond passwords or OAuth alone
• Edge-enforced protection against credential compromise
• Minimal operational overhead for monitoring and remediation

The restrictions

These requirements ruled out traditional hosting: no infrastructure, no client VPNs, no new hosts to manage and no public exposure of the origin. That pushed the design toward Cloudflare Access Zero Trust Network Access.

The solution

The app was deployed on Cloudflare Workers - serverless code running across the global edge, close to users, with fast startup, automatic scaling and no idle capacity. Cloudflare Access sits at the edge in front of the application and enforces identity-based policies before any request reaches it, integrating with the existing SSO/IdP over OAuth/OIDC. For the user it's a brief auth screen, then they're on the tool - no extra passwords, no VPN client, no OTP codes.

The OCR pipeline, NER engine and RegEx recognizers run as containers that spin up on demand for long documents. What used to require managed infrastructure or Kubernetes is now configuration: instances scale up during peak use and back down when idle, so cost tracks workload directly.

Biggest wins

Conclusion

Cloudflare Workers and Cloudflare Access delivered a high-trust redaction application that runs close to users, scales on demand and stays private by default - without traditional servers or VPN complexity. Identity remains central, but enforcement shifts to the edge, turning "just another login screen" into a network-level gate protecting APIs, storage and processing workloads before traffic touches the app. The result: better performance, a stronger security posture, lower operational overhead, and an architecture reusable for other sensitive internal tools.