Current State
Cloudflare is excited to offer a Proof of Value to VSCO to evaluate Cloudflare for SaaS as the infrastructure layer powering VSCO's custom hostname initiative. VSCO operates a B2C creative platform with a large base of creator accounts who use custom domains — each requiring automated SSL/TLS certificate provisioning, edge routing, and per-hostname security policy enforcement at scale.
VSCO's current custom hostname architecture requires manual certificate lifecycle management and does not natively support per-hostname WAF policies or edge-level routing logic. As VSCO's creator ecosystem grows, the operational cost and complexity of managing thousands of custom hostnames under their SaaS platform is a measurable bottleneck to shipping creator-facing features.
Both parties have agreed to a time-bounded POV to demonstrate Cloudflare for SaaS' ability to automate SSL/TLS provisioning, apply per-hostname edge policies, and support VSCO's roadmap for custom domain-enabled creator features — including potential Workers for Platforms extensibility.
VSCO has been an active Cloudflare customer since 2024. The current contract covers WAF, Bot Management, CDN, and R2. The CF for SaaS / custom hostname initiative represents an expansion into the platform tier, driven by VSCO's engineering team (Benji Hertel, Jeremy Hertel, Andreas Salme) and CTO Chris Haire, who is both decision maker and signer.
Objectives
The following objectives define what both Cloudflare and VSCO intend to accomplish through this POV:
Confirm the operational pain points around certificate provisioning, hostname lifecycle management, and per-hostname routing and security policy today.
Validate that CF for SaaS' custom hostname API, automated SSL via DCV, and per-hostname Worker/WAF binding covers VSCO's requirements without requiring significant application-layer changes.
Agree on finite, testable outcomes that constitute POV success — hostname provisioning time, SSL issuance success rate, certificate renewal automation, and WAF policy propagation per hostname.
Establish start/end dates, check-in cadence, and the contracting process if the POV is successful — including expansion on top of VSCO's existing Cloudflare agreement.
Align on who owns each workstream at VSCO and Cloudflare, and the weekly cadence already in place with the VSCO engineering team.
Proposed Solution Overview
Cloudflare for SaaS enables VSCO to offer custom domains to creators by operating as the authoritative edge for those hostnames — handling TLS automation, routing, and security policy — without VSCO needing to manage certificates or build custom hostname infrastructure themselves.
Cloudflare Products in POV
Cloudflare for SaaS
docs ↗The core product. VSCO provisions custom hostnames via the Cloudflare API — each hostname receives its own SSL/TLS certificate (DCV automated), edge routing, and is bound to VSCO's fallback origin. Supports tens of thousands of hostnames with no per-hostname operational overhead.
SSL/TLS — Custom Certificates
docs ↗Automated certificate issuance and renewal for every custom hostname. Cloudflare handles DCV (HTTP, TXT, or email validation), issuance via DigiCert or Let's Encrypt, and automatic renewal — no manual cert management for VSCO's engineering team.
Workers for Platforms
docs ↗Optional but in-scope: Workers for Platforms lets VSCO deploy per-hostname edge logic (creator-specific routing, A/B tests, custom redirect rules) without routing all creator traffic through VSCO's own infrastructure. Aligns with VSCO's existing Workers for Platforms exploration.
WAF — Per-Hostname Rules
docs ↗WAF managed rules and custom rules applied at the per-hostname level. VSCO can enforce a baseline security policy across all creator custom domains, with the ability to override per-hostname where needed — without running separate WAF infrastructure per creator.
Use Cases & Success Criteria
Cloudflare and VSCO agree on the following finite and measurable success criteria to be validated during the POV.
At the end of the POV, VSCO will confirm the success or failed delivery of each criterion. Cloudflare will maintain active entitlements through contracting if the POV is successful. If the POV is not successful, Cloudflare will deactivate the CF for SaaS entitlements upon written confirmation.
| Use Case | Pain Point | Success Criteria | Outcome |
|---|---|---|---|
| Custom Hostname Provisioning | Manual certificate lifecycle management for creator custom domains is operationally expensive and error-prone. Certificate renewals require engineering intervention and cause periodic downtime for creators. |
|
Necessary |
| SSL/TLS Certificate Automation | VSCO's current certificate management does not scale to the planned creator custom domain growth. Each new hostname requires manual engineering work to provision and renew certificates, creating a bottleneck to the creator domain feature launch. |
|
Necessary |
| Per-Hostname WAF Policy | VSCO needs to enforce baseline security rules across all creator custom domains without building and operating per-hostname security infrastructure. Existing WAF rules on vsco.co do not automatically propagate to custom hostnames. |
|
Desired |
| Workers for Platforms — Edge Routing | VSCO wants to enable per-creator customization at the edge (routing rules, feature flags, A/B tests on custom domains) without routing all creator traffic through VSCO's application servers. Current architecture requires application-layer handling for all hostname-specific logic. |
|
Desired |
| Scale & Operational Cost | At VSCO's projected creator custom domain volume, the engineering and ops cost of managing hostnames outside CF for SaaS is unsustainable. VSCO needs a demonstrated path to operating tens of thousands of hostnames with minimal engineering overhead. |
|
Necessary |
POV Timeline
The POV is scoped to a 4-week engagement with weekly check-ins aligned to VSCO's existing Cloudflare cadence call. Milestone dates below are proposed; final dates to be confirmed at POV kickoff.
Participants
Check-in Cadence
VSCO and Cloudflare have an established weekly cadence call (Thursdays). The CF for SaaS POV check-ins will be folded into the existing meeting or scheduled as 30-minute add-ons aligned to the milestone schedule above. Kathy Ly is primary technical point of contact for POV questions between meetings.
Contracting
The CF for SaaS / Hostname Initiative expansion will be structured as an addendum to VSCO's existing Cloudflare agreement. The POV entitlements will be active at no charge for the duration of the POV period. Upon successful completion, Cloudflare will issue an Order Form for expansion.
Existing Agreement
VSCO's current contract covers WAF, Bot Management, CDN, R2, and Image optimization. The CF for SaaS expansion is additive to the existing SKUs under the same MSA.
Pool of Funds
VSCO and Cloudflare have an active Pool of Funds discussion. The CF for SaaS expansion and Workers for Platforms use case will be scoped against the confirmed Pool allocation. Final ACV to be reviewed at the Proposal Review check-in.
POV Entitlements
CF for SaaS entitlements (custom hostnames, per-hostname SSL, WAF for SaaS, Dispatch Namespace for Workers) are provisioned as a time-bounded POV. Entitlements are deactivated if the POV is unsuccessful, confirmed in writing.
Go/No-Go Decision
At POV end, VSCO will confirm success or failure of each success criterion. A majority of "Necessary" criteria must pass for POV to be considered successful and for Cloudflare to issue the Order Form.
Ted Patsos · ted@cloudflare.com · Account Executive, Digital Native West
Kathy Ly · kly@cloudflare.com · Solutions Engineer
Agreement to Proceed
By proceeding with the POV, both parties acknowledge the objectives, success criteria, timeline, and contracting terms outlined in this document.