Cloudflare Clears FedRAMP High, Bringing Post-Quantum Encryption to Agencies

Cloudflare said its government platform earned FedRAMP High certification and GovRAMP Moderate authorization, clearing it to handle the most sensitive federal data. The certifications are compliance milestones with nothing quantum about them. What makes the announcement relevant here is what rides along: Cloudflare already runs post-quantum encryption across most of its network, and that protection now reaches agencies inside an authorized federal boundary.

A compliance milestone first

Most of the August 10 announcement is govtech. FedRAMP High clears Cloudflare for Government to process High Impact data, the national-security and critical-infrastructure information where a breach could be catastrophic, and GovRAMP Moderate covers state and local workloads.

Cloudflare also said it intends to pursue the Defense Department’s Impact Level 4 authorization. The company says more than 100 US agencies already use its services, among them the Departments of State, Justice, and Homeland Security. None of that is a quantum story; it’s a cloud-security vendor widening its access to government buyers.

The part that counts for quantum

What sets Cloudflare apart from the usual “quantum-safe” pitch is that its post-quantum encryption is real and running. More than 60% of human web traffic reaching Cloudflare’s network was protected by hybrid post-quantum key exchange as of early 2026, pairing the standard X25519 with NIST’s ML-KEM, a defense against harvest-now-decrypt-later attacks that scoop up encrypted data today to break it later.

Folding that into a FedRAMP-High boundary means agencies get it by default on data in transit. The limits are worth stating: this guards traffic in motion rather than data at rest or the systems behind it, and the wider federal shift to post-quantum standards remains a long, costly job the government has barely begun, one analysts put in the billions of dollars. Still, a vendor that has already shipped PQC at scale, where others are only starting to build it into products, is a more credible carrier of it into government than most.