About Anycast Network Routing
OneTrust's cloud hosting utilizes Cloudflare for network performance and security. Cloudflare utilizes the Anycast routing method, which allows multiple machines to share the same IP address. With the Anycast network, all IP addresses are assigned one particular country (i.e. United States), but the assigned country does not necessarily relate to where the information behind that IP address is being served or processed (i.e. Europe, the Middle East, and Africa). OneTrust IP addresses are IP addresses on the Anycast network, so they may look like a location other than the data center outlined for the application environment. However, the requests you make will be directed and stored in a specific data center through OneTrust's cloud hosting provider Microsoft Azure. For more information, see About OneTrust Hosting Options, Locations, and Backup.
What does Cloudflare do for OneTrust?
Cloudflare provides a variety of services to protect our customers, which in turn protects our customers' end users. The security processing in OneTrust's global network analyzes traffic for attacks and other threats and blocks them. Those processes produce logs with analytical data for our customers to use, which is the data transmitted to the United States and stored in our data centers.
These logs do not contain the contents of end user communication with our customer’s sites.
As with any online provider, internet service provider (ISP), etc., Cloudflare uses IP addresses assigned to OneTrust by Internet registration authorities, formerly the Internet Assigned Numbers Authority (IANA), now by the Regional Internet Registries (RIR). Cloudflare’s IP address blocks are assigned by the American Registry for Internet Numbers (ARIN), which is the registry for the Americas, including the United States. This means that address blocks assigned to an entity within the United States are “mapped” to the United States when looked up. However, this does not mean that the host assigned with one of those IP addresses is physically located in the United States. Cloudflare uses these assigned IP addresses to run OneTrust's global Anycast network.
What is Anycast?
Anycast is a network routing method which can route incoming traffic to a variety of different data centers. The Anycast network distributes incoming requests to the nearest data center that has the capacity to process and respond efficiently. With the Anycast network's use of selective routing, the load can then be spread across other available data centers, which helps provide network resiliency against high traffic volume, network congestion, and distributed denial-of-service (DDoS) attacks.
OneTrust utilizes Anycast to provide services for our customers in all of our global locations. Our customers configure their websites to advertise to the Internet via Cloudflare’s nameservers, so their traffic flows through Cloudflare’s network in order to deliver the security and performance that OneTrust offers. This is the reason why you will see United States IP addresses associated with our customers. These IP addresses are actually Cloudflare systems on the Anycast network that are protecting our customers’ sites.
For more information on Anycast, see Cloudflare's What is Anycast? How does Anycast Work? article.
Frequently Asked Questions (FAQ)
The following responses are supported solutions to frequently asked questions (FAQ) about the OneTrust application. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified.
How do I know which data center my account is in?
A cdn-cgi trace can be run to identify the data center that you are connected to and therefore the country through which your traffic is routing. The cdn-cgi is a reserved path for the content delivery network (CDN) that exposes valuable information about the connecting edge.
To run a cdn-cgi trace, add /cdn-cgi/trace? to the end of the URL for your environment, such as https://app.onetrust.com/cdn-cgi/trace? or https://youramazingcompany.my.onetrust.com/cdn-cgi/trace? From the response, you can then determine the connecting location by examining the colo and loc headers. The colo header represents the airport code that can be identified using the Cloudflare System Status page. The loc header identifies the country through which your traffic is routing.
I performed a trace and see an IP address that looks like it is from a different location. Is this a performance issue?
OneTrust's cloud hosting utilizes Cloudflare for performance and security. Cloudflare utilizes the Anycast routing method, which allows multiple machines to share the same IP address. Though it may look like the IP address is from a location other than the data center outlined, in reality, the requests you make will be directed to the machine in the data center closest to where you made the request. This allows requests to be routed using a faster and more reliable network path.
Does all end user traffic go to the United States?
No - End users visiting a customer site are directed to the nearest available point of presence (PoP) on Cloudflare’s network where the security and performance technology operates. Then, the shortest path to the customer site is taken to connect the end user to the site.
For example, if an end user in Germany visits a Cloudflare customer website located in Germany, that user will be directed to one of Cloudflare’s PoPs in Germany. Then, Cloudflare will connect them via the quickest route to the customer site. In almost all cases, the traffic would stay completely in Germany. However, if there was a large Internet disruption in Germany, an exception would be made and the traffic could be directed through an adjacent available EU PoP.