Cloudflare Buys Startup Zaraz To Secure, Speed Up Websites

‘We’ve spent the last half year testing Zaraz, and it’s magical. It gives you the best of the flexible, extensible web while ensuring that CIOs and CISOs can sleep well at night,’ Cloudflare’s Matthew Prince and John Graham-Cumming wrote in a blog post.

Cloudflare has purchased early stage startup Zaraz to boost website speed and security without sacrificing privacy by reducing the impact of third-party marketing and analytics tools.

The San Francisco-based security and performance services vendor said Tel Aviv, Israel-based Zaraz uses Cloudflare Workers to replace the multiple network requests from each third-party tool with a single request. This improves the browsing experience and protects user privacy by giving customers the ability to control what data they send to a third party, according to Cloudflare.

“We were impressed by how the team at Zaraz used Cloudflare Workers in a unique way to help businesses get the insights they need, while delivering the lightning performance consumers expect,” Cloudflare co-founder and CEO Matthew Prince said in a statement. “We truly believe the next billion-dollar company can and will be built on Cloudflare Workers.”

[Related: Cloudflare Buys Browser Isolation Startup S2 Systems For $39.2 Million]

Terms of the deal were not disclosed, and Cloudflare did not immediately respond to a CRN request for additional comment. Cloudflare’s stock is down $2.10 (1.34 percent) to $154.07 per share shortly after trading opened Wednesday morning. Zaraz is the first company Cloudflare has acquired that’s built on its own Cloudflare Workers technology.

Zaraz was founded in 2019, employs six people and raised $2 million of seed funding in a February 2021 round led by PICO Venture Partners, according to LinkedIn and Crunchbase. The company’s technology transforms a messy web of extensions into a single lightweight application and prevents malicious code from entering websites by not running third-party tools on the browser.

“We couldn’t have built Zaraz without the global scale, speed and flexibility provided by Cloudflare Workers,” Zaraz co-founder and CEO Yair Dovrat said in a statement. “Using Workers meant that we were able to optimize Zaraz for performance and security.”

Zaraz’s technology strictly controls what scripts inserted onto a company’s webpage can do, ensuring that third parties wouldn’t have access to anything they weren’t authorized to see even if the scripts were compromised, according to a blog post from Prince and Cloudflare CTO John Graham-Cumming. Zaraz also ensures that scripts wouldn’t keep a webpage from rendering even if it failed or was slow.

Specifically, they said Zaraz completely removes the attack surface in the event of compromised script by eliminating the ability for attackers to create username and password fields or access cookies that are stored in the user’s browser. Zaraz is immediately available to Cloudflare’s enterprise customers, while other Cloudflare customers can access a free beta version of Zaraz on their dashboard, they said.

“We’ve spent the last half year testing Zaraz, and it’s magical,” Prince and Graham-Cumming wrote on the blog post. “It gives you the best of the flexible, extensible web while ensuring that CIOs and CISOs can sleep well at night knowing that even if a third-party script provider is compromised, it won’t result in a security incident.”

Cloudflare sits in front on nearly 20 percent of all websites today, and Zaraz’s technology will be helping protect all of them before long, according to Prince and Graham-Cumming. Third-party script developers who aren’t properly securing their scripts will find that their scripts stop working as Zaraz rolls out across more of the web, they wrote.

This will ensure that scripts running on Cloudflare customers’ sites meet modern security, performance and reliability standards, Prince and Graham-Cumming said. Zaraz will leverage Cloudflare’s expertise to expand its feature set and help customers deal with more security threats and privacy risks presented by third-party code, Zaraz CEO Dovrat wrote in a blog post.

Geolocation triggers will make it possible to load different tools to end users who visit a company’s website from different parts of the world, ensuring that businesses are compliant with local regulations, Dovrat wrote. In addition, a data loss prevention feature will scan every third-party endpoint request to ensure it doesn’t include information such as names, email addresses or Social Security numbers.

“Together with Cloudflare, we will play a leading role in the shift to cloud loading of third-party code,” Dovrat wrote in the blog post. “In no time, we are all going to enjoy a browsing experience that’s 40 percent faster, simply by optimizing how websites load third-party tools.”

The Zaraz acquisition comes nearly a year after Cloudflare acquired automation platform Linc for an undisclosed amount to help front-end developers collaborate and build powerful applications. And in January 2020, Cloudflare purchased early stage browser isolation vendor S2 Systems for $17.7 million to keep security threats away from devices and make everyday web browsing safer and faster.