A partner listing will not change a WAF rule when internet banking is under attack on a Sunday night.
Most of the African banks we work with do not fail at buying Cloudflare. They fail at naming who runs it after go-live. The longer buying guide is on How African banks should buy Cloudflare. This is the short list: how to choose the operator.
1. Name the surfaces before you name the vendor
Internet banking and the apps behind it. Payment and mobile-money APIs. Public sites and onboarding. Staff access to the core. Each has a different risk. If marketing and payments sit in the same project with nobody named on the account, the licence looks complete and the perimeter is not. Scope first. Then decide who runs it. The South Africa page is Managed Cloudflare in South Africa.
2. Write five names, not one mailbox
Who changes WAF. Who tunes bots. Who owns DNS and certificates. Who approves Zero Trust. Who leads a Cloudflare incident after hours. A mailbox is not a name. "IT, when they have time" is not a name. If any line is blank, go-live was a cutover, not an operating model. More on who operates Cloudflare after go-live.
3. Ask who is on the hook on Sunday night
If internet banking or a payment API is under attack at 2am, that is a named owner, not a ticket queue. Core is business-hours governance. Priority and Critical run 24/7. Clocks sit on the SLA. Packages are on Managed Cloudflare.
4. Buy the licence and the operator together
We sell the Cloudflare licence and we run the account. The platform and the operator are both part of the buy. Do not treat a listing as the operating model. The general cut is How to choose who runs Cloudflare.
5. Check change control and what you will show POPIA and the regulator
Routine change needs a rhythm. Emergency change needs a path. Keep configuration, change history, and incident notes. That is what you show internal audit, a POPIA reviewer, a PCI assessor, and your regulator, not a partnership slide deck.
6. Ask how you leave if the work is not being done
Prefer a term you can exit if the operator is not running the account. Keep the Cloudflare account when you leave.
Before you sign
Walk these with IT, security, and procurement in the same room. What is in scope? Who is named for WAF, bots, DNS, Zero Trust, and Sunday night? Does the quote cover both the licence and who runs it? Can you leave if the operator disappears?
If you want an operator who will size the account for a South African bank, deploy it against internet banking and payments, and stay after go-live, talk to us.
