TYO Reach vs Cloudflare Access
Cloudflare Access (part of Zero Trust) puts a login wall in front of your internal apps. TYO Reach gives your team a managed exit point for traffic going out to the public internet. They guard opposite ends of the connection.
Inbound protection vs outbound control
Cloudflare Access — guard your apps from the internet
Access puts Cloudflare in front of your internal tools. A team member goes to your app's URL, Cloudflare intercepts, verifies identity via your IdP (Google, Okta, Azure AD), and only lets them through if they pass. Your app never gets a direct hit.
TYO Reach — control where your traffic goes out
Reach sits between your team's devices and the public internet. All outbound browser and app traffic exits from a fixed gateway IP. External SaaS tools see that IP — not your users' home IPs. Reach also enforces MFA at login and lets you set routing rules centrally.
Side by side
| Feature | TYO Reach | Cloudflare Access |
|---|---|---|
| Static egress IP for team outbound trafficCF: Dedicated Egress IPs available on Enterprise plans only | ✓ Yes | Partial |
| Internet gateway — outbound routing controlCF: WARP + Gateway available but complex to configure | ✓ Yes | Partial |
| Protect internal apps with identity-aware proxyReach doesn't protect your apps from inbound requests | ✗ No | ✓ Yes |
| IdP federation (Google, Okta, Azure AD) | Coming soon | ✓ Yes |
| MFA on every login | ✓ Yes | ✓ Yes |
| Per-app domain routing rulesCF: via Gateway DNS/HTTP policies | ✓ Yes | ✓ Yes |
| Australian-hosted identityCloudflare identity is US-hosted | ✓ Yes | ✗ No |
| Works on managed machines (no kernel driver)CF: WARP client installs a kernel-level network adapter | ✓ Yes | Partial |
| Consumer / personal planCloudflare is teams-only product | ✓ Yes | ✗ No |
| Free tier (small teams) | yes (personal 500 MB) | yes (up to 50 users) |
| Audit log | Coming soon | ✓ Yes |
| Device posture checks | ✗ No | ✓ Yes |
| Network tunnel to your private LANCF: Cloudflare Tunnel; Reach ZTNA coming | Coming soon | ✓ Yes |
| Pricing | Per seat (SMB-priced) | Free ≤50 users; $7/user/month Pay-As-You-Go; Enterprise custom |
When to choose which
Choose Reach if…
You need your team's traffic to exit from a static, auditable IP address — for SaaS IP allowlists, APAC geo requirements, or controlled egress policy. Also the right call if you're on endpoint-protected Windows machines where WARP's kernel driver would be blocked.
Choose Cloudflare Access if…
You self-host internal tools (a wiki, a dev environment, an admin panel) and need to gate them behind SSO without opening firewall ports. Cloudflare's inbound identity proxy is best-in-class for this use case.
Use both if…
Most mature teams do. Cloudflare Access guards your inbound-facing internal apps; Reach manages where your team's outbound traffic appears. They complement each other naturally.
Can Cloudflare Gateway replace TYO Reach?
Cloudflare Gateway (the outbound filtering piece of Zero Trust) overlaps with Reach's routing capabilities, but it requires the WARP client — a kernel-level network adapter that is frequently blocked on endpoint-protected machines. Reach uses a user-space proxy approach that works without admin rights or a kernel module. Gateway also requires Cloudflare as your DNS resolver, which some organisations prefer to keep internal.
Does TYO Reach protect my internal apps like Cloudflare Access does?
Not yet. Reach ZTNA (reverse tunnel access to LAN resources) is on the roadmap but not available today. If you need to gate internal apps behind an identity-aware proxy right now, Cloudflare Access or a similar solution is the right choice for that piece.
Can I use TYO ID with Cloudflare Access?
Cloudflare Access supports any OIDC-compatible identity provider. TYO ID is OIDC-compatible — federation with Cloudflare Access is technically possible, though not yet documented as a supported path. If this is important to your setup, contact [email protected].