What did Cloudflare launch on October 15?
On October 15, Cloudflare and VoidZero open-sourced three products for building and deploying full-stack Vite apps: the Void SDK, the Void CLI and the Void Platform.
The problem it targets is one most operating companies now share. A staff member can build a working internal tool with a coding agent in an afternoon, and nobody wants to hand each builder the keys to the cloud account.
The Void Platform is Cloudflare’s answer: a shared deployment environment you install in your own Cloudflare account, where an administrator decides who can ship, what each app may consume and who can open it.
Here’s what launched, what it changes for an operating company, what it leaves unsolved and how to decide whether to install it.
What is the Void Platform?
Void has three parts. The SDK turns a Vite app into a full-stack Cloudflare Workers app. The CLI builds that app, provisions the resources it uses, applies database changes and deploys it. The Platform is the shared home those apps deploy into.
Cloudflare states the motive plainly: companies want to encourage vibe-coded internal apps but are wary of the security risk and of giving cloud access to every employee. The platform runs on Workers for Platforms, Cloudflare’s product for running code written by customers, or by AI, in isolated sandboxes.
An administrator controls access, sets resource limits and inspects deployments and usage from the CLI or an admin dashboard. The source is MIT-licensed on GitHub, so a company can run it as shipped, contribute improvements upstream or fork it.
The platform enforces the path. Deciding who owns each app stays with you.
Cloudflare says VoidZero has run the SDK, CLI and Platform in production for the past several months. The public release is new this week, so treat it as a young open-source project with a capable owner behind it.
What does it change for an operating company?
Until now, a company that wanted staff-built tools had three weak options: personal hosting accounts nobody audits, a shared cloud login with far too much authority, or an engineering queue where a two-day tool waits for weeks.
The Void Platform adds a fourth: one governed environment inside an account the company already controls. Three details matter most to a buyer.
1. Access is enforced at the front door
Project Zero Trust puts Cloudflare Access in front of every project hostname, including custom domains, so visitors sign in with your identity provider before they reach an app. Void rejects policies that let everyone through, and a sign-in lasts 12 hours.
Protection is a setting, though. Each project can still be made public, and new projects are public unless an administrator switches on protection for them. Set that default before the first app ships.
2. The cost floor is modest and visible
Workers for Platforms requires a paid plan. Cloudflare lists it at $25 a month, with 20 million requests, 60 million CPU milliseconds and 1,000 scripts included before overage charges apply.
The installation prerequisites add R2, Analytics Engine, a login provider, a domain and an empty PostgreSQL database, which Void does not provision for you. Database and Cloudflare usage are billed separately. In our judgment, the platform bill is rarely the expensive part of a few dozen internal tools. Attention is.
3. Non-engineers become publishers
Cloudflare pitches the platform at teammates who do not normally write code: a designer sharing an interactive prototype, an operations lead sharing a dashboard. It also says the platform cuts the time to ship an internal app from days or weeks to minutes. That is a vendor claim about deployment speed. It says nothing about whether the app is right.
What does the launch leave to you?
A deployment platform settles where an app runs and who may open it. It does not settle what the app is allowed to know, who answers for it when it is wrong, or who keeps the platform itself healthy.
Plenty of internal-tool programs stop at the first working demo. Our standard is stricter: every app has an owner, a data boundary and a way back before a second person relies on it.
1. An owner for every app
An app with no named owner becomes a liability the day its builder changes roles. Record the owner, the business purpose and a review date when the project is created, and retire apps that lose their owner.
2. A data boundary for every app
Sign-in decides who opens an app. It does not limit what the app reads once it runs. Decide which customer, payroll or supplier records each kind of app may touch, and keep the sensitive ones behind a reviewed integration rather than a connection the builder wired up alone.
3. A release path for real users
Standing an app up is the quick part. In our builds, putting a system in front of real users takes about four times as long as getting it working: a staging copy, QA, a security pass and a release habit. Void makes the first part faster. Budget for the second.
4. Someone who runs the platform
Self-hosting means your company owns upgrades, credentials, the PostgreSQL database and recovery. Done, for us, means an engineer can step away and touch a system only a few times a month, with a person still checking its work. A platform nobody maintains is an unaudited cloud account in a better suit.
Should you install the Void Platform now?
This is our recommendation, not Cloudflare’s: install it when staff are already building tools and the real risk is that those tools live somewhere you cannot see.
Install it if
- Your company already runs on Cloudflare, or is ready to.
- Staff are building internal tools with coding agents today.
- You can name one person to own the platform, its upgrades and its database.
- You already have an identity provider for company sign-in.
Wait if
- One engineering team builds every internal app and already has a deployment process.
- Nobody can own a self-hosted platform this quarter.
- Your sensitive data has no access model yet. Fix that first.
A hypothetical example: a 120-person distributor whose operations team has built four trackers on personal accounts. Moving them onto one protected platform, each with a named owner and company sign-in, is a better use of a week than building a fifth tracker.
For the wider infrastructure view, read why Cloudflare belongs in your 2027 plans. For whether a tool should be built at all, read build or buy internal software. If your staff are already shipping tools and you want them on a platform you control, talk to us.
FAQs
Is the Void Platform free?
The code is open source under the MIT license. Running it is not free: Workers for Platforms is a $25 monthly paid plan with usage-based overage, and the PostgreSQL database and other Cloudflare usage are billed separately.
Does Cloudflare host the Void Platform for you?
No. You install it in your own Cloudflare account and run it there. Developers who do not need its team management can deploy Void apps straight to their own Cloudflare account instead.
Can apps on the platform stay private to employees?
Yes, with Project Zero Trust switched on. Cloudflare Access asks visitors to sign in with the identity providers you chose before they reach a protected app. Any project can still be made public, so review the defaults.
Is the Void Platform the same as Workers for Platforms?
No. Workers for Platforms is the Cloudflare product that runs untrusted code from customers or AI in isolated sandboxes. The Void Platform installs on top of it and adds users, projects, limits and the deployment workflow.
Does it replace a security review?
No. It narrows who can deploy and who can open an app. It does not check what an app does with the data it can reach. Review that for each app, as you would for any other system.
Written by the dplyz team
Senior engineers who work inside client companies to take AI from pilot to production: agentic workflows, AI integration and the platform work around them.
