by CloudflareObject storage
S3-compatible object storage with no egress fee for any storage class, a permanent free tier and direct access from Cloudflare Workers.
S3-compatible storage where downloads carry no egress fee, so serving or moving data out costs only the requests it takes.
R2 charges for storage and for operations, and the pricing page states there is no egress charge for any storage class. For data that is read from the internet often, such as media, downloads or datasets, the bill does not grow with the bytes sent: our 1 TB scenario with 1 TB downloaded comes to $23.10. Existing S3 tools work against its S3-compatible endpoint, Cloudflare Workers reach buckets through a native binding, and free tools copy data in from S3, Google Cloud Storage and other S3-compatible stores.
Against 3 other products we reviewed in Object storage: what you pay for with each, the five access facts, the plan limits we recorded and each review's bottom line. The note under the table says how each one was checked.
| Metric | Cloudflare R2 | Backblaze B2 | Google Cloud Storage | Amazon S3 |
|---|---|---|---|---|
| What you're paying for | Worth the priceS3-compatible storage where downloads carry no egress fee, so serving or moving data out costs only the requests it takes. | Worth the priceHot S3-compatible storage at a flat $6.95 per TB a month, with read, write and list calls free and egress free up to 3x what you store. | Compliance includedHot to archive storage in one API, with cross-region buckets, retention locks that cannot be undone and compliance papers you accept yourself. | Compliance includedThe S3 API itself, with compliance-mode Object Lock, replication and a self-serve HIPAA BAA in place, billed per use with no minimum charge. |
| Overall score | 8.1 | 8.6Best | 7.3 | 6.4 |
| Free option | Free plan | Free plan | Free plan | Free trial |
| Card to start | –Not measured | No card needed | Card required | –Not measured |
| Getting access | Self-serve | Self-serve | Self-serve | Self-serve |
| Starter priceCheapest paid plan | $0.015/GB-month | $6.95/TB/mo | $0.02/GiB-month | $0.023/GB-mo |
| Pricing model | Usage-based | Usage-based | Usage-based | Usage-based |
| Pricing page | Public prices | Public prices | Public prices | Public prices |
| Standard storage price | $0.015/GB-month | $6.95/TB per 30 days, billed per byte-hour; same in all 4 regions | $0.02/GiB-month (Iowa, us-central1; prorated to the sub-second) | $0.023/GB-month (US East, first 50 TB; binary GB) |
| Egress to the internet | No egress fee for any storage class | Free up to 3x average stored data, then $0.01/GB; free to listed CDN and compute partners | $0.12/GiB for the first 10 TiB (all destinations except China and Australia); free within the same Google Cloud location | $0.09/GB for the first 10 TB (US East); 100 GB a month free across AWS |
| Request fees | Class A $4.50 per million; Class B $0.36 per million | Class A, B and C calls free; event notifications (Class D) $0.004 per 10,000 after 2,500 a day | Class A $0.005 per 1,000; Class B $0.0004 per 1,000 (Standard, single region) | PUT, COPY, POST, LIST $0.005 per 1,000; GET $0.0004 per 1,000 |
| Free option | 10 GB-month, 1 million Class A and 10 million Class B a month, permanent | First 10 GB always free, no credit card | 5 GB-months, 5,000 Class A, 50,000 Class B and 100 GB egress a month, permanent (3 US regions); $300 credit for 90 days | No permanent free storage; up to $200 in credits for new accounts |
| Reference scenario (1 TB/mo) | $23.10, no egress charge, computed | $6.95, egress and calls free within the rules, computed | $149.00 in Iowa, $120 of it egress, computed | $122.00 in US East, $90 of it egress, computed |
| Billing minimums | None on Standard; 30 days on Infrequent Access | None stated (no minimum file size, storage duration or monthly charge) | None on Standard; 30 to 365 days on colder classes | None on S3 Standard; 30 to 180 days on colder classes |
| S3 API | S3-compatible; versioning, Object Lock and replication calls not implemented | S3-compatible, next to the B2 Native API | Interoperability mode (XML API with HMAC keys) | Native (the S3 API itself) |
| Versioning and object lock | No versioning; R2 bucket locks the account can remove | Versioning on by default; compliance-mode Object Lock | Versioning; Bucket Lock and Object Retention Lock (Locked mode cannot be removed) | Versioning; compliance-mode Object Lock |
| Replication | No built-in replication | Cloud Replication within or between regions (another region needs a second account) | Built into dual- and multi-region buckets; cross-bucket replication | Cross-Region and Same-Region Replication |
| SOC 2 / ISO 27001 | Cloudflare SOC 2 Type II names R2; ISO 27001:2022 | Own SOC 2 Type 2 report; ISO 27001 held by its data centres | Google Cloud SOC 2 Type II (quarterly, names Cloud Storage); ISO 27001 | AWS SOC 2 report in AWS Artifact; ISO 27001 list names S3 |
| HIPAA BAA | Enterprise customers only | On request for covered entities | Self-serve in the console (IAM & Admin) | Self-serve in AWS Artifact |
| Regions | 6 location hints (best effort); EU, US and FedRAMP jurisdictions | 4 (US East, US West, EU Central, CA East); one per account | 43, including 13 in Europe, plus dual-regions and ASIA, EU and US multi-regions | 36, including EU and AWS GovCloud (US) |
| Bottom line | From its public pages, Cloudflare R2 removes the egress fee and keeps billing simple, with a permanent free tier and no minimums on Standard. Versioning, the S3 Object Lock API and replication are not implemented, so it suits serving data more than strict retention. | From its public pages, Backblaze B2 has the lowest list price in our 1 TB scenario, with free API calls, egress free up to 3x storage and solid data protection. Each account sits in one of 4 regions, with one storage class. | From its public pages, Google Cloud Storage has nearly every protection and compliance feature we score, publishes every price in USD and keeps a permanent free tier. Internet egress, billed per GiB, is the main cost, and S3 support is an interoperability mode. | From its public pages, Amazon S3 is the reference S3 service and has every protection and compliance feature we score. Storage and requests are priced per use with no minimum, and internet egress, billed per GB, is the main cost to plan for. |
Evidence: Cloudflare R2: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Backblaze B2: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Google Cloud Storage: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run; Amazon S3: facts checked 2026-10-15 from its public sign-up and pricing pages, no completed hands-on run. Prices in USD as listed, excluding tax. "–" means not recorded.
Review from public pages
Written from Cloudflare R2's public pages (pricing, security or privacy, and docs) as read on Oct 15, 2026. We did not sign up, and no hands-on run is published yet.
We read the R2 product page, the R2 pricing page, the R2 docs (get started, S3 API compatibility, storage classes, lifecycle rules, bucket locks, data location, API tokens, temporary credentials, audit logs, durability, limits, data migration), the dashboard SSO docs, the Trust Hub SOC 2, ISO and HIPAA pages, and the billing and support docs on Oct 15, 2026; we did not sign up, create a bucket or call the API for this review. All prices on these pages are in US dollars.
The pages make the cost model clear. You pay per GB-month of storage and per million Class A and Class B operations, usage is rounded up to the next billing unit, and there is no egress fee. The S3 API page lists each S3 operation as implemented or not, so the gaps are easy to check: versioning, the S3 Object Lock API, replication, bucket policies, ACLs, tagging and SSE-KMS are not implemented. Data location is a best-effort location hint, or a jurisdiction (EU, US or FedRAMP) that guarantees where objects are stored and cannot be changed after the bucket is created.
Two points need a question. The product page says "no credit card required", while the get-started docs add R2 through a checkout and the billing docs say a payment method is required to purchase Cloudflare products. And the pricing page lists PutBucketEncryption as a Class A operation that the S3 API page lists as not implemented.
Downloads through the S3 API, the Workers API or r2.dev are not charged, so our 1 TB scenario with 1 TB downloaded is $23.10, of which nothing is egress.
vs Backblaze B2: Amazon S3 bills $0.09 per GB from US East and Google Cloud Storage $0.12 per GiB; Backblaze B2 is free up to 3x what you store.
Every month 10 GB-month of Standard storage, 1 million Class A and 10 million Class B operations are free, with no egress fee and no time limit.
vs Amazon S3: Amazon S3 has no permanent free storage; Google Cloud Storage’s Always Free tier covers 5 GB-months.
The pricing and storage class pages state no minimum storage duration, no minimum object size and no minimum monthly charge for Standard storage.
Compared: Wasabi bills at least 1 TB a month, a 90-day minimum duration and a 4 KB minimum object on Pay as You Go.
Cloudflare’s SOC 2 Type II names R2 in scope and Cloudflare holds ISO 27001:2022. Dashboard SSO is free on all plans, bucket-scoped read-only tokens are documented, and audit logs of bucket changes are always on.
vs Backblaze B2: Backblaze B2’s ISO 27001 is held by its data centres, and Wasabi states only its data centres’ SOC 2 reports.
Super Slurper copies whole buckets and Sippy copies objects as they are requested, both free apart from the Class A operations they make on R2.
vs Backblaze B2: The Super Slurper docs list Amazon S3 and Google Cloud Storage as sources and name Backblaze B2 and Wasabi among tested S3-compatible ones.
The S3 API page lists the versioning and replication calls as not implemented, and each bucket keeps its data in one region; Local Uploads only stages writes near the client.
Workaround: Keep a second copy in another bucket with Super Slurper or rclone, and use bucket lock rules to block overwrites for a period.
The S3 Object Lock API is not implemented. R2 bucket lock rules retain objects by age, date or indefinitely, and the account can remove them in the dashboard, Wrangler or the API.
Workaround: The durability page suggests pairing bucket locks with bucket-scoped API tokens to limit who can reach the data.
Bucket policies, ACLs, object and bucket tagging and SSE-KMS are listed as not implemented. Encryption uses Cloudflare-managed keys by default, with SSE-C for keys you supply.
Workaround: Access is set with API tokens scoped to buckets and temporary credentials that can be limited to a prefix.
The Trust Hub HIPAA page says Cloudflare enters into a BAA with Enterprise-level customers, and Enterprise customers get the FedRAMP jurisdiction by contacting their account team or Cloudflare Support.
Workaround: R2 is listed in the scope of Cloudflare’s HIPAA attestation; ask the account team about an Enterprise plan.
R2 has no plan to pick: you pay per GB-month of storage and per million operations, and usage is rounded up to the next billing unit. Standard storage is $0.015 per GB-month, Class A operations (writes, lists) $4.50 per million and Class B (reads) $0.36 per million, with no egress fee. Our scenario (1 TB stored, 1 TB downloaded, 1 million writes, 10 million reads) is $15 + $4.50 + $3.60 = $23.10 a month at list price, computed with 1 TB taken as 1,000 GB-months and the free tier left out. Costs grow with reads: the pricing page’s asset-hosting example, 300 million reads a month, bills 290 million after the free 10 million: $104.40. Infrequent Access adds $0.01 per GB retrieved and a 30-day minimum. Basin Catalog, Data Access Logs (Observability pricing from Dec 1, 2026) and other metered services in front of a bucket are extra; sales tax applies by local law.
Objects are read out through the S3-compatible API with any S3 tool, such as rclone or the aws CLI. There is no egress fee; the reads and lists are billed as Class B and Class A operations. No export tool to another provider is documented, since Super Slurper only copies into R2. To close, remove any bucket lock rules, empty the bucket (the dashboard has an Empty Bucket action) and then delete it.
From its public pages, Cloudflare R2 removes the egress fee and keeps billing simple, with a permanent free tier and no minimums on Standard. Versioning, the S3 Object Lock API and replication are not implemented, so it suits serving data more than strict retention.
| Limit | As recorded |
|---|---|
| Standard storage price | $0.015/GB-month |
| Egress to the internet | No egress fee for any storage class |
| Request fees | Class A $4.50 per million; Class B $0.36 per million |
| Free option | 10 GB-month, 1 million Class A and 10 million Class B a month, permanent |
| Reference scenario (1 TB/mo) | $23.10, no egress charge, computed |
| Billing minimums | None on Standard; 30 days on Infrequent Access |
| S3 API | S3-compatible; versioning, Object Lock and replication calls not implemented |
| Versioning and object lock | No versioning; R2 bucket locks the account can remove |
| Replication | No built-in replication |
| SOC 2 / ISO 27001 | Cloudflare SOC 2 Type II names R2; ISO 27001:2022 |
| HIPAA BAA | Enterprise customers only |
| Regions | 6 location hints (best effort); EU, US and FedRAMP jurisdictions |
Read from the vendor's public pages on Oct 15, 2026. No hands-on run is published yet. How we check
We have not published a sign-up run for Cloudflare R2 yet. The access facts above were read from its sign-up and pricing pages on Oct 15, 2026.
We have not published API calls for Cloudflare R2 yet.
Cloudflare R2 lists 3 plans. The cheapest paid plan, Standard storage, costs $0.015/GB-month.
Prices as listed, USD, excluding tax; observed 2026-10-15.
Source: developers.cloudflare.com pricing page. Prices change; the observed date above is when our agent read them.
We read the pricing, docs, security and legal pages of three object storage services on the same day and scored them on the same six indicators. What each one charges for egress and requests, what 1 TB a month costs, and who should pick which.
