I worked at Cloudflare for 3 years. There are strict internal controls against employee data access, but those controls disappear when faced with government requests. They'll fight some requests for PR purposes, but ultimately they comply with almost everything