What does it look like when a four-person newsroom or a mental health non-profit builds software like a product team? On October 2, 2026, Cloudflare published a rundown of what dozens of civil society organizations have built with its developer services, backed by more than $7.5 million in credits. The details are worth a builder’s attention — not because the tech is novel, but because the constraints these teams face (sensitive data, no funding for idle servers, non-technical staff) expose what actually matters when automating on someone else’s cloud.
From renting protection to building products
The backdrop matters. Since 2014, Cloudflare’s Project Galileo has given free cybersecurity services to at-risk civil society groups — it now protects over 3,400 domains across more than 120 countries. The pattern the company describes is a shift in requests: groups that once asked for help staying online now ask for help building new applications, with AI letting non-technical staff create tools tailored to their workflows.
The timing is difficult for the sector. Per the article, many organizations report financial strain after cuts to government funding, and a CIVICUS survey found 48% cite cost as a barrier to adoption, while more than half point to privacy concerns. These teams hold data — activist locations, anonymous sources — where a leak or a hallucinated output can cause real harm. That combination of tight budgets and high stakes is the real spec for anything they build.
Three builds that show the range
The small-team examples are the most instructive. LebTown, an independent newsroom in Lebanon County, Pennsylvania, ran its entire editorial operation across two Google Docs, a calendar, Discord, and Gmail until this year. It is now replacing that with a custom editorial management system tracking stories from pitch to publication, plus tools that turn county real-estate transfer PDFs into structured data and a real-time copyeditor agent wired into WordPress.
Kaya Guides, which pairs people in India experiencing depression with trained lay counselors over WhatsApp, migrated its care management system to Cloudflare and now processes roughly 500,000 WhatsApp messages a month. It supports 10,439 people as of September 2026, and has built an AI system that listens to counseling calls and gives counselors live feedback. The Snorkelling Society, a UK non-profit run by volunteers, is the third case: SnorkelMap, a community-contributed mapping app, leans on secured storage to let strangers upload images without opening the door to abuse.
When the stakes go up, humans stay in the loop
The larger human-rights projects tackle the same shape of problem — thousands of manually collected, dispersed documents needing structure before analysis — but with harsher failure modes. Freedom House is getting an interactive dashboard that ingests public reporting and flags potential cases of transnational repression, fine-tuned on its own methodology, with security and data minimization treated as priorities in every decision. The Global Network Initiative is building a dashboard that surfaces and categorizes regulatory proposals across dozens of jurisdictions and tracks internal advocacy deadlines. Article One’s risk assessment tool processes factory audits and country reports to flag salient human rights risks — with the article stating plainly that Article One, not the model, makes all judgments.
This division of labor is the useful pattern for anyone shipping agentic tooling: automation handles intake, structuring, and flagging; the organization keeps the judgment calls. Cloudflare’s own security-agent work follows the same logic, as I covered in Evidence First, Inference Second: Cloudflare’s Recipe for a Security Agent Harness.
The infrastructure tradeoff underneath
Why did these teams build on Cloudflare rather than a conventional stack? The stated reasons map to the constraints above: serverless scaling means no paying for idle infrastructure (vital when funding is uncertain), Workers AI removes the need to operate GPUs, and AI Gateway adds rate limits, observability, and model routing to keep inference costs contained. DDoS protection comes by default — not a nicety for groups that are, per Cloudflare’s data, disproportionately targeted.
Cloudflare is opening a second non-profit cohort of its startup program, offering up to $250,000 in credits per organization. The honest caveat: this is Cloudflare describing its own program and customers, so treat the outcomes as vendor-reported. But the takeaway holds regardless of provider — when credits and managed infrastructure lower the floor, small mission-driven teams can ship production automation. The constraint that matters most is not the model choice; it is deciding, up front, which steps must keep a human in the loop.