Zymr Cloudflare
← Back to overview
Expanded Architecture

The full picture under ZOEY and every Zymr delivery.

Zymr ships AI-first by design. ZOEY is the orchestration framework; every client engagement layers Generative AI, AI Agents, MLOps, and Data Engineering on top. This page walks ZOEY's pipeline, the AI Gateway runtime story for every delivery, and the platform consolidation argument for clients who don't want lock-in to AWS / Azure / GCP.

The ZOEY orchestration framework, mapped to Cloudflare primitives

Every multi-agent platform faces the same runtime challenges: state per session, fan-out across sub-agents, cost attribution per tenant, model-provider fallback, and audit logging. Here is how each maps to a Cloudflare primitive — purpose-built for exactly these patterns, not retrofitted.

ZOEY layer
What it requires at runtime
Cloudflare primitive
Agent orchestrationMulti-agent coordination per session
Per-conversation state, strict ordering across sub-agent calls, single-writer semantics, region affinity for compliance
Durable ObjectsQueues One DO per active orchestration. Queues for sub-agent fan-out with at-least-once delivery.
LLM inference pathEvery model call across providers
Per-tenant cost attribution, PII redaction before the model sees client data, fallback routing when primary model errors or budgets cap, one unified log line
AI GatewayWorkers AI Dollar-denominated spend caps (June 5 GA). Identity-driven budgets via Cloudflare Access. PII redaction layer.
Knowledge retrievalRAG for client-specific corpora
Per-client vector indexes, real-time sync, low-latency retrieval at conversation speed, isolation between clients
VectorizeR2 Tenant-scoped vector indexes co-located with the inference Worker. R2 for source corpora at zero egress.
Tool calling / actionsWhen agents take action in client systems
Outbound connectivity to client SaaS, on-prem systems, custom APIs — without opening inbound firewall holes on the client side
Cloudflare TunnelAccessWorkers Reverse tunnels into client estates. Identity-bound action authorization.
Observability + auditWhat the regulator and the CFO each want to see
Per-request logging across all providers, per-tenant cost rollup, retention policies that meet client compliance requirements
LogpushR2 Logs to customer-owned R2 or S3. One schema across every provider. Per-tenant rollup.
Multi-tenancyEach Zymr client is a separate tenant
Per-client domain/subdomain, per-client SSL, per-client rate limits, per-client config — without managing 100 separate deployments
Workers for PlatformsSSL for SaaS One platform, N tenants. Each client gets isolated config + their own custom domain.
Edge inference (optional)Where Zymr clients want low-latency local inference
Inference at 330+ POPs without per-region GPU procurement, model variants per client
Workers AI Open models served at the edge, per-request billing, no GPU capacity planning.

Why this is the runtime piece Zymr's clients will ask for

Every Zymr client is going to face the same conversation with their CFO in the back half of 2026: "What's our AI spend, who's spending it, and how do we cap it?" The product that answers that conversation shipped on June 5.

Per-tenant spend attribution

Zymr ships ZOEY to multiple clients. Each client wants their own AI bill, not a pooled invoice. AI Gateway attributes every token to the originating tenant via header-based or identity-based metadata.

For Zymr's client-delivery model, this means "here's exactly what your AI spend was last month, broken down by use case" — without Zymr building the attribution layer.

Identity-driven budgets

The Cloudflare Access integration means budgets bind to authenticated identities, not just account-level caps. A Zymr client can give a junior analyst a $200/month budget and a senior architect a $2,000/month budget — through Zymr's existing identity surface.

When the budget hits the cap, AI Gateway either blocks or falls back to a cheaper model — configurable per route.

PII redaction before the model

For Zymr's healthcare, finance, and cybersecurity verticals, this is the regulatory dealbreaker. Client data flows into the model — but with names, account numbers, SSNs, and PHI redacted at the gateway tier, before the model provider sees them.

Audit log records the redaction event without recording the redacted content. Defensible to a regulator, transparent to the client.

Multi-provider, one log

ZOEY's "next-generation AI" positioning implies provider flexibility — OpenAI for some workloads, Anthropic for others, self-hosted for sensitive data. AI Gateway sits in front of all of them.

One log format. One cost view. One PII-redaction policy. Switching providers becomes a config change, not a re-architecture.

Why Cloudflare wins for SI engagements specifically

When Zymr proposes an architecture to a client, the client asks a question Zymr has to answer: "Are we locked in?" If the answer is "yes, to AWS" or "yes, to Azure," the conversation gets harder. Cloudflare's developer platform is the answer to that question.

Workers + open standards

Workers is a JavaScript / TypeScript / WASM runtime that conforms to web standards. The same Worker code ships unmodified across all 330+ POPs and runs in any V8-compatible runtime — no vendor-specific SDK lock-in.

R2 is S3-compatible. Vectorize is approachable via a standard API. The architectural argument to a Zymr client is "if you ever need to leave, the code goes with you."

No GPU capacity planning

For clients adopting Generative AI without an existing data-center footprint, Workers AI removes the procurement conversation entirely. Per-request billing, no commitment, no capacity reservations.

For Zymr's positioning — "modern, AI-native, no infrastructure overhead" — this aligns with the pitch better than asking the client to commit to a GPU reservation pool on a hyperscaler.

The CloudFront / Akamai displacement

When a Zymr client is already on AWS CloudFront or Akamai, Cloudflare can sit in front (orange-cloud) without origin changes. Marginal value, marginal cost. The longer-term consolidation conversation comes later.

This matters because most enterprise clients aren't ready to displace their existing edge vendor in one quarter — but they will accept "add Cloudflare on top for the capabilities you don't have today."

The integration plane

Zymr clients live across SaaS, on-prem, hyperscalers, and legacy systems. Cloudflare Tunnel reverses the connectivity model — the client's connector dials out; Zymr-built agents reach systems through the tunnel; no public surface required.

This is structurally different from "build an integration to each client's environment" — which is what most SI engagements end up doing manually.

What changes Monday, week by week

The proof path is two-sided: prove the runtime works for Zymr's own ZOEY platform, then prove it works in front of a real client engagement. Both should run in parallel.

01
Weeks 1–4

AI Gateway in front of ZOEY

Route one ZOEY agent's LLM calls through AI Gateway. Spend caps, PII redaction, fallback routing. Benchmark cost-per-conversation against the current path. One internal use case picked by your team.

02
Weeks 5–8

Workers for Platforms POC

Stand up the multi-tenant deployment pattern for one prospective Zymr client. Per-tenant config, custom domain, isolated rate limits. Pattern reusable across the client base.

03
Weeks 9–12

Vectorize + Tunnel for one engagement

Pilot the RAG + tool-calling story in front of a real Zymr client engagement. Compare retrieval latency and integration overhead against the previous architecture.

The foundation is in place

zymr.com is fronted by Cloudflare today — confirmed via server: cloudflare and cf-ray headers. The marketing surface is on Webflow with Cloudflare's edge in front; HubSpot handles the blog. The conversation isn't "switch infrastructure," it's "extend the same platform underneath what you're already building."

For Zymr specifically, the natural sequence is: (1) AI Gateway under ZOEY → (2) Vectorize for client-specific RAG → (3) Workers for Platforms for multi-tenant client deployments → (4) Tunnel for client-system integration. None of these require leaving the existing AWS / Azure / GCP relationships clients already have. They sit on top.

The economic argument is straightforward for an SI: every primitive listed above is something Zymr would otherwise have to build, operate, and maintain on behalf of each client. Cloudflare ships them as managed services, and Zymr's services value goes up because the engagement closes faster and operationally cleaner.