The main problem is that data is transferred out of EU, it is simply not acceptable for a EU company regardless of any DPA (history have shown here that any such DPA would be invalid in the near future).

However some of our clients (for example in health or financial industry) would be concerned that data is proxied through a third-party, doesn't matter if it is encrypted (also it's unclear to me how keys etc are managed and what data Cloudflare can access).

btw: Render looks awesome but at the current offering is it not an option for us.