Cloudflare already sits in front of www.hims.com and api.forhims.com. Fold the images, storage, API protection and the AI Health Companion onto that same network — fewer vendors, one control plane, and HIPAA-aligned logging for a telehealth business carrying PHI on every request.
www.hims.com and api.forhims.com already run on Cloudflare — but the apex still resolves to Fastly. Move it onto the same edge for one CDN, one WAF, and one set of logs.
Same URL-based resize, crop and format-shifting for product, before/after and editorial imagery — delivered from the very CDN already serving hims.com. One bill instead of a separate media SaaS.
Lab results, visit recordings, prescription docs and the media archive carry recurring egress tax on S3/CloudFront. R2 charges $0 egress — a HIPAA-aware origin feeding the web, Images and AI stack.
Hims runs a self-hosted Health Companion ML service that talks to patients. AI Gateway puts a governed front door on every LLM call — caching, rate-limits, spend caps and full request logging a regulated provider needs. Firewall for AI blocks prompt injection and PHI leakage before it reaches a model.
Hims runs on APIs — intake, accounts, pharmacy and EMR integrations carrying PHI. API Shield discovers every endpoint and enforces schema, auth and volumetric limits inline at the edge.
Issue per-app credentials to the Hims & Hers iOS / Android app so only the genuine app can call your APIs — backed by bot, automation and account-takeover defenses tuned for consumer health and PHI.
Swap reCAPTCHA for privacy-first Turnstile and point Bot Management at the intake and checkout funnel — stopping fake consultations, promo abuse and account-takeover for a subscription DTC health brand.
Real-time JavaScript supply-chain monitoring on the Adyen / Stripe checkout and intake pages — catching skimmers before they touch patient payment data or PHI. PCI + HIPAA in one control.
Collapse Secure Web Gateway, DNS filtering, CASB, DLP and ZTNA onto Cloudflare One — gating internal clinical, EMR and engineering tools, with AI Prompt Protection so PHI never leaks into consumer ChatGPT. One agent, one policy engine, one set of logs for auditors.
| Function | Today | How it was identified | On Cloudflare |
|---|---|---|---|
| CDN / edge | Cloudflare + Fastly | www/api: server cloudflare; apex 151.101 (Fastly) | Consolidate on Cloudflare |
| Image delivery | Cloudinary identified | cloudinary.forhims.com (og:image) | Cloudflare Images |
| Object storage | AWS S3 / CloudFront | Media / lab-result archive | R2 (egress-free) |
| AI traffic control | Self-hosted Health Companion | health-companion-service…himshers.com | AI Gateway + Firewall for AI |
| API protection | App proxies / manual rules | GraphQL at api.forhims.com/graphql | API Shield |
| Mobile app security | In-app / 3rd-party SDKs | Consumer iOS / Android health app | API Shield mobile SDK + Bot Mgmt |
| Bot / captcha | Google reCAPTCHA | reCAPTCHA keys in app config | Bot Management + Turnstile |
| Payments / client-side | Adyen + Stripe | Live client keys in app config | Page Shield |
| Identity / SSO | Auth0 | prod-forhims.us.auth0.com | Access (SSO front door) |
| SSE / Zero Trust | Netskope (NG-SWG + NPA) | Account-team input | Cloudflare One |