Cloudflare for Golden 1 Credit Union — Vendor Consolidation Executive Brief

Golden 1 at a glance

Founded in 1933 as California State Employees' Credit Union #1, Golden 1 has scaled fast since gaining statewide field-of-membership in 2018 — widening its digital attack surface across web, mobile, business banking and loan origination.

$21.5B total assets 1.1M members 70+ branches & resource centers 2,000+ employees 2nd largest CU in California

Golden 1 opened new Financial Resource Centers in Del Paso Heights (2024) and Madera (2025) as part of a $10M community-investment commitment, runs its digital and business banking on a Q2-powered platform, and was named a "Best Credit Union to Work For" for the fifth consecutive year (American Banker, 2025) and ranked for "Best Customer Service in Financial Services" (USA Today/Newsweek, 2026). Sources: Golden 1 2025 Annual Report; American Banker, Aug 2025; USA Today, Jan 2026. That growth — plus a live credential-check endpoint on the public login form — is exactly where a fragmented perimeter and an absent Zero Trust layer create seams for fraud and inconsistent policy enforcement.

From vendor sprawl to one network

Identified across golden1.com's DNS and HTTP headers, plus a third-party technology-intelligence scan (marked *, not independently confirmed by Cloudflare — see "How we know" below). The right is where it can consolidate.

3 vendors → 1 network

AkamaiCDN · edge today

Akamai Prolexic*DDoS scrubbing

Alert Logic*managed WAF

Cloudflare one network · one bill · one control plane

Plus: close the Zero Trust gap & govern AI

Seven plays: consolidate what's there, secure what's missing

Three replace a vendor already identified on golden1.com (Akamai CDN, Akamai Prolexic, Alert Logic). Four close a gap or add new capability — bot/fraud defense, Zero Trust, a modern application platform, and AI governance — where Golden 1 has little or no incumbent to migrate away from.

Cloudflare CDN & edge performance

↳ replaces Akamai CDN

Move golden1.com, digital banking and the mobile API surface onto Cloudflare's edge — the same 330+ city network already serving financial institutions this size, with tiered caching to cut origin load during paycheck-day and holiday traffic spikes.

Identified: server: AkamaiGHost on the apex; www/api/login/help all CNAME to *.edgekey.net
Smart Tiered Cache reduces origin hits at branch & resource-center scale
Same edge that will also run WAF, Bot Management and Zero Trust

Unmetered DDoS protection

↳ replaces Akamai Prolexic*

Credit unions are a recurring extortion/DDoS target. Cloudflare's network absorbs volumetric and application-layer attacks at the edge — no per-incident overage, no separate scrubbing-center contract.

Flagged in a third-party technology-intelligence scan (Cyber Security: Prolexic)*
L3/L4 + L7 mitigation on the same network as the CDN
Always-on, included — not a metered add-on

WAF & Bot Management for member login

↳ replaces / augments Alert Logic*

golden1.com's login form fires a live preLogonUser AJAX call on every username entered — a common credential-stuffing target for retail banking. Cloudflare WAF + Bot Management sit in front of that endpoint and the wider site.

Alert Logic flagged in a third-party technology-intelligence scan (managed WAF)*
Endpoint observed directly in golden1.com login page source
Managed rulesets tuned for financial-services OWASP + credential abuse

Turnstile on apply & enrollment forms

Protect the loan-application funnel

The Apply Today and loan-origination flow (fronted by MeridianLink LoansPQ on Azure) and Digital Banking enrollment are prime bot-fraud targets — synthetic identity and application fraud are a growing NCUA supervisory focus. Turnstile adds invisible, privacy-first bot filtering with no CAPTCHA friction for real members.

Identified: applynow.golden1.com → Azure Traffic Manager → loanspq.com
Drop-in widget; no member-facing puzzle challenges
Pairs with WAF rate-limiting on the same public endpoints

Zero Trust: Access, Gateway & CASB/DLP

Net-new — no SSE/ZTNA vendor detected

No SWG, CASB, DLP or ZTNA vendor was identified anywhere in Golden 1's public footprint — a rare clean landing spot. Cloudflare One replaces ad-hoc VPN/firewall rules for Business Online Banking admins, branch staff and internal apps with one policy engine and one agent (WARP).

No competing SSE agent, CASB or DLP vendor detected in recon — greenfield, not a rip-and-replace
Access (ZTNA) gates admin entry to the Q2-powered Business Online Banking platform
Device posture + identity (SSO) enforced before any internal request reaches the network

Full Akamai off-ramp — build forward on the Developer Platform

↳ retires the Akamai relationship entirely

Retiring CDN and DDoS closes out the Akamai relationship. Rather than buying a separate application platform for new digital-banking features, Golden 1's engineering team can build directly on Workers, Durable Objects, D1, R2 and KV — the same network already running CDN, WAF and Zero Trust.

No Akamai App Platform / EdgeWorkers usage was identified — this is a forward-looking build option, not a displacement of a confirmed product
Workers: zero cold starts, 330+ cities — ideal for rate calculators, pre-qualification APIs, personalization
D1 / R2 / KV for edge-native data without standing up a second data platform
One vendor for CDN, security, Zero Trust and application compute

Generative & Agentic AI — governed from day one

AI Gateway + Workers AI + MCP

As Golden 1 moves into AI-assisted member service — chat-based support, loan-officer copilots, document and fraud review — AI Gateway puts one governed front door on every LLM call, across any model provider, with caching, rate limits, spend caps and full request logging an NCUA examiner will ask for. Workers AI runs models at the edge for latency-sensitive scoring. MCP, fronted by Zero Trust Access, lets internal systems be exposed to AI agents safely — no open data paths.

Generative: member chatbot & loan-officer copilot, RAG over rate sheets/policies via AI Search + R2 — one logged, cost-capped gateway across any model vendor
Agentic: MCP servers expose core-banking and Q2 data to AI agents behind Zero Trust Access — least-privilege, fully audited
Fraud & document review: Workers AI vision/text models score loan applications and KYC documents at the edge
Compliance: the same audit trail GLBA/NCUA exam teams already expect, extended to every AI call

Consolidation roadmap

Sequenced from the lowest-risk cutover to the biggest incumbent displacement — not a generic timeline, but staged around what's actually running on golden1.com today, plus the Zero Trust and AI gaps.

First 90 days

Land & prove it

Pilot Cloudflare CDN on marketing + rates/apply pages
Turnstile on Apply Today & enrollment forms
Zero Trust Access pilot for a first internal app — greenfield, no incumbent to rip out
Free vulnerability & DDoS exposure scan of golden1.com

6–9 months

Secure the perimeter & govern AI

DDoS protection live — retire Akamai Prolexic
WAF + Bot Management in front of login.golden1.com
Zero Trust Gateway + CASB/DLP for the full employee footprint
AI Gateway pilot — govern early generative-AI experiments (member chat / employee copilot)

12–24 months

Consolidate & build forward

Retire remaining Akamai CDN footprint entirely — full Akamai off-ramp
Magic WAN pilot across the 70+ branch & resource-center network
Build new digital-banking features on the Developer Platform (Workers, D1, R2, KV)
Stand up first MCP servers for agentic AI, fronted by Zero Trust Access

Consolidation snapshot

Current-state vendors are evidence-based; nothing here is assumed. scan = third-party technology-intelligence scan, not independently confirmed by Cloudflare. gap = no vendor detected; net-new capability.

Function	Today	How it was identified	On Cloudflare
CDN / edge	Akamai identified	server: AkamaiGHost; www/api/login/help → *.edgekey.net	Cloudflare CDN
DDoS protection	Akamai Prolexic scan	Third-party technology-intelligence scan	Cloudflare DDoS (unmetered)
Web application firewall	Alert Logic scan	Third-party technology-intelligence scan	Cloudflare WAF
Bot / credential-stuffing defense	Not detected gap	Live preLogonUser AJAX call observed in login page source	Bot Management + Turnstile
Zero Trust / SSE (ZTNA, CASB, DLP)	Not detected gap	No SWG/CASB/ZTNA vendor or agent traffic identified in recon	Cloudflare One (Access + Gateway + CASB/DLP)
Generative & agentic AI governance	Not observed gap	No AI chat widget or LLM vendor detected on public site — forward-looking	AI Gateway + Workers AI + MCP
Application / edge compute platform	Not identified gap	No Akamai App Platform / EdgeWorkers usage identified — forward-looking	Workers + Durable Objects + D1/R2/KV
Digital / business banking platform	Q2 Digital Banking (Q2 Software, Inc.)	businessonline.golden1.com → onlineaccess1.com → q2digitalbanking.com (CNAME); WHOIS: Q2 Software, Inc.	Unchanged — Zero Trust Access can gate employee/admin entry points
Loan application / origination	MeridianLink LoansPQ (Azure-hosted)	applynow.golden1.com → Azure Traffic Manager → loanspq.com (CNAME)	Turnstile + WAF in front of the public form

One network for Golden 1's edge, Zero Trust & AI.