The challenge
Taqeem, the Saudi Authority of Accredited Valuers, regulates the valuation profession in Saudi Arabia. The organisation needed a secure way to provide access to internal applications without the complexity, performance issues, and security risks of traditional VPN.
Several risks were unmanaged in the existing setup:
- VPN dependencies. Slow performance and broad credential exposure if any account was compromised.
- No granular access control. The existing system could not restrict access based on user identity, role and device security posture.
- Internal applications exposed via private IPs. A solution was needed to allow secure external connectivity without exposing services on the public internet.
- Difficult user management. Manual onboarding, not scalable for a growing regulator workforce and external auditors.
What Brixio deployed
6 Cloudflare Tunnels for application segmentation
- Each tunnel mapped to a different internal application.
- Applications accessible without public internet exposure.
- Better segmentation and security than a single VPN connection.
Cloudflare Access with built-in OTP
- Instead of integrating an external Identity Provider, Taqeem opted for Cloudflare's built-in One-Time Password authentication.
- Simple, secure login via email OTP without additional identity infrastructure.
- Granular access policies based on user identity, device posture, and location.
Role-based access and MFA
- High-risk applications restricted to authorised users only.
- Multi-factor authentication enforced for all access.
Cloudflare WARP for network access
- Split tunneling configured for access to internal private IP addresses.
- Encrypted remote connectivity without traditional VPN.
Firewall and logging
- Firewall rules validated to allow Cloudflare Edge servers to communicate with internal systems.
- Detailed access logs providing real-time monitoring of authentication attempts and application access.
Architecture
Internal users and external auditors authenticate against Cloudflare's built-in OTP and reach internal apps through one tunnel per application — no public IPs, no VPN.
Internal staff Regulator workforce
External auditors Scoped access
Mobile users WARP enrolled
Cloudflare Zero Trust
Internal apps 6 dedicated tunnels
Private IP services WARP split tunnel
Audit logs Real-time
Results
After rollout, Taqeem operates without VPN: every internal application sits behind its own tunnel, every access goes through identity-aware OTP, and every decision is logged.
VPN eliminatedAll remote access now routes through Cloudflare Zero Trust, with no VPN client and no public IP exposure.
Per-application segmentation6 dedicated Cloudflare Tunnels isolate each internal application instead of granting broad network access.
Identity-based access without external IDPCloudflare's built-in OTP authentication replaces external identity infrastructure for staff and external auditors.
Audit-ready visibilityFull audit trail of access attempts, policy decisions and authentication events for compliance review.
