How Project Galileo Protects TEEI’s Platforms

The website, TEEI Language, TEEI Mentorship, Skills Academy, Evenhall and the tools our staff use, and what stands in front of each of them. Security and traffic figures read from our Cloudflare account between 14 and 18 October 2026.

Oksana T. learned English in one-to-one sessions with volunteers on TEEI Language. In her film she talks about joining when she felt stuck, and about becoming less afraid to speak.

Today, a learner can open TEEI Language on their phone, choose an available volunteer and start a conversation. Behind that experience are the web applications that organise participation, connect people and record their activity. Those applications run on Cloudflare, with Business-plan protection on our main zone provided through Project Galileo.

The Educational Equality Institute (TEEI) is a nonprofit, and our programmes are free. The participants in this story are Ukrainians affected by the war, both those displaced abroad and those still living in Ukraine, and women from Latin America and the Caribbean, including women who have migrated or been displaced. What people come for is ordinary, and it matters:

• finding a peer and a place to belong
• using a new language with more confidence in daily life
• talking through a CV or a job interview with someone who has done the job
• learning data, technology or project management skills

Volunteers from many countries give that time as conversation partners, mentors and teachers.

TEEI organises its programmes in four areas: connection, language, skills and work. Participants can combine language practice, skills learning and mentoring according to their needs, without following a fixed sequence. Three platforms on our main zone carry language, skills and work: TEEI Language, Skills Academy and TEEI Mentorship. Evenhall serves the companies whose employees take part.

This article goes through each platform in this story in turn: what people do there, what stands in front of it, and what that protection handled up to 16 October 2026. The screens come from demo platforms and sample workspaces: every name in those screens belongs to a sample profile, and none of the faces or pictures in them shows a participant. The two films are different. Oksana T. and Ihor R. took part in TEEI’s programmes and agreed to their films being used on TEEI’s pages. The security and traffic figures were read from our Cloudflare account between 14 and 18 October 2026. Cloudflare’s analytics are sampled, so those figures are estimates, and they count requests, not people, confirmed intrusions or prevented breaches. Each table, chart and note gives its own window, and their limits are listed at the end.

Built through volunteer contributions. TEEI’s software platforms are built through volunteer work, with NOK 0 spent on paid software development. Infrastructure and third-party services are separate from that figure.

How it fits together

A learner finds TEEI on the website and opens TEEI Language on a phone. The page comes from Cloudflare. They pick a volunteer who is free right now, and the volunteer’s screen rings. When they join the session, the Worker authenticates the request and asks AWS for a meeting; from then on their voice goes through the Chime media service in Ireland. When they leave, the platform settles the hours that a volunteer’s record and a partner company’s report are later built from. When a volunteer gives their time through an employer, the company’s managers see it in Evenhall. People earn certificates and badges as they go.

Each of those screens is answered by a different Worker, or by the same Worker doing a different job, and every one of them sits on a hostname of our main zone. The voice and video of the session itself run on Amazon Chime SDK, outside the zone. Cloudflare’s Managed Ruleset runs in front of every TEEI platform on the zone, so requests that match its signatures are blocked before they reach our code, whichever platform they arrive at.

The platforms hold people’s bookings, the records of the sessions they took part in, and the certificates they earn and share. Many of the people who use them are Ukrainians affected by the war, or people rebuilding a career or finding their way in a new job market.

Through Project Galileo, Cloudflare gives TEEI its Business plan on our main zone, at no cost. The main zone is more than the website. TEEI Language, TEEI Mentorship, Skills Academy and Evenhall all live on hostnames inside it, and so do our internal tools. The protection sits in front of the platforms where learners and volunteers meet, not only in front of the page that describes them. Galileo’s support is that plan on the zone. The Workers Paid plan, R2 storage, AI services and the other third-party services the platforms use are separate from it.

Most of the work is done by two layers. The first is the Cloudflare Managed Ruleset, which Cloudflare maintains and keeps up to date. The version we run was last updated on 15 October. The second is a handful of narrow rules we wrote ourselves for problems we have actually had.

That first layer was not on from the start. Our zone has been on the Business plan through Project Galileo since 6 July 2026, but we turned on the Managed Ruleset only on 22 September, so the blocks counted in this article start that day. A plan that includes a protection is not the same as a protection that runs.

At a glance

What a request meets on the way in

The same zone settings apply to every TEEI platform on the zone. They decide how a browser may connect, and what every answer tells it about connecting next time.

On 18 October 2026 we sent two requests from Oslo to show what happens next. The first asked for our impact page, the way a reader would. The second asked for /.git/config, a version-control file of the kind about 73 percent of the blocked requests asked for.

The reader’s request passed the ruleset and was answered by the website’s Worker. The probe never got that far. Cloudflare’s Managed Ruleset matched it to the rule Version Control - Information Disclosure, answered with its own block page and status 403, and recorded the event in our firewall data under the ray ID shown, a4c52e00fc8a5694. Both answers carry the same HSTS header and offer HTTP/3, and the OSL at the end of each ray ID names the data centre in Oslo that received them.

The website and the stories

Between 22 September and 16 October, Cloudflare’s Managed Ruleset blocked about 29,270 requests at the website’s address. Across the zone, most of what it blocks are requests for version-control files such as .git. The website stays open to anyone, without a sign-in, while those requests are turned away before they reach our code.

The website is an Astro 7 site that runs as a Worker with Static Assets. Most of our traffic goes there: of the about 5.2 million requests the five core application Workers answered in the 30 days to 16 October, the website’s Worker answered about 3.1 million. People find the programmes there, reach us through its forms, and watch films from people who took part.

Oksana T.’s film above is one of those on the stories wall. The films sit in an R2 bucket and reach the browser through the bucket’s public domain, in the byte ranges the player requests when it plays. The player is set to preload="none", which asks the browser not to fetch the video ahead of playback; its poster image loads with the page. Ihor R.’s film, further down, measured 6.7 MB on 15 October 2026, in the same square cut the stories wall plays.

What Cloudflare’s cache does for the zone is easiest to see by day, over the 30 days from 14 September to 13 October.

About 7.7 million of the 10.7 million requests in those 30 days, seven in ten, were answered from Cloudflare’s cache. About 2.7 million carry the status none, bypass or updating, and the dynamic and miss layers together are under 300,000.

The same zone carries the redirects that keep old links alive. The website used to run on WordPress, and other sites still link to its old addresses, among them news sites and job boards in Ukraine. On 12 October we found 39 of those addresses that answered 404 and added them to a Bulk Redirect list, 78 entries with both slash forms. All 117 checks we ran answered 301 in one hop, kept the query string, and ended on a page that answered 200.

Public figures that stay public

Anyone can open our impact page. When automated crawling of it increased, we did not put everyone behind a challenge. We wrote a narrow rule for that crawl instead. From 11 to 16 October it issued about 885 challenges.

The public statistics that the Language Worker publishes said, on 14 October 2026 at 13:38 UTC, that 12,517 sessions and 9,435.5 hours of conversation have taken place across TEEI Language and TEEI Mentorship, with members in 148 countries.

The website shows the same counter. Its impact page pins each published figure, so that a citation stays true, and under the record it prints the counter as it stands now. The website’s Worker asks the Language Worker for that number, so the reader’s address never reaches the counter, and reuses each reading for 30 seconds. The capture below was taken two hours after the reading above, so its live line is a little higher.

Forms that stay open

Partners, companies and volunteers reach us through public enquiry forms, and we want those forms open to anyone. In the 30 days we measured, a rule for known spam sources blocked about 433 submissions, all between 17 and 25 September. Since 26 September it has had nothing to block.

Those are two of the rules we wrote ourselves. They address the specific patterns we have observed on our services, and each one is kept as narrow as possible, so that public pages stay public. We are not publishing the exact rules.

TEEI Language: the ring and the room

The door. Between 22 September and 16 October, the Managed Ruleset blocked about 1,770 requests at TEEI Language’s address. Sign-in on TEEI Language also has a rate limit of its own, and in the 30 days we measured it recorded no events. In the 30 days to 16 October, the Language Worker answered about 1.4 million requests. For a learner, TEEI Language’s pages are where a conversation is arranged and begun: the booking, the ring and the way into the room.

TEEI Language and TEEI Mentorship are two products on one platform, built from one React Router 8 codebase and deployed as two Workers. Language is where people practise a language through real conversations; Mentorship connects mentees with professional mentors.

A volunteer’s home in TEEI Language shows the learner they meet next, the requests waiting for an answer and the hours they have given.

The ring. Some conversations do not wait for a booking. A volunteer can mark themselves available now, and a learner who sees them can start a session straight away. The volunteer’s screen then rings, and the volunteer answers or declines. If nobody answers, the booking must be settled and the learner told, even if the volunteer’s browser has been closed. That needs something that can hold a connection open and keep time after every browser has closed, which a request and a response cannot do. That is a Durable Object.

The room. People open the room from their own TEEI page, check camera and microphone in a lobby, and talk. The page comes from the Language Worker, and the video call runs on Amazon Chime SDK. In the meeting and attendee fields, the meeting service receives opaque identifiers, the booking’s generated ID and a pseudonymous user ID, rather than names or email addresses. The voice and video themselves take a separate path, through Chime’s media service, and background blur lets someone take part without showing their home.

The practice room article shows the room in full.

The distance. TEEI’s programmes are for people who are often on a phone, on a mobile network, in a country far from our database. By September, TEEI Language was quick in Western Europe and slow almost everywhere else. Over the week before 21 September, request-weighted regional averages of the data centres’ median Worker times on page requests were 247 milliseconds in Western Europe, 1,193 in the western United States, 1,656 in Japan and 2,723 in Oceania; the mix of pages was not controlled. A Worker runs in the data centre closest to the person by default, and our database has one location, in AWS Europe (Ireland), so the further away someone was, the more each trip to the database could cost. On 21 September we committed a placement setting so that our Workers run next to the database instead of next to the user; it reached production with the release of 22 September.

Placement, loader changes and indexes shipped together. The before-and-after figures describe that combined release and the traffic in each measurement window; they do not isolate the effect of placement. A request-local read coalescer batches eligible SQL reads into fewer transport calls; it does not deduplicate identical statements. Loader rewrites and indexes reduce other database work. Both weeks are summarised the same way, over every page request in the week; the placement article describes its own measurement window in full. The Workers article shows 179 and 499 milliseconds for the later week, because there the daily figures are averaged; taken as a whole, the same week gives 180 and 474.

TEEI Mentorship and Skills Academy

The door. Between 22 September and 16 October, the Managed Ruleset blocked about 1,119 requests at TEEI Mentorship’s address and about 1,771 at Skills Academy’s. The Mentorship Worker, which answers both, handled about 239,000 requests in the 30 days to 16 October.

Finding a mentor. On TEEI Mentorship, mentees browse approved mentors by expertise and request or book a session, and the mentor accepts when acceptance is required. A mentor helps with a CV, interview preparation, a job-search strategy, a career change or how hiring works in their industry.

Ihor R. is a career fellow on TEEI Mentorship. In his film he talks about moving to a different country, the help his mentors gave him with his LinkedIn profile, cover letter and CV, and wanting to work as a project manager.

Learning a skill. Skills Academy has two halves. Participants study at their own pace on DataCamp and take Google Career Certificates on Coursera. Alongside that, volunteers teach live: a workshop, a clinic, an expert Q&A, a webinar, or a class that meets weekly for two to six sessions. Mentors on TEEI Mentorship help participants choose learning resources, apply what they learned, review practical work and plan next steps. Skills Academy is served from a second hostname on the Mentorship Worker. TEEI brings the learners and does the scheduling. In a class, participants receive a certificate once the teaching team confirms the required attendance and reviewed work.

An instructor’s desk shows the next session with its registrations and the preparation for it, and the sessions after it.

Certificates people share

The certificates and badges people earn are kept in R2, in the bucket the website reads them from, and they are most of what R2 holds. The managed-artwork URLs we inspected use the website’s own hostname, where its Worker reads the files from R2, so those requests meet the same Managed Ruleset as the website.

By object count the order flips: the platform logs hold more than eleven objects for every certificate or badge.

The share cards for published sessions have a bucket of their own. A separate renderer outside Cloudflare writes them with an R2 API token, which is scoped to buckets, not to prefixes within them. R2’s temporary credentials can be narrowed to a prefix, but the renderer does not use them. We use separate buckets to keep the share-card renderer’s write access separate from certificate storage, so a fault in the renderer cannot overwrite the certificates people put on LinkedIn.

The public /verify/ page lists TEEI’s registration numbers, official domain and current programme names. Individual credentials have a separate verification page, which links to their badge and certificate files.

Evenhall: what companies see

Evenhall is where a partner company’s managers invite employees into TEEI’s programmes, see what they did there, and turn it into a report they can file. Between 22 September and 16 October, the Managed Ruleset blocked about 1,899 requests at the address Evenhall had under its earlier name, which now forwards to Evenhall. The Evenhall Worker answered about 332,000 requests in the 30 days to 16 October.

A company applies, and once TEEI has reviewed the application, its managers invite employees into TEEI Language, Skills Academy or TEEI Mentorship.

Evenhall sends email, takes in applications from companies and syncs employee lists from HR systems. None of that should keep the person who pressed the button waiting, so Evenhall uses three Cloudflare Queues: applications, email and HR system sync. A manager pastes the employees’ email addresses and presses Send invitations. For each address the Worker saves an invitation and an outbox row in separate database writes, then publishes a queue message that references the row. Queue messages identify work held in the database rather than carrying the recipient list or message content. Consumers use guarded claims and provider idempotency where supported to handle retries. Recovery and terminal handling differ between message families; the detailed queue article describes their boundaries.

Each of the three queues has a dead-letter queue. This is the email queue:

What Evenhall adds is the company’s view: who took part, how much time they gave, and reports a manager can prepare for leadership.

The hours in it are counted from the room, not the calendar. When both people join a session, we record from TEEI’s video room when each of them connected and left. For a one-to-one session, the hours are the time both were connected to the same room at the same time, not the length of the booking. A session whose evidence has not arrived is kept apart and is not counted as hours. “Verified” here means verified by TEEI, from our own room records. It does not mean audited by anyone else.

A company’s CSR manager sees each named employee’s hours and session records. Employees never see each other’s records, and participants’ names stay out of the company’s reporting. Personal learning conversations and mentoring notes stay private. The company never sees the conversation, only the record that it took place.

Staff tools and how we ship

Admin is where TEEI’s staff run the programmes. It has its own sign-in and role checks, and the Managed Ruleset runs in front of it as well. Selected preview and staging environments, our database tools and specific internal endpoints sit behind Cloudflare Access.

We deploy often. TEEI Language had 235 production deploys between 27 June and 14 October 2026, and TEEI Mentorship 107. Every production deploy is written to a deploy log and probed. If the probe fails, the release script restores the previous version on its own, as long as that version still works with the database schema.

That has happened twice. On 22 July a Language deploy failed its probe at 07:10:12 UTC, because the probe expected a heartbeat the new version had only just added; the previous version was back six seconds later, and a release with the corrected probe went out at 08:05 and passed. On 28 July a Mentorship deploy rolled back because the probe still expected the closed service Mentorship had been before it opened on 24 July. The recorded rollbacks on 22 and 28 July were triggered by probe problems. They demonstrate the rollback path, not confirmed application failures; the probes were corrected.

We keep logs long enough to answer a question asked next quarter, not only one asked this week, and Workers Logs keep a few days. So Language and Mentorship send their logs to R2 through Logpush. Logpush needs two switches, and having only the first is the trap: with observability on and Logpush off, the Logpush job exists, reports no error and delivers nothing. The two settings now sit next to each other in the configuration, with a comment that says so.

Silence is the other thing we watch for. Evenhall’s daily sync went stale on 12 July 2026, and nobody was told for two months. Now a sweep runs every five minutes and sends an alert when a scheduled job goes stale. It has been on in production since 28 September.

In the 30 days to 16 October, the five core application Workers answered about 5.2 million requests, and about 70 of them ended in a runtime error. Keeping the platforms on one account means a small team sees all of them in one place: one set of analytics, one set of logs and one view of every Worker.

What the protection handled

Since 22 September 2026, Cloudflare’s Managed Ruleset has run in front of every TEEI platform on the zone. From 22 September to 16 October 2026, it blocked an estimated 99,000 requests across TEEI’s main zone.

The rules those requests matched show what they asked for:

Together, about 86 percent of the blocked requests matched rules for files that can reveal how a site is built or where its secrets are kept.

A request that matches a signature does not tell us who sent it or why. In June 2026, for Project Galileo’s twelfth anniversary, Cloudflare published its first comprehensive report on cyberattacks targeting civil society, announced in its anniversary post. It found that civil society organisations faced attempts to exploit website vulnerabilities at a rate more than seven times higher than other Cloudflare customers.

Cloudflare’s Browser Integrity Check stopped about 406 more requests in the 30 days, most of them between 20 and 22 September. No DDoS-classified events appeared in the firewall data for the period.

The counts for each platform, given above, are also in the public data file. They are counted at each platform’s own hostname and do not add up to the total, because internal tools and other host variants are not listed.

If you run a small nonprofit on Cloudflare

This is what we would tell another organisation in our position:

1. Check which protections are actually enabled. We had the Business plan from July and turned on the Managed Ruleset in September. Check which rulesets are active, not just which features the plan includes.
2. Lock down the basics. Turn on Always Use HTTPS, strict TLS and a minimum of TLS 1.2. Turn on HSTS once every hostname it will cover, subdomains included, works over HTTPS.
3. Put internal tools and previews behind Cloudflare Access. We use Cloudflare Access to control access to selected preview and staging environments, database tools, and specific internal endpoints. Our admin application uses its own authentication and role checks.
4. Write narrow rules for the problems you actually have. One specific pattern is better than a challenge for every visitor.
5. Keep your logs longer than the dashboard does. We send the Workers logs for TEEI Language and TEEI Mentorship to R2 with Logpush, so that we can still answer next quarter’s questions about those services.

The engineering series behind this story

This article is the story of the people the platforms serve and the protection around them. The engineering behind it is a series of notes. It starts with How TEEI Runs Its Platforms on Cloudflare Workers. Two reading paths branch from it: Astro on Workers, for our website, and React Router 8, for TEEI Language, TEEI Mentorship, Evenhall and admin.

Thank you, Cloudflare

For the learner, the purpose is a conversation, a class or a useful exchange with a mentor. For the volunteer, it is a practical way to contribute. The technology has to support those encounters, while the organisation protects the information and services around them.

Through Project Galileo, Cloudflare gives TEEI Business-plan protection on our main zone. That protection sits in front of the website and the platforms through which people from Ukraine, Latin America and the Caribbean meet volunteers from many countries. Thank you to the Project Galileo team.

Cloudflare is welcome to share this story, quote it, and use TEEI’s name and logo.

About the figures

• Security and Workers traffic figures are estimates from Cloudflare’s sampled analytics, for 17 September to 16 October 2026 (UTC), read on 17 October 2026. The Managed Ruleset figures cover 22 September to 16 October. Programme totals are taken from TEEI’s public programme statistics, read on 14 October 2026.
• The counts per platform are for the Managed Ruleset at each platform’s own hostname, 22 September to 16 October 2026. Evenhall’s count is for its earlier hostname, which now forwards to the current one; both are served by the same Worker.
• The 5.2 million requests and the about 70 runtime errors cover the five core application Workers in the 30 days to 16 October 2026. The Workers article counts every production Worker in the 30 days to 14 October, so its totals differ. A runtime error is counted apart from HTTP error responses, and neither is an uptime figure.
• The two requests in the panel were sent by TEEI from Oslo on 18 October 2026 at 05:35 UTC, and their headers and the firewall event are kept with the article’s working files.
• Requests measure load, not people.
• A request that matches a signature does not mean we run the software it targets, or that the attempt would have worked.
• No DDoS-classified events appeared in the firewall data for this period. That does not show that no attack was attempted, and the observed activity does not establish a targeted campaign against TEEI.
• The Managed Ruleset, custom rule and DDoS figures, the Workers totals and the programme figures, with their measurement periods and definitions, are in a public data file. The cache and storage figures come from the Workers article.
• How TEEI Runs Its Platforms on Cloudflare Workers covers the architecture, the limits we hit and how we deploy.