× Cloudflare
Talk to Cloudflare →
Executive Brief · Vendor Consolidation

None of Wineshipping's edge, API, or AI stack sit on Cloudflare today.

wineshipping.com runs across three clouds — Google Cloud, Microsoft Azure and AWS — with no shared WAF, bot management, or CDN layer, and a customer-facing client portal with no visible edge protection at all. One network can front all of it.

See the 6 plays → View the roadmap
Who they are: Wineshipping.com LLC is a Napa, CA-based tech-enabled 3PL for the beverage-alcohol DTC industry — wineries, breweries, distilleries and DTC beverage e-commerce brands — serving 1,000+ brands nationwide. Est. ~$326.6M revenue and ~1,000 employees (ZoomInfo, 2026). Acquired by Greenbriar Equity Group in Nov. 2021 (from Endeavor Capital, which had owned it since 2014); the company has rolled up several fulfillment shops — Bacchus, Safe Haven, Oregon Wine Services, and 24 Seven/Vin-Go — under a "DTC Logistics" holding structure. The broader DTC wine-shipping channel has softened industry-wide (a Napa winery co-op cited "soft sales" when exiting direct shipping in Jan. 2026, per the Press Democrat), which puts a premium on operational efficiency and risk reduction over discretionary spend.

From vendor sprawl to one network

Identified live on wineshipping.com's own DNS and HTTP surface. Today, all seven sit outside Cloudflare — the right side is where they could live instead.
7 surfaces → 1 network
Google Cloud / SiteGroundmarketing site
Azure API Mgmtapi.wineshipping.com
Azure AD B2Cclient portal login
AWS / RedoclyAPI docs
AWS / Stonlysupport portal
GoDaddyDNS + payment links
OpenAI + Anthropicungoverned AI*
Cloudflare one network · one bill · one control plane
Goal: one edge in front of every property — today, none of it

Six consolidation plays

Each maps to a surface Wineshipping is already running — verified live, not assumed.
01

API Shield for the Azure API Mgmt gateway

↳ fronts Azure API Management

api.wineshipping.com CNAMEs straight to an Azure APIM instance (ws-apim-prod), and Wineshipping publishes a public developer portal (developer.wineshipping.com) so wineries and integration partners can call it directly.

  • Identified: api → ws-apim-prod.azure-api.net (CNAME sweep)
  • Automatic endpoint discovery + schema enforcement
  • Stops credential stuffing & scraping before origin
02

WAF + Bot Management for the Client Portal

↳ nothing today — direct nginx on Azure

The "Awesome Client Portal" (client.wineshipping.com) is where 1,000+ winery clients log in to see orders and inventory. It authenticates through Azure AD B2C but has no WAF, bot management, or rate-limiting visible in front of it.

  • Identified: raw nginx response, no cf-ray / WAF header
  • Login/credential-stuffing protection for 1,000+ winery accounts
  • Rate-limit & bot rules ahead of the Azure B2C auth flow
03

Page Shield for the portal's script supply chain

Client-side / Magecart-style risk

The Client Portal's own Content-Security-Policy allow-lists six-plus third-party script origins on a page handling order and inventory data — a growing surface with no client-side script monitoring visible today.

  • Identified live in CSP: b2clogin.com, lr-in-prod.com, stonly.com, widget.dromo.io, smarty.com
  • Detects unauthorized/compromised script changes
  • Purpose-built for pages that touch business data
04

One CDN across Google Cloud, Azure & AWS

↳ unifies 3 clouds, 1 registrar

The WordPress marketing site runs on Google Cloud via SiteGround; the API and client portal run on Azure; the docs (Redocly) and support center (Stonly) run on AWS/CloudFront; DNS sits with GoDaddy. No shared caching, TLS, or security layer ties any of it together.

  • Apex: 35.208.137.3 → Google LLC (ASN); server: nginx
  • One certificate & cache layer across every subdomain
  • Consistent security policy regardless of origin cloud
05

AI Gateway — govern AI tools already in use

Cost control · logging · no assumptions needed

wineshipping.com's DNS carries active domain-verification TXT records for both OpenAI and Anthropic — meaning custom-domain integrations with at least one enterprise AI tool are already live, with no governance layer in front of them today.

  • Identified: openai-domain-verification= & anthropic-domain-verification= TXT records
  • One pane of glass + logging across any model provider
  • Cache & rate-limit to control spend as usage grows
06

Email Security (Area 1)

↳ consolidates a sprawling SPF record

Wineshipping's SPF record authorizes Microsoft 365, SendGrid, Zoho, and Transmail as mail senders — a wide surface for a logistics company that invoices and bills 1,000+ wine-industry clients. They already fund phishing-simulation training via KnowBe4, showing security-awareness budget exists.

  • Identified live in SPF TXT: spf.protection.outlook.com, sendgrid.net, spf.zoho.com, transmail.net, _spf.psm.knowbe4.com
  • BEC & invoice-fraud defense for a shipping/logistics brand
  • Pairs naturally with existing KnowBe4 awareness training

Consolidation roadmap

A land-and-expand path for a net-new account — prove value on the highest-risk surface first, then extend across the rest of the footprint.
First 90 days

Land on the riskiest surface

  • WAF + Bot Management in front of the Client Portal login
  • Page Shield in monitor mode — inventory the portal's scripts
  • DNS/CNAME discovery workshop across all 6 subdomains
  • Free plan / trial zone stood up on wineshipping.com apex
By 6 months

Expand across the stack

  • API Shield discovery + schema on the Azure APIM gateway
  • Move the WordPress marketing site onto Cloudflare CDN + WAF
  • Stand up Email Security (Area 1) given the SPF sprawl
  • Confirm PCI-adjacent flow around GoDaddy Commerce payment links
Within 12 months

Consolidate & govern

  • AI Gateway governance over existing OpenAI/Anthropic usage
  • Consolidate DNS from GoDaddy onto Cloudflare DNS
  • One control plane + unified logging across GCP/Azure/AWS
  • Single vendor relationship for edge, security & AI governance

Consolidation snapshot

Current-state vendors are evidence-based; nothing here is assumed.
FunctionTodayHow it was identifiedOn Cloudflare
Client portal edge security Unprotected identified Raw nginx on Azure — no cf-ray/WAF header WAF + Bot Management
API gateway Azure API Management identified api → ws-apim-prod.azure-api.net (CNAME) API Shield
Portal script surface 6+ third-party JS origins Live CSP on client.wineshipping.com Page Shield
Marketing site / CDN Google Cloud via SiteGround Apex A 35.208.137.3 → Google LLC ASN; server: nginx Cloudflare CDN + WAF
AI tool governance Ungoverned (OpenAI + Anthropic) DNS TXT domain-verification records AI Gateway
Email security M365 + SendGrid + Zoho + Transmail SPF TXT record Email Security (Area 1)
DNS GoDaddy NS: pdns01/02.domaincontrol.com Cloudflare DNS

How we know — observed on wineshipping.com

No assumptions: every current-state vendor below was identified from public DNS records, HTTP response headers, and the live client-portal Content-Security-Policy.
Not on Cloudflare no cf-ray anywhere in the footprint Azure API Management ws-apim-prod.azure-api.net Azure AD B2C b2clogin.com in portal CSP Google Cloud / SiteGround 35.208.137.3 · server: nginx OpenAI + Anthropic DNS TXT verification Email sprawl M365 / SendGrid / Zoho / Transmail (SPF) GoDaddy pdns01/02.domaincontrol.com (NS) Zoho SalesIQ salesiq.zoho.com live-chat widget
LIVE Checking the Cloudflare edge serving this page…