Sensitive data discovery

If you set InfoType.version to legacy when including the MEDICAL_ID infoType in your InspectConfig, Sensitive Data Protection now includes…

If you set InfoType.version to legacy when including the MEDICAL_ID infoType in your InspectConfig, Sensitive Data Protection now includes MEDICAL_RECORD_NUMBER findings as type MEDICAL_ID in the scan results.

A new version with an updated name dictionary is available for the PERSON_NAME infoType detector.

You can try it out by setting InfoType.version to latest when including the PERSON_NAME infoType in your InspectConfig.

Discover where sensitive data goes before you create a Data Loss Prevention policy

Passive Detection for Cloudflare Data Loss Prevention (DLP) lets you learn from your Gateway traffic before deciding what to log or block.

Sensitive Data Protection content policies are in General Availability.

You can use content policies to evaluate content and return an ALLOW or BLOCK verdict based on data sensitivity.

Test Data Loss Prevention profiles without sending traffic through Gateway

Test scan lets you check how Data Loss Prevention (DLP) evaluates sample content before you apply a profile to production traffic. Paste text, upload a file, or upload a HAR file, then select the profiles you want to test.

Image scanning is available in the following regions:

europe-north1

Source code detection improvements

Data Loss Prevention (DLP) source code detection now focuses on identifying whole source code file uploads and downloads. Previously, source code detection performed partial scans resulting in a higher rate of false positives.

Define custom topics for AI prompt protection

You can now define custom topics for AI prompt protection. Predefined AI prompt topics cover common content and intent categories such as PII, source code, and jailbreak attempts.

Classify sensitive content with Data Classification

Cloudflare DLP now includes Data Classification, which lets administrators organize and label sensitive content using labels, templates, and reusable data classes.

New predefined detection entries are available

Cloudflare DLP now includes new predefined detection entries.

Create and manage DLP detection entries outside of profiles

You can now create, view, and manage DLP detection entries outside of profiles.

Detect PII records with a new predefined DLP profile

Cloudflare DLP now includes a new predefined profile designed to detect PII records that contain multiple types of personal data: Personally Identifiable Information (PII) Record.

DLP account-level settings

Account-level DLP settings are now available in Cloudflare One. You can now configure advanced DLP settings at the account level, including OCR, AI context analysis, and payload masking.

Detect Cloudflare API tokens with DLP

The Credentials and Secrets DLP profile now includes three new predefined entries for detecting Cloudflare API credentials:

Configure how sensitive data appears in DLP payload logs

You can now configure how sensitive data matches are displayed in your DLP payload match logs — giving your incident response team the context they need to validate alerts without compromising your security posture.

Streaming ZIP file scanning removes per-file size limits

DLP now processes ZIP files using a streaming handler that scans archive contents element-by-element as data arrives. This removes previous file size limitations and improves memory efficiency when scanning large archives.

Detect and sanitize HAR files

HTTP Archive (HAR) files are used by engineering and support teams to capture and share web traffic logs for troubleshooting.