Data Loss Prevention

Discover where sensitive data goes before you create a Data Loss Prevention policy

Passive Detection for Cloudflare Data Loss Prevention (DLP) lets you learn from your Gateway traffic before deciding what to log or block.

Test Data Loss Prevention profiles without sending traffic through Gateway

Test scan lets you check how Data Loss Prevention (DLP) evaluates sample content before you apply a profile to production traffic. Paste text, upload a file, or upload a HAR file, then select the profiles you want to test.

Source code detection improvements

Data Loss Prevention (DLP) source code detection now focuses on identifying whole source code file uploads and downloads. Previously, source code detection performed partial scans resulting in a higher rate of false positives.

Define custom topics for AI prompt protection

You can now define custom topics for AI prompt protection. Predefined AI prompt topics cover common content and intent categories such as PII, source code, and jailbreak attempts.

Classify sensitive content with Data Classification

Cloudflare DLP now includes Data Classification, which lets administrators organize and label sensitive content using labels, templates, and reusable data classes.

New predefined detection entries are available

Cloudflare DLP now includes new predefined detection entries.

Create and manage DLP detection entries outside of profiles

You can now create, view, and manage DLP detection entries outside of profiles.

Detect PII records with a new predefined DLP profile

Cloudflare DLP now includes a new predefined profile designed to detect PII records that contain multiple types of personal data: Personally Identifiable Information (PII) Record.

DLP account-level settings

Account-level DLP settings are now available in Cloudflare One. You can now configure advanced DLP settings at the account level, including OCR, AI context analysis, and payload masking.

Detect Cloudflare API tokens with DLP

The Credentials and Secrets DLP profile now includes three new predefined entries for detecting Cloudflare API credentials:

Configure how sensitive data appears in DLP payload logs

You can now configure how sensitive data matches are displayed in your DLP payload match logs — giving your incident response team the context they need to validate alerts without compromising your security posture.

Streaming ZIP file scanning removes per-file size limits

DLP now processes ZIP files using a streaming handler that scans archive contents element-by-element as data arrives. This removes previous file size limitations and improves memory efficiency when scanning large archives.

Detect and sanitize HAR files

HTTP Archive (HAR) files are used by engineering and support teams to capture and share web traffic logs for troubleshooting.