DLP datasets

Cloudflare DLP can scan your web traffic and SaaS applications for specific data defined in a custom dataset. Sensitive data can be hashed before reaching Cloudflare and redacted from matches in payload logs.

DLP dataset types

Exact Data Match

Exact Data Match (EDM) protects sensitive information, such as names, addresses, phone numbers, and credit card numbers.

All data in uploaded EDM datasets is encrypted before reaching Cloudflare. To detect matches, Cloudflare hashes traffic and compares it to hashes from your dataset. Matched data will be redacted in payload logs.

Custom Wordlist

Custom Wordlist (CWL) protects non-sensitive data, such as intellectual property and SKU numbers.

Cloudflare stores data from CWL datasets within DLP. Plaintext matches appear in payload logs.

Use DLP datasets

Prepare a dataset

Formatting

To prepare a dataset for DLP, add your desired data to a single-column spreadsheet. Each line must be at least six characters long. Entries do not require trailing or final commas.

For compatibility, save your file in either .csv or .txt format with LF (\n) newline characters. DLP does not support CRLF (\r\n) newline characters. For information on dataset limits, refer to Account limits.

Column title cells

Column title cells may result in false positives in Custom Wordlist datasets and should be removed.

DLP will detect and use title cells as column names for Exact Data Match datasets. If multiple columns have the same name, DLP will append a number sign (#) and number to their names.

Update EDM datasets

To select which Exact Data Match columns to use, you will need to reupload any EDM datasets added prior to column support.

Upload a new dataset

Upload an Exact Data Match dataset

1. In Zero Trust ↗, go to DLP > DLP datasets.
2. Select Create new dataset.
3. Choose Exact Data Match.
4. Upload your dataset file. Select Next.
5. Review and choose the detected columns you want to include. Select Next.
6. Name your dataset. Optionally, add a description. Select Next.
7. Review the details for your uploaded dataset. Select Save dataset.

DLP will encrypt your dataset and save its hash.

Upload a Custom Wordlist dataset

1. In Zero Trust ↗, go to DLP > DLP datasets.
2. Select Create new dataset.
3. Choose Custom Wordlist.
4. Name your dataset. Optionally, add a description.
5. In Upload file, choose your dataset file.
6. Select Save.

DLP will save your dataset in cleartext.

To use your uploaded dataset, add it as an existing entry to a custom DLP profile.

Manage existing datasets

Uploaded DLP datasets are read-only. To update a dataset, you must upload a new file to replace the original.

1. In Zero Trust ↗, go to DLP > DLP datasets.
2. Select the dataset you want to update.
3. Select Upload dataset and choose your updated dataset. Select Next.
4. If your select dataset is an Exact Data Match dataset, review and choose the new columns. Select Next.
5. Select Save dataset.

Your new dataset will replace the original dataset.

Remove existing column entries

If you want to update an Exact Data Match dataset to remove a column in use as an existing detection entry, you must remove the existing entry from any custom DLP profiles using it before updating the dataset.