Data Loss Prevention
Cloudflare Data Loss Prevention (DLP) allows you to scan your web traffic and SaaS applications for the presence of sensitive data such as social security numbers, financial information, secret keys, and source code.
To prevent interference, Cloudflare does not write scanned content to disk. Instead, DLP only encrypts and temporarily stores content in memory. Optionally, you can configure payload logging to store encrypted copies of payloads from matching HTTP requests or a Logpush destination to export entire matching HTTP requests.
Data Loss Prevention complements Secure Web Gateway to detect sensitive data transferred in HTTP requests. DLP scans the entire HTTP body, which may include uploaded or downloaded files, chat messages, forms, and other web content. You can also use DLP with Email Security to scan outbound emails.
DLP requires Gateway HTTP filtering with TLS decryption for visibility into data in transit. The depth of visibility varies for each site or application. DLP does not scan any traffic that bypasses Cloudflare Gateway (such as traffic that matches a Do Not Inspect policy).
To get started, refer to Scan HTTP traffic with DLP.
Data Loss Prevention complements Cloudflare CASB to detect sensitive data stored in your SaaS applications. Unlike data in transit scans which read files sent through Cloudflare Gateway, CASB retrieves files directly via the API. Therefore, Gateway and WARP settings (such as Do Not Inspect policies and Split Tunnel configurations) will not affect data at rest scans.
To get started, refer to Scan SaaS applications with DLP.
DLP supports scanning the following file types:
- Text and CSV
- Microsoft Office 2007 and later (
.docx,.xlsx,.pptx), including Microsoft 365 - ZIP files containing the above
DLP will scan the text contained in Microsoft Office and PDF files.
The maximum file size is 100 MB. Size limitation is assessed against the file after unzipping. ZIP files can be recursively compressed a maximum of 10 times.