Custom DLP Profiles: Bringing Flexible Data Detection to Cloudflare One
Data loss prevention hinges on a simple question: can you identify sensitive data before it leaves your organization? Predefined detectors for credit card numbers and Social Security numbers cover common compliance needs, but they don’t address data unique to your business — internal project code names, unreleased product terminology, or proprietary partner names. Those patterns vary by industry and organization, making generic detection insufficient.
Cloudflare is addressing that gap with Custom DLP Profiles in Cloudflare One, extending its data loss prevention offering with user-defined regular expression detections.
Building Detections with Existing Tooling
Custom DLP lives in Cloudflare Gateway, the secure web gateway component of Cloudflare One. As corporate traffic routes through Cloudflare, HTTP traffic can be inspected against both predefined and custom DLP profiles.
Administrators start within the Zero Trust dashboard under Gateway > DLP Profiles. From there, selecting Create Profile prompts for a name and description, then an Add detection entry workflow handles regex definitions. Each entry in a profile functions as an independent detection that can be toggled on or off via the Status field — useful for A/B testing or gradual rollout.
The regex engine aligns with what’s already available in Gateway HTTP policies: the Rust regex crate. This consistency minimizes the learning curve for administrators who have already built policies across Cloudflare’s platform, and the same syntax and limitations apply.
Detection entries are flexible enough to target either structured formats or simple keyword patterns. For example, an email address regex can be defined as a custom PII detector:
Documentation on supported regex syntax and examples is available in the Cloudflare developers documentation.
Applying Custom Profiles in Policies
Once a custom profile is created, it behaves exactly like a predefined profile when attached to HTTP policies. Predefined and custom profiles can be used side by side in the same policy — for instance, blocking a combination of credit card patterns and proprietary project names from being uploaded to an external domain:
What’s Next on the DLP Roadmap
Custom profiles are one component of a broader expansion of Cloudflare’s DLP offering. The most recent delivery cycle added expanded predefined profiles, custom detection entries, PDF scanning support, and improved file name logging.
Planned and in-development features include:
- Data at rest scanning with Cloudflare CASB
- Minimum DLP match counts to reduce false positives
- Microsoft Sensitivity Label support
- Exact Data Match (EDM) for precise, high-confidence detection
- Context analysis to evaluate the surrounding data before triggering
- Optical Character Recognition (OCR) for image-based text
- Additional predefined DLP detections
- Dedicated DLP analytics
Each of these additions aims to give security teams finer-grained visibility into where sensitive data resides and how it’s moving across the network.
Getting Started with DLP
DLP is delivered as part of Cloudflare One’s Zero Trust network-as-a-service platform. Organizations interested in onboarding can request a consultation directly or work through their account manager to get access to the new custom detection capabilities.
