DLP gains OCR and source code detection

Cloudflare has added two previously requested capabilities to its Data Loss Prevention (DLP) service: Optical Character Recognition (OCR) for scanning images and scanned documents, and predefined profiles for detecting source code in inline traffic. Both features are now available in the DLP engine, which is part of Cloudflare One and works alongside other services such as CASB, ZTNA, SWG, remote browser isolation, and cloud email security.

OCR extraction converts text embedded in image files into readable, searchable text data. This matters because sensitive information commonly appears in images—for example, when employees upload pictures of passports, driver’s licenses, or other identity documents that contain PII such as birthdates and tax identification numbers. DLP policies can now inspect those images for sensitive content and block uploads or sharing attempts that would expose regulated data, helping organizations meet privacy and compliance obligations.

The new source code detections address theft of intellectual property as well as accidental exposure by internal users—such as a developer posting proprietary code to a public repository or feeding it into a generative AI tool. Cloudflare’s predefined DLP profiles cover C, C++, C#, Go, Haskell, Java, JavaScript, Lua, Python, R, Rust, and Swift. The detections are machine learning-based and trained on public repositories, and DLP inspects the HTTP body of requests so that security teams can block traffic containing code in those languages.

Configuration and policy enforcement

Administrators can use Cloudflare’s predefined DLP profiles or create custom detections. To block source code exfiltration, select the profiles for the languages you want to catch and then create a blocking policy through the secure web gateway. For example, an organization using Rust, Go, and JavaScript would enable those detections and could prevent source code from being uploaded to ChatGPT or other unauthorized destinations.

Enabling OCR on any detection is a toggle within the profile settings. Once turned on, DLP scans images in the same way it inspects text—Match Counts and Context Analysis behave identically, with no additional configuration required. OCR can be applied to both data at rest (via CASB) and data in transit (via Gateway), preserving consistent protection regardless of where the data lives or how it moves.