Targeted DLP: Matching the data you care about, not just the pattern
Data loss prevention has long struggled with a fundamental problem: knowing that a credit card number is present in a transaction is not the same as knowing that the transaction is a problem. A generic detection routine can flag an employee using a personal card for an online purchase, but that creates noise and obscures the cases security teams actually need to catch—like a customer's card appearing where it shouldn't. Cloudflare's new Exact Data Match (EDM) feature for its Data Loss Prevention (DLP) suite is designed to close that gap.
With EDM, administrators provide Cloudflare with a specific list of data—customer credit card numbers, names, addresses, or any other sensitive records—and Cloudflare scans traffic or repositories for only those entries. This replaces the broad "does this look like a credit card?" approach with a precise "is this our credit card?" check, drastically reducing false positives while enabling more targeted detection and blocking policies.
How Exact Data Match works
Traditional DLP detections identify a pattern (often via regular expressions) and then validate it with additional criteria, such as checksums or machine learning models. But those validations only confirm that a piece of data is syntactically a credit card—not that it belongs to a specific customer. EDM changes that by allowing you to upload a finite list of exact values you want to protect.
Privacy is preserved through client-side hashing. When a dataset file is uploaded, Cloudflare one-way hashes the data in the browser before any of it is transmitted. The cleartext never leaves the browser; only the hashed values are sent to Cloudflare via its API. Those hashes are stored and used to scan traffic or content for matches. When a match is found, the configured DLP policy—log or block—is applied.
Creating a dataset and using it in a profile
Datasets are the building blocks of EDM. To create one, navigate to the DLP section of the Cloudflare dashboard and select the option to upload a new dataset. Provide a descriptive name, an optional description, and a file containing the data you want to match.
Once uploaded, the dataset appears in a dashboard table where you can monitor the status of the upload. The hashing happens in the browser, which means the file's contents are never exposed to Cloudflare's servers in readable form.
Applying datasets to DLP profiles
After a dataset is successfully uploaded, it can be added to a DLP profile alongside other predefined or custom detection entries. The same profile can contain multiple datasets and other rule types, giving you flexibility in how you combine detections.
DLP profiles are used in two primary contexts: inline scanning and protection through Cloudflare Gateway, and scanning data at rest via Cloudflare CASB. This means your datasets can be enforced both on traffic passing through your network and on files stored in your connected cloud applications.
Availability and roadmap
Exact Data Match is now available for all existing DLP customers as part of the beta. Organizations that are not currently DLP customers can reach out to Cloudflare to learn more about the offering and request a consultation.
Cloudflare says it plans to expand the feature to support additional data formats and monitoring approaches, aiming to provide more flexibility as customers' data protection needs evolve.
