Compliance in Context: Why DLP Needs the Whole Network View
Data Loss Prevention (DLP) is about protecting data based on its characteristics — or what it is. Cloudflare has announced that DLP is now a native part of the Cloudflare One platform, moving data protection from a standalone feature to a component of a broader Zero Trust architecture.
In designing this solution, Cloudflare engineers spoke with a wide range of customers, from large enterprises with mature security operations to smaller teams with limited dedicated security resources. The common thread was not a lack of effort, but a loss of visibility. As data has migrated from on-premises servers to a sprawling ecosystem of SaaS applications, organizations have found it increasingly difficult to answer basic questions about their own information:
- Where is the data going?
- Are uploads and downloads moving to and from corporate or personal SaaS instances?
- What applications are storing sensitive data?
- Who has access to those applications?
- Can we see and block large downloads from file repositories?
This uncertainty is striking because many of these teams have already deployed endpoint agents, built custom rulesets, and established incident response pipelines for more traditional data protection. The challenge is not a lack of tools — it's that those tools were designed for a network perimeter that no longer contains the data.
From Identity to Content: Completing the Zero Trust Picture
A Zero Trust network architecture is fundamentally about securing data, but the existing control points each answer a different question about a given request. Identity-based access checks determine who is attempting to reach a resource, and device posture checks evaluate how they are connecting. DNS and HTTP filtering protect based on the reputation and category of the destination — informing you where the data is headed. An API-driven CASB adds another dimension by analyzing the configuration of your SaaS applications to reveal how those destinations are set up.
Yet none of these controls describe the data itself. DLP fills that gap by addressing what is being transmitted. Sensitive or confidential data can be identified by keywords, patterns, or file types, giving you a way to detect information moving across or out of the network — regardless of who is moving it or where they are sending it.
Implementation: Profiles and Policies
Cloudflare's DLP implementation is built around two steps: identifying the data, then deciding what to do with it.
Define DLP Profiles. Profiles are the mechanism for defining what data you want to protect. These are added to the Zero Trust dashboard, where you can add keywords and craft regular expressions to detect the presence of sensitive content. Cloudflare will also provide pre-built profiles for common categories, such as credit card numbers, to simplify initial setup.
Create an HTTP policy. Once a profile is configured, it can be referenced in a Cloudflare Gateway HTTP policy to allow or block sensitive data from leaving your organization. Gateway parses and scans HTTP traffic for strings that match the keywords or regexes specified in the DLP profile, enforcing the rules at the network edge.
Running DLP on Cloudflare's Network
DLP is a demanding workload to run comprehensively and at scale. Cloudflare's existing network — which securely delivers traffic to a significant portion of the global internet population within 50ms — is designed for precisely this kind of inline inspection. The company plans to expand the feature set over time, with integration into other Cloudflare One products such as Remote Browser Isolation already in development.
