Preventing Sensitive Data Exposure in AI Tools with Cloudflare Gateway and DLP

AI tools like ChatGPT, Claude, Gemini, and Perplexity are now part of everyday employee workflows. They help developers review code, support teams summarize cases, finance teams analyze spreadsheets, and business users draft content. The risk is that users may accidentally paste sensitive data into public AI services: SSNs, API keys, customer records, financial data, source code, HAR files, or internal business context.

Cloudflare Gateway and Cloudflare One Data Loss Prevention give administrators a practical way to control this risk without blocking AI entirely. The goal is not always "block ChatGPT." A better goal is usually:

Allow approved AI usage, but prevent sensitive data from being submitted to AI tools.

This post walks through how to build that control model using Gateway HTTP policies, DLP profiles, Body Phase, Browser Isolation, OCR, and AI Context Analysis.

Architecture Overview

A strong Cloudflare AI data protection architecture usually combines several controls:

For workforce access to public AI tools, Gateway HTTP policies are the main enforcement point.

For company-built AI applications, especially Workers-hosted AI wrappers, AI Gateway and Access should also be part of the design.

Gateway DLP Prerequisites

To inspect AI prompts and uploads through Gateway, make sure these are in place:

AI Gateway DLP is different. It inspects AI traffic directly as an AI proxy, so it does not require Gateway HTTP filtering or TLS decryption.

The Most Important Concept: Body Phase

Body Phase controls which direction of HTTP body content DLP scans.

This matters a lot.

If your goal is to stop users from typing or uploading SSNs into ChatGPT, use:

Body Phase = Request Body

If you do not specify Body Phase, DLP may also inspect response bodies. That means Gateway can trigger when a normal webpage loads and happens to contain something that looks like an SSN.

Example request body:

Please summarize this employee record:
Jane Smith, SSN 123-45-6789

Example response body:

Example SSN format: 123-45-6789

For the first case, blocking makes sense. For the second case, blocking may create noise.

Example: Block SSNs In ChatGPT Prompts Without Blocking ChatGPT

This is a common implementation goal: prevent users from submitting SSNs to ChatGPT, but do not block ChatGPT entirely.

Recommended Gateway HTTP policy:

Action:

Block

If Application Granular Controls are available, make it even more precise:

Action:

Block

This allows ChatGPT to load and operate normally, but blocks prompt submissions that contain SSN-like data.

Test prompt that should be blocked:

Summarize this employee record: John Smith, SSN 123-45-6789.

Test prompt that should be allowed:

Explain what an SSN is and why companies should protect it.

If the second prompt is blocked, review the enabled detection entries in the SSN profile. The Social Security Number Text entry can match words like SSN or social security, which may be noisier than numeric SSN detection.

For stricter SSN handling, create a custom DLP profile that only includes:

United States SSN Numeric Detection

Using Browser Isolation With DLP

Some customers isolate ChatGPT while also applying DLP. This is a valid pattern, but policy behavior can be confusing.

Gateway HTTP policies are evaluated broadly in this order:

That means an Isolate ChatGPT policy can route ChatGPT into Browser Isolation first. A separate DLP block policy still needs to evaluate the prompt submission traffic.

Recommended policy model:

The DLP policy should not use Isolate as the action. It should usually be an Allow policy for logging or a Block policy for enforcement.

Also make sure there is no broad Do Not Inspect or Do Not Scan policy for ChatGPT, because those can prevent DLP from operating as intended.

Recommended Baseline AI Policy Pack

A practical customer policy set often looks like this:

Tenant Control For ChatGPT Business

If the customer uses ChatGPT Business or Enterprise, Gateway can enforce tenant control by injecting the workspace header.

Policy:

Action:

Allow

Add header:

This helps prevent users from authenticating to personal ChatGPT workspaces from managed devices.

Predefined DLP Profiles To Know

Cloudflare provides several predefined DLP profiles that are useful for AI governance.

Cloudflare also provides AI prompt profiles:

These are especially useful with Application Granular Controls on supported AI apps.

OCR In DLP

OCR stands for Optical Character Recognition.

In Cloudflare DLP, OCR allows DLP to inspect text inside supported image files that users upload.

Supported OCR file types:

Example:

A user uploads a screenshot to ChatGPT containing:

Employee: Jane Smith
SSN: 123-45-6789

With OCR enabled, DLP can extract the text from the image and apply the SSN profile.

Useful OCR use cases:

OCR expands what DLP can see. It is not a full image-understanding engine; it extracts readable text from supported images.

AI Context Analysis

AI Context Analysis improves DLP accuracy by analyzing the context around a detection.

Traditional DLP may find a pattern like:

123-45-6789

That looks like an SSN. But context determines confidence.

Higher-confidence example:

Employee SSN: 123-45-6789

Lower-confidence example:

Test format example: 123-45-6789

AI Context Analysis uses a pretrained model to evaluate surrounding context and adjust the confidence level of the match.

Cloudflare redacts matched text first, then converts surrounding context into vector embeddings. Those embeddings are submitted to Cloudflare Workers AI and stored in private user-specific namespaces for up to six months with hit counts and false-positive/true-positive feedback.

In practical terms:

OCR expands visibility. AI Context Analysis reduces false positives.

Confidence Threshold Strategy

Cloudflare DLP supports confidence thresholds:

A good deployment model is to split monitoring and enforcement:

This gives security teams visibility without immediately disrupting users.

Logging And Investigation

Cloudflare DLP supports several logging options:

Payload logs are especially useful for tuning DLP policies.

By default, matched content is masked. For example:

123-45-6789

may appear as:

***-**-****

Masking options include:

Use clear text carefully. Payload logs can contain highly sensitive data.

Common Implementation Mistakes

Recommended Deployment Path

Final Recommended SSN Policy

For the original use case, the cleanest policy is:

Application = ChatGPT
AND DLP Profile = Social Security, Insurance, Tax, and Identifier Numbers
AND Body Phase = Request Body
Action = Block

If available:

AND Control = Prompt / SendPrompt

This prevents users from submitting SSNs to ChatGPT without blocking all of ChatGPT and without triggering on random SSNs displayed on webpages or AI responses.

That is the right model for AI governance with Cloudflare Gateway: precise controls, scoped inspection, and progressive enforcement rather than blunt blocking.