Cloudflare AI Gateway DLP vs Maskflare: flag and block, or mask and restore?

If you already route model calls through Cloudflare AI Gateway for caching, rate limits and analytics, switching on DLP is a few clicks. That's a good reason to try it first. The question is what happens when a prompt contains ada@example.com and a card number: the request gets flagged in a header, or it gets a 400 back. Whether that's acceptable depends on your product.

Maskflare wrote this page, and we've based Cloudflare's side on its developer documentation as of October 2026. Cloudflare ships fast, so check the docs for changes.

What does Cloudflare offer for sensitive data in AI traffic?

Three related features, each with a different job:

• AI Gateway DLP scans incoming prompts and outgoing responses using the same detection profiles as Cloudflare One DLP, predefined or custom. Each gateway's policy has two outcomes. Flag lets the request through and records findings in the cf-aig-dlp response header and logs. Block discards the response and returns a DLP error with status 400. Streaming responses are buffered before scanning, which adds time to first token. Only text is inspected; base64 and binary multipart content aren't decoded.
• AI Gateway Guardrails run Llama Guard 3 8B on Workers AI to classify prompts and responses by hazard category, with Flag, Ignore or Block per category, and a separate model for prompt injection. It's content safety, not PII masking.
• AI Security for Apps (formerly Firewall for AI) is a WAF capability that detects PII, unsafe topics and prompt injection in prompts sent to your own LLM endpoints. Results become fields you use in WAF rules to block or challenge. The detection fields are an Enterprise add-on, per Cloudflare's docs.

None of the three documents masking or tokenizing a value and putting it back in the answer.

When is Cloudflare enough?

• Your policy is “never send this”. If any card number in a prompt should stop the request, Block does exactly that at the edge.
• You want visibility first. Flag mode plus logs tells you how often sensitive data appears before you decide on enforcement.
• You already run on Cloudflare. No new vendor, no new contract, the same DLP profiles your security team maintains for Cloudflare One.
• You need content safety and injection checks at the same edge. Guardrails and AI Security for Apps cover those.

When do you need Maskflare?

1. The task needs the data. “Write a payment reminder to Ada Lovelace for CHF 2,400 to IBAN CH93 0076 2011 6238 5295 7.” Blocking stops a legitimate task. Maskflare sends tokens, the model writes the letter around them, and the gateway restores the real name and IBAN in the reply.
2. Streaming latency matters. Cloudflare buffers streamed responses before scanning. Maskflare masks server-sent events one by one and restores values while the stream is still flowing.
3. Embeddings and retrieval. Deterministic tokens mean the same value always becomes the same token, so you can embed masked text and still search it. Embedding requests fail closed.
4. Employees and agents. Cloudflare AI Gateway sits in front of your apps' API calls. Maskflare also covers people using ChatGPT, Claude, Gemini, DeepSeek and Perplexity on the web, MCP tool calls and coding agents.
5. Richer actions. Per rule you can mask, redact, keep the last four digits, hash with a per-org HMAC, apply format-preserving encryption, alert or block.
6. Detection built for Europe. 47 country packs with checksum validation and 232 credential formats, with a compliance coverage report you can export as evidence.

Cloudflare AI Gateway DLP vs Maskflare

Can you use Cloudflare and Maskflare together?

Yes. Cloudflare's WAF and AI Security for Apps can keep protecting your public endpoints, and AI Gateway can keep doing caching and analytics for traffic that has no sensitive data. For flows that do, point the provider SDK at Maskflare instead:

from openai import OpenAI

# Sensitive flows: mask and restore
private_client = OpenAI(base_url="https://<your-gateway>/v1/openai", api_key="mf_live_...")

One caveat: if Cloudflare DLP scans the same request after Maskflare has masked it, it will see tokens, not values, and won't flag anything. That's expected. Decide which layer owns sensitive-data policy so your logs tell a consistent story.

The honest objections

“Blocking is safer than masking.” For a value that should never leave, sure, and Maskflare can block too. But teams that block everything find people route around it. Masking lets the work happen without the value leaving.

“Our DLP profiles already live in Cloudflare One.” That's a fair reason to start with Cloudflare, since your security team maintains one set of profiles. If you move sensitive flows to Maskflare, you'll maintain a second set of rules. The compliance profiles (GDPR, UK GDPR, PCI DSS v4.0, HIPAA Safe Harbor, US PII) give you a starting point in one click, and shadow mode lets you compare results before you enforce anything.

“It's another hop.” It is. Maskflare adds about 2 ms median to a 10 KB chat request with default rules, 4.3 ms at p99.

“Cloudflare will probably add redaction.” Maybe. As of October 2026 it isn't documented. If it ships, restoring values in streamed answers is the part to test.

A worked example: one prompt, three outcomes

Your billing assistant receives: “Ada Lovelace (ada@example.com, card 4532 7781 0021 9047) was charged CHF 2,400 twice. Draft an apology and confirm the refund.”

Flag gives you a record that the card number left. Block stops a legitimate support task. Neither is wrong, but if the honest answer to “should this task be possible?” is yes, you need masking. You'd probably also set the card number to partial in Maskflare, keeping the last four digits so the draft can say “the card ending 9047” without the model ever seeing the full number. Rules can run in shadow or alert mode first, so you see what would change before enforcing it.

What Maskflare doesn't do

• No caching, rate limiting or cost analytics; keep a general gateway for those if you need them.
• No content-safety (toxicity) classification.
• Audio in realtime voice sessions isn't masked; text events are.
• SOC 2 Type II and ISO 27001 audits are in progress.