|
| 1 | +--- |
| 2 | +pcx_content_type: how-to |
| 3 | +title: DLP settings |
| 4 | +sidebar: |
| 5 | + order: 5 |
| 6 | +--- |
| 7 | + |
| 8 | +DLP settings allow you to configure account-level settings that apply across all DLP profiles and policies. These settings are located in **Zero Trust** > **Data loss prevention** > **DLP settings** in the [Cloudflare dashboard](https://dash.cloudflare.com/). |
| 9 | + |
| 10 | +## Optical Character Recognition (OCR) |
| 11 | + |
| 12 | +Optical Character Recognition (OCR) analyzes and interprets text within image files. When turned on, OCR can detect sensitive data within images your users upload. |
| 13 | + |
| 14 | +OCR supports scanning `.jpg`/`.jpeg` and `.png` files between 4 KB and 1 MB in size. Text is encoded in UTF-8 format, including support for non-Latin characters. |
| 15 | + |
| 16 | +To turn on OCR: |
| 17 | + |
| 18 | +1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **DLP settings**. |
| 19 | +2. Turn on **Optical Character Recognition (OCR)**. |
| 20 | + |
| 21 | +## AI context analysis |
| 22 | + |
| 23 | +:::note |
| 24 | +AI context analysis only supports Gateway HTTP and HTTPS traffic. |
| 25 | +::: |
| 26 | + |
| 27 | +AI context analysis uses a pretrained model to analyze surrounding context and adjust the confidence level of a detection. For example, a number that matches a credit card pattern may receive a lower confidence score if it appears in a context where credit card numbers are unlikely. DLP will log any matches that are above your confidence threshold. |
| 28 | + |
| 29 | +DLP redacts any matched text, then converts the surrounding context into a vector embedding and submits it to [Cloudflare Workers AI](/workers-ai/). Vector embeddings (not raw text) are stored in user-specific private namespaces for up to six months, along with hit count and the [false positive/negative report](/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#report-false-and-true-positives-to-ai-context-analysis). |
| 30 | + |
| 31 | +To turn on AI context analysis: |
| 32 | + |
| 33 | +1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **DLP settings**. |
| 34 | +2. Turn on **AI context analysis**. |
| 35 | +3. [Add the profile](/cloudflare-one/data-loss-prevention/dlp-policies/#2-create-a-dlp-policy) to a DLP policy. |
| 36 | +4. When configuring the DLP policy, turn on [payload logging](/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#log-the-payload-of-matched-rules). |
| 37 | + |
| 38 | +AI context analysis results will appear in the payload section of your [DLP logs](/cloudflare-one/data-loss-prevention/dlp-policies/#4-view-dlp-logs). To improve future detections of sensitive data, you need to [report false and true positives](/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#report-false-and-true-positives-to-ai-context-analysis). |
| 39 | + |
| 40 | +## Payload encryption key |
| 41 | + |
| 42 | +Before you begin logging DLP payloads, you will need to set a DLP payload encryption public key. DLP uses public-key encryption so that matched sensitive data is readable only by you — Cloudflare does not have access to your private key and cannot decrypt your logs. |
| 43 | + |
| 44 | +### Generate a key pair |
| 45 | + |
| 46 | +You will generate two keys: a public key (uploaded to Cloudflare to encrypt log data) and a private key (kept by you to decrypt log data later). |
| 47 | + |
| 48 | +To generate a public/private key pair in the command line, refer to [Generate a key pair](/waf/managed-rules/payload-logging/command-line/generate-key-pair/). |
| 49 | + |
| 50 | +### Upload the public key to Cloudflare |
| 51 | + |
| 52 | +1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **DLP settings**. |
| 53 | +2. In the **DLP Payload Encryption public key** field, paste your public key. |
| 54 | +3. Select **Save**. |
| 55 | + |
| 56 | +:::note |
| 57 | +The matching private key is required to view logs. If you lose your private key, you will need to [generate](#generate-a-key-pair) and [upload](#upload-the-public-key-to-cloudflare) a new public key. The payload of new requests will be encrypted with the new public key. Previously logged data encrypted with the old key will be permanently unreadable. |
| 58 | +::: |
| 59 | + |
| 60 | +## Payload log masking |
| 61 | + |
| 62 | +You can control how sensitive data appears in your DLP payload logs by selecting a masking level. This determines how much of the matched content is visible after decryption. |
| 63 | + |
| 64 | +To configure payload log masking: |
| 65 | + |
| 66 | +1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **DLP settings**. |
| 67 | +2. Go to the **Payload log masking** card. |
| 68 | +3. Choose one of the following masking levels: |
| 69 | + - **Full Mask (default):** Masks the match while preserving character count and visual formatting. For example, a Social Security Number appears as `***-**-****`. |
| 70 | + - **Partial Mask:** Reveals 25% of the matched content while masking the remainder. For example, `***-**-6789`. |
| 71 | + - **Clear Text:** Stores the full, unmasked match for detailed investigation. For example, `123-45-6789`. |
| 72 | + |
| 73 | +:::note |
| 74 | +The masking level is applied at detection time, before the payload is encrypted. Your team will see the selected format when they decrypt the log with your private key. |
| 75 | +::: |
| 76 | + |
| 77 | +:::caution |
| 78 | +The selected masking level applies to all sensitive data matches found within a payload window — not just the match that triggered the policy. |
| 79 | +::: |
| 80 | + |
| 81 | +## Migrate from profile-level settings |
| 82 | + |
| 83 | +OCR and AI context analysis are available at both the profile level (**Data loss prevention** > **Profiles**) and the account level (**Data loss prevention** > **DLP settings**) during the migration period. When both are configured, DLP uses OR logic for evaluation. A match occurs if either the profile-level or account-level setting would trigger a detection. |
| 84 | + |
| 85 | +Profile-level OCR and AI context analysis settings will be deprecated in a future release. We recommend migrating to account-level settings in **DLP settings** to ensure consistent behavior across all profiles. |
| 86 | + |
| 87 | +To migrate: |
| 88 | + |
| 89 | +1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **DLP settings**. |
| 90 | +2. Turn on **Optical Character Recognition (OCR)** and/or **AI context analysis** as needed. |
| 91 | +3. Go to **Zero Trust** > **Data loss prevention** > **Profiles**. |
| 92 | +4. For each profile with OCR or AI context analysis enabled, edit the profile and turn off the profile-level settings. |
| 93 | +5. Select **Save profile**. |
0 commit comments