6 Stop company data leaving through the browser.

ReadyLab and laptop~8 minGateway HTTP policiesDLP profilesApplication typesPayload loggingAntivirus

A customer list blocked on its way to personal storage, the same profiles catching card numbers and passwords inside an internal app, malware stopped on download, and the matched value decrypted from the log.

The problem

Horizon Inc's customer list lives in Pipeline. On a busy afternoon somebody exports it and drops it into their personal Dropbox to work on from home. Separately, its own service desk is full of things nobody should have pasted there - a customer's card number, a service account's password - and "it is only on the internal network" is the whole of its protection.

Lands with: security and compliance teams, and anyone who has had to report a data breach

Before you start

The protection layer in block mode - ./protect.sh block on a laptop deploy, protection_mode = "block" in the lab. In log mode these rules record matches and allow them.
The Cloudflare One client enrolled as , with the Cloudflare root certificate trusted.
The sample export downloaded: horizon-customer-export.csv - ten synthetic customers with direct mobile numbers and discounts, the shape of a real CRM export.
A personal storage account to upload to: Dropbox, Google Drive, OneDrive or WeTransfer.
The Backlog section is lab only - it reaches the private service desk.
The DLP private key from the key page, for the last section.

Run it

One rule for every file sharing service

Do	Say
Traffic policies → Firewall policies → HTTP → Block company data uploads to file sharing.	Not a list of services. It selects the File Sharing application type - Dropbox, Google Drive, OneDrive, WeTransfer, Box and some sixty more Cloudflare recognises - including the ones nobody thought to list. It inspects uploads only, for customer contact data, card numbers and employee records.
As Alice, upload `horizon-customer-export.csv` to the personal storage service.	Blocked, with a page saying why, and a notification from the Cloudflare One client. The service itself still works - she can upload her holiday photos. It is the customer list that cannot leave.
Open Pipeline and show where the export came from.	Nothing changed in the CRM. The control sits in the path the data takes, not in each application, so the next application that can export a CSV is covered on the day it is bought.

The same profiles, on an internal application

Do	Say
As Alice, client on, open `http://backlog.corp.internal` and then BKL-1060.	An ordinary ticket, on an ordinary internal tool, reached over the private route from chapter 2.
Open BKL-1043, "Customer card declined on renewal".	Blocked. Somebody pasted the customer's full card number into the ticket to get a payment taken. The same DLP profile that protects the internet protects this, on traffic that never touched the internet - and Backlog has no idea it happened.
Open BKL-1051.	A service account's password, pasted "so you can reproduce it". Same answer, different profile.

And files that are dangerous rather than sensitive

Do	Say
Download the EICAR test file: `https://secure.eicar.org/eicar.com.txt`.	Every file uploaded or downloaded through Gateway is scanned. This one is the industry's harmless test signature, and it is refused before it reaches the laptop.

What exactly was in it

Do	Say
Insights → Logs → HTTP request logs, expand the blocked upload, Decrypt payload log, paste the key.	The matched values, masked, with a little context either side - the mobile numbers that tripped the rule. Encrypted with a key Cloudflare does not hold, so the evidence does not become a second copy of the data.

What the audience should see

The CSV upload refused with Gateway's block page and the client notification Upload blocked: it contains customer or employee data.
BKL-1043 and BKL-1051 refused with a block page; BKL-1060 opening normally.
The EICAR download refused, with Blocked: this file was flagged as malicious.
A decrypted payload showing partially masked mobile numbers.

Where the evidence is

Gateway HTTP request logs: each block with its policy, the DLP profile that matched, and a decryptable payload. The EICAR block shows as an antivirus detection.

Known limitations

Personal and corporate accounts of the same service are not told apart - that is SaaS tenant control, which needs a real tenant and is out of scope here. The rule blocks the upload to any file sharing service.
File sandboxing, which detonates unknown files before releasing them, is not provisioned.
Backlog has no way to create tickets, so the internal half shows data being stopped on its way out of the application rather than on its way in.

Part of: The whole of Cloudflare One · Secure web gateway and data protection · The full tour