Scan for sensitive data

import { Render } from "~/components";

:::note Requires Cloudflare CASB and Cloudflare DLP. :::

You can use Cloudflare Data Loss Prevention (DLP) to discover if files stored in a SaaS application contain sensitive data. To perform DLP scans in a SaaS app, first configure a DLP profile (a set of patterns that define what counts as sensitive data) with the data patterns you want to detect, then add the profile to a CASB integration.

Supported integrations

Configure a DLP profile

You may either use DLP profiles predefined by Cloudflare, or create your own custom profiles based on regex, predefined detection entries, datasets, and document fingerprints.

Configure a predefined profile

Your DLP profile is now ready to use with CASB.

Build a custom profile

Your DLP profile is now ready to use with CASB.

For more information, refer to Configure a DLP profile.

Enable DLP scans in CASB

Add a new integration

1. In the Cloudflare dashboard, go to Zero Trust > Integrations > Cloud & SaaS.
2. Select Add integration and choose a supported integration.
3. During the setup process, you are prompted to select DLP profiles for the integration.
4. Select Save integration.

CASB will scan every publicly accessible file in the integration for text that matches the DLP profile. The initial scan may take up to a few hours to complete.

Modify an existing integration

1. In the Cloudflare dashboard, go to Zero Trust > Integrations > Cloud & SaaS.
2. Choose a supported integration and select Configure.
3. Under DLP profiles, select the profiles that you want the integration to scan for.
4. Select Save integration.

If you enable a DLP profile from the Manage integrations page, CASB will only scan publicly accessible files that have had a modification event since enabling the DLP profile. Modification events include changes to the following attributes:

• Contents of the file
• Name of the file
• Visibility of the file (only if changed to publicly accessible)
• Owner of the file
• Location of the file (for example, moved to a different folder)

:::caution If you add a DLP profile to an existing integration, CASB only scans files modified after you enabled the profile. To scan all files, you must enable the DLP profile during the integration setup flow. :::

Limitations

DLP in CASB will only scan:

• Text-based files such as documents, spreadsheets, and PDFs. Images are not supported.
• Files less than or equal to 100 MB in size.
• Java and R source code files that are at least 5 KB. Smaller files in these languages are skipped.