6 Stop company data leaving through the browser.

ReadyLab and laptop~8 minGateway HTTP policiesDLP profilesApplication typesPayload loggingAntivirus

A customer list blocked on its way to personal storage, the same profiles catching card numbers and passwords inside an internal app, malware stopped on download, and the matched value decrypted from the log.

The problem

Nestor Herzog is an Account Executive at Horizon Inc, and he is leaving for a competitor. On his last afternoon he exports his book of business from the CRM and drops it into his personal file sharing account to take with him. Separately, the company's own service desk is full of things nobody should have pasted there - a customer's card number, a service account's password - and "it is only on the internal network" is the whole of its protection.

Lands with: security and compliance teams, and anyone who has had to report a data breach

Before you start

The protection layer in block mode - ./protect.sh block on a laptop deploy, protection_mode = "block" in the lab. In log mode these rules record matches and allow them.
The Cloudflare One client enrolled as , an Account Executive who owns four accounts in Pipeline.
open in a tab: Driftbox, a fictional consumer file sharing service the lab deploys, standing in for Dropbox or Google Drive. It is deliberately not behind Access - it plays a service outside the company.
The Backlog section is lab only - it reaches the private service desk.
The DLP private key from the key page, for the last section.

Run it

The export is allowed - it is where it goes next

Do	Say
As Nestor, open Pipeline → Accounts → Export.	A perfectly ordinary CRM export: his four accounts, every contact with a direct mobile number, and the discount on each open deal. Pipeline allows it, and should - it is his job to have this data.
Traffic policies → Firewall policies → HTTP → Block company data uploads to file sharing.	One rule for every file sharing service. It selects the File Sharing application type - Dropbox, Google Drive, OneDrive, WeTransfer, Box and some sixty more Cloudflare recognises - and inspects uploads only, for customer contact data, card numbers and employee records.
Upload the exported CSV to Driftbox.	Blocked, with a page saying why and a notification from the Cloudflare One client. Driftbox itself still works - upload any harmless file and it goes through. It is the customer list that cannot leave.
Back in Pipeline, show that nothing changed.	The control sits in the path the data takes, not in each application, so the next application that can export a CSV is covered on the day it is bought.

The same profiles, on an internal application

Do	Say
As Alice, client on, open `https://backlog.corp.internal` and then BKL-1060.	An ordinary ticket, on an ordinary internal tool, reached over the private route from chapter 2.
Open BKL-1043, "Customer card declined on renewal".	Blocked. Somebody pasted the customer's full card number into the ticket to get a payment taken. The same DLP profile that protects the internet protects this, on traffic that never touched the internet - and Backlog has no idea it happened.
Open BKL-1051.	A service account's password, pasted "so you can reproduce it". Same answer, different profile.

And files that are dangerous rather than sensitive

Do	Say
Download the EICAR test file: `https://secure.eicar.org/eicar.com.txt`.	Every file uploaded or downloaded through Gateway is scanned. This one is the industry's harmless test signature, and it is refused before it reaches the laptop.

What exactly was in it

Do	Say
Insights → Logs → HTTP request logs, expand the blocked upload, Decrypt payload log, paste the key.	The matched values, masked, with a little context either side - the mobile numbers that tripped the rule. Encrypted with a key Cloudflare does not hold, so the evidence does not become a second copy of the data.

What the audience should see

A CSV downloaded from Pipeline's Export button.
The Driftbox upload refused with Horizon Inc's block page - naming the site, the application and the user - and the client notification Upload blocked: it contains customer or employee data.
BKL-1043 and BKL-1051 refused with a block page; BKL-1060 opening normally.
The EICAR download refused as malicious.
A decrypted payload showing partially masked mobile numbers.

Where the evidence is

Gateway HTTP request logs: each block with its policy, the DLP profile that matched, and a decryptable payload. The EICAR block shows as an antivirus detection.

Known limitations

Driftbox is fictional, because the labs have no real file sharing accounts. The same rule matches the real services by application type.
Personal and corporate accounts of the same service are not told apart - that is SaaS tenant control, which needs a real tenant and is out of scope here.
File sandboxing, which detonates unknown files before releasing them, is not provisioned.
Backlog has no way to create tickets, so the internal half shows data being stopped on its way out of the application rather than on its way in.

Part of: The whole of Cloudflare One · Secure web gateway and data protection · The full tour