6 Stop company data leaving through the browser.

ReadyLab and laptop~8 minGateway HTTP policiesDLP profilesApplication typesPayload loggingAntivirus

A customer list blocked on its way to personal storage, the same profiles catching card numbers and passwords inside an internal app, malware stopped on download, and the matched value decrypted from the log.

The problem

The Summit invite list on the company wiki - the same customer contacts Alice pastes into ChatGPT in the AI walkthrough - needs tidying, and Alice wants to finish it at home tonight. She exports the page and drops it into her personal file sharing account. Nothing about it feels like a breach. Separately, the company's own service desk is full of things nobody should have pasted there - a customer's card number, a service account's password - and "it is only on the internal network" is the whole of its protection.

Lands with: security and compliance teams, and anyone who has had to report a data breach

Before you start

The protection layer in block mode - ./protect.sh block on a laptop deploy, protection_mode = "block" in the lab. In log mode these rules record matches and allow them.
The Cloudflare One client signed in as .
open in a tab: Driftbox, a fictional consumer file sharing service the lab deploys, standing in for Dropbox or Google Drive. It is deliberately not behind Access - it plays a service outside the company. Its sign-in accepts any username and password.
The Backlog section is lab only - it reaches the private service desk.
The DLP private key from the key page, for the last section.

Run it

The export is allowed - it is where it goes next

Do	Say
As Alice, open Nexus → Marketing → Summit invite list (pasted from CRM - needs tidying) → Export.	Ten customers with names, titles and direct mobile numbers, pasted into the wiki by a colleague. The wiki lets anyone who can read a page export it, as every wiki does. Nothing has gone wrong yet.
Traffic policies → Firewall policies → HTTP → Block company data uploads to file sharing.	One rule for every file sharing service. It selects the File Sharing application type - Dropbox, Google Drive, OneDrive, WeTransfer, Box and some sixty more Cloudflare recognises - and inspects uploads only, for customer contact data, card numbers and employee records.
Sign in to Driftbox (anything works) and upload the exported file.	Blocked, with a page saying why and a notification from the Cloudflare One client. Driftbox itself still works - upload any harmless file and it goes through. It is the customer list that cannot leave.
Back in the wiki, show that nothing changed.	The control sits in the path the data takes, not in each application, so the next application that can export a file is covered on the day it is bought - Pipeline's account export is caught the same way.

The same profiles, on an internal application

Do	Say
As Alice, client on, open `https://backlog.corp.internal` and then BKL-1060.	An ordinary ticket, on an ordinary internal tool, reached over the private route from chapter 2.
Open BKL-1043, "Customer card declined on renewal".	Blocked. Somebody pasted the customer's full card number into the ticket to get a payment taken. The same DLP profile that protects the internet protects this, on traffic that never touched the internet - and Backlog has no idea it happened.
Open BKL-1051.	A service account's password, pasted "so you can reproduce it". Same answer, different profile.

And files that are dangerous rather than sensitive

Do	Say
Download the EICAR test file: `https://secure.eicar.org/eicar.com.txt`.	Every file uploaded or downloaded through Gateway is scanned. This one is the industry's harmless test signature, and it is refused before it reaches the laptop.

What exactly was in it

Do	Say
Insights → Logs → HTTP request logs, expand the blocked upload, Decrypt payload log, paste the key.	The matched values, masked, with a little context either side - the mobile numbers that tripped the rule. Encrypted with a key Cloudflare does not hold, so the evidence does not become a second copy of the data.

What the audience should see

The wiki page saved as a text file from its Export button.
The Driftbox upload refused with Horizon Inc's block page - naming the site, the application and the user - and the client notification Upload blocked: it contains customer or employee data.
BKL-1043 and BKL-1051 refused with a block page; BKL-1060 opening normally.
The EICAR download refused as malicious.
A decrypted payload showing partially masked mobile numbers.

Where the evidence is

Gateway HTTP request logs: each block with its policy, the DLP profile that matched, and a decryptable payload. The EICAR block shows as an antivirus detection.

Known limitations

Driftbox is fictional, because the labs have no real file sharing accounts. The same rule matches the real services by application type.
Personal and corporate accounts of the same service are not told apart - that is SaaS tenant control, which needs a real tenant and is out of scope here.
File sandboxing, which detonates unknown files before releasing them, is not provisioned.
Backlog has no way to create tickets, so the internal half shows data being stopped on its way out of the application rather than on its way in.

Part of: The whole of Cloudflare One · Secure web gateway and data protection · The full tour