Cloudflare AI Gateway vs Nonimo Gateway for personal data

Cloudflare AI Gateway can spot personal data in prompts and answers, and it can stop them. It cannot replace them with stand-ins, and nothing in its documentation puts real values back into an answer: its data loss prevention (DLP) feature has two actions, flag and block.

Nonimo Gateway runs on your own servers. See plans and get in touch.

Cloudflare’s DLP needs no install: if your traffic already runs through Cloudflare, it is a setting, at no charge on all plans, next to caching, rate limiting and fallback. It is built to stop certain data at the edge. If your policy is “send the model a version without client names, and give staff an answer with the names back in it”, you need a proxy that pseudonymises and restores, and that is what Nonimo Gateway does.

What Cloudflare does with personal data

Three Cloudflare features touch personal data, and none of them masks it:

• DLP in AI Gateway scans prompts and responses with the DLP profiles you manage in Cloudflare One (financial data, PII, government IDs, healthcare, plus custom ones). Flag records the detection “for audit purposes without blocking”; on a blocked response, “the provider response is discarded and replaced with a DLP error response”.
• Guardrails judge harmful content with Llama Guard 3 8B on Workers AI. The page does not describe them as PII detection, they do not support stream: true requests, and Cloudflare says they “add approximately 500 milliseconds per request”.
• AI Security for Apps (formerly Firewall for AI) detects 13 PII categories in prompts only and feeds your WAF rules, which block, challenge or log. It is a paid Enterprise add-on.

On price, Cloudflare offers the core gateway features and DLP at no charge, bills Guardrails as Workers AI inference and does not publish the price of AI Security for Apps.

Where Cloudflare stops

No stand-ins, no restore. A prompt with a client’s name and IBAN either goes through as it is, with a log entry, or does not go through at all. There is no middle option where the model sees a placeholder and your staff see the real name in the answer.

Streaming waits for the whole answer. When DLP scans responses, “DLP buffers the full streamed response before scanning”. The user sees nothing until the model has finished. Scanning prompts only keeps the stream as it is, but then nothing checks what the model writes back.

It runs on Cloudflare’s network. We found no self-hosted option in the documentation we read, so prompts travel through Cloudflare on their way to the provider.

National IDs are a fixed list. The predefined DLP profiles name identifiers from a set of countries, such as the French social security number and the UK National Insurance number, but not a Spanish NIF or an Italian codice fiscale; for those you write a custom profile. Languages are not published.

Cloudflare AI Gateway and Nonimo Gateway, side by side

	Cloudflare AI Gateway (DLP)	Nonimo Gateway
Where it runs	Cloudflare’s network	On your own servers
Personal data action	Flag or block	Replace with stand-ins
Real values back in the answer	No	Yes
Streaming with protection on	Response scan buffers the whole answer	Real values back in the answer
Detection	Cloudflare One DLP profiles; no Spanish or Italian ID in the predefined list	National documents and numbers of each country covered
API	OpenAI-compatible endpoint, now deprecated for single-model calls	OpenAI-compatible
Caching, rate limiting, fallback	Yes	Not its focus

What blocking means for a small law firm

Take a 15-person law firm with an internal tool that drafts letters from case notes. Almost every useful prompt contains a client name, and many contain a date of birth or a reference number.

With DLP set to block, most of those prompts stop and staff get an error instead of a draft. With DLP set to flag, the prompts go through with the personal data intact and you get an audit trail of what left. Neither gives you the middle option: let the work happen while the provider sees stand-ins. That middle option is pseudonymisation, and what UK GDPR asks of it is worth reading before you choose. For what to strip from a prompt in the first place, see what personal information to remove before AI. An audit trail still helps when an insurer asks, as our cyber insurance questionnaire guide explains.

How Nonimo Gateway does it

Nonimo Gateway runs on your own servers. It exposes an OpenAI-compatible API, so your code keeps working when you change the base URL:

from openai import OpenAI

client = OpenAI(
    base_url="https://gateway.your-company.internal/v1",
    api_key="sk-...your own OpenAI key...",
)

It replaces personal data in what goes out and restores the real values in the response. It recognises the national documents and numbers of each country it serves, such as the Spanish DNI and NIF, the German Steuer-ID, the French NIR, the Italian codice fiscale and the Brazilian CPF. You use your own OpenAI key, and a LiteLLM plugin is available. Plans and prices are on the Nonimo Gateway page.

It helps with pseudonymisation; it is not a substitute for deciding whether a disclosure is lawful, which our guide on putting client data in ChatGPT walks through.

If you need your staff to work with client data through an LLM, not just be stopped, Nonimo Gateway is built for that. See plans and get in touch. For other gateway options, see Kong AI Gateway and PII and the Portkey comparison, or the full overview of PII redaction software.

Sources

• Cloudflare, AI Gateway overview. Available on all plans; caching, rate limiting, retries and fallback.
• Cloudflare, AI Gateway pricing. Core features and DLP at no charge, Guardrails billed as Workers AI.
• Cloudflare, OpenAI-compatible chat completions. The compat endpoint and its deprecation for single-model calls.
• Cloudflare, DLP in AI Gateway. Prompts and responses, block response, full buffering of streamed responses, request-only scanning.
• Cloudflare, set up DLP. Flag and block actions, DLP profiles.
• Cloudflare One, predefined DLP profiles. The national identifiers in the predefined list.
• Cloudflare, Guardrails. Harmful content evaluation and hazard categories.
• Cloudflare, Guardrails usage considerations. Llama Guard 3 8B, no streaming support, about 500 ms per request.
• Cloudflare, Firewall for AI. Rename to AI Security for Apps, WAF rules block or challenge.
• Cloudflare, AI Security for Apps PII detection. Prompts only, 13 categories.
• Cloudflare, AI Security for Apps. Plan availability, paid Enterprise add-on.

All checked 20 October 2026.

---

This page is for information. Product details of other vendors were checked on their official pages on 20 October 2026 and can change.