Head-to-head · updated 13 September 2026
DataShield vs Cloudflare AI Gateway: who governs the pipe, and who governs the data?
Cloudflare AI Gateway is a very good inference control plane, and if you already run on Cloudflare you should turn it on today. It routes to 70+ models across 12+ providers, caches responses, fails over when a provider wobbles, and since June it can cap what a named user is allowed to spend. Core features cost nothing. That is a hard offer to argue with, so we won't try.
We sell the layer underneath. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is checked against the agent's current authority, and each decision is sealed into a hash chain your auditor can verify without asking us for anything. This is a complement page. Most of our design calls assume a gateway is already in the path. The question is which obligations land in the pipe and which land in the data.
The short version
Pick DataShield when
- Someone will one day ask you to prove an agent's log wasn't edited. Gateway logs are rows on a platform you don't control, and they age out. Ours is a hash chain with signed, chained checkpoints. Run the verifier.
- The risk you carry is the raw PII already sitting in your datasets. A gateway can only act on traffic that passes it. We take the value out of the data.
- You need to pull an agent's authority mid-session and have the very next governed tool call fail closed.
- Your rule is that nothing leaves your account. We self-host on your own infrastructure with your keys. Cloudflare is Cloudflare's network, by design.
Pick Cloudflare AI Gateway when
- You want one endpoint for every model, with failover, caching, and streaming that survives a dropped connection. We offer none of that and never will.
- The pain is the bill. Real-time spend limits by model, provider, team or user are live, and per-user budgets ride on Cloudflare Access identity.
- You want to start this afternoon for nothing. Core AI Gateway features are free, and a default gateway now gets created on your first call.
- Your MCP problem is sprawl. MCP Server Portals put every server behind one Access-protected URL, and WriteGuard adds per-tool risk tiers.
Bottom line: run both. Cloudflare is the best place to put your model traffic. It is not where your evidence should live, and it is not where your PII should still be.
Feature by feature
Competitor cells describe what Cloudflare's public docs and blog say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Cloudflare AI Gateway | Edge |
|---|---|---|---|
| Point of control | The data layer and the MCP tool boundary. Tokenization happens at ingest, so the protection travels with the data, not the route. | The request path between your app and the model provider. Control begins where traffic passes through the edge. | — |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Public verifier. | Rich request logs, analytics, and Logpush. Guardrails logs are pitched at EU AI Act and DSA duties. We found no tamper-evidence mechanism, and log retention is capped by plan. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, a declared authority tier, and a revocation re-check before dispatch. Revocation lands mid-session. | Access policies at the portal, plus WriteGuard per-tool risk tiers that can block a write before the handler runs. It's the closest thing to our seam, and it was still private beta in August 2026. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents that auto-revokes and can't be quietly deleted from the log. | We found none in their docs. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities are HMAC commitments, so the chain still verifies after the subject is gone. | Zero Data Retention support with model providers. For values the detector missed and then logged, we found no published erasure path. | ◆ |
| Data handling | Deterministic, join-preserving, vault-reversible tokens at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column on quasi-identifiers and masking-by-default SQL views. | DLP scans prompts and responses using Cloudflare One profiles, then blocks or flags. It detects. It doesn't tokenize, so there's no way back and no join key. | ◆ |
| Inline blocking and guardrails | No traffic proxy, by design. What we do have: a fail-closed gate on every value that leaves a governed dataset for a prompt, and a PHI dataset refuses any AI endpoint not marked BAA-approved. Datasets are tokenized at ingest, so the model works on tokens. | Core strength. Guardrails run Llama Guard 3 8B over prompts and responses with ignore, flag, or block. DLP can kill a response outright. | ◇ |
| MCP and agents | Native MCP endpoints on Auth, Ontology, and Lighthouse. Auth issues MCP tool tokens with scope ceilings, and per-call metering is attributed to the agent. | MCP Server Portals in Cloudflare One, a published enterprise MCP reference architecture, Code Mode, and thirteen first-party MCP servers. Deep, but split across products. | ◈ |
| Routing, caching, and cost | Not offered. We say so on sales calls. | The reason people buy it. 70+ models, 12+ providers, caching, retries, failover, rate limits, and real-time spend caps by user or team. | ◇ |
| Deployment | Self-hosted in your own cloud or data center, or on a dedicated single-tenant server we operate. Your keys. | Cloudflare's edge only. That's the product, and the scale is the point, but on-prem isn't on the menu. | ◆ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | A public company running one of the largest networks on earth. AI Gateway went GA in May 2024 and has shipped steadily since. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Core features free. Logs capped at 100,000 on Workers Free and 10 million per gateway on Workers Paid. Logpush $0.05 per extra million requests. Unified billing adds 5% on credit purchases. | ◈ |
◆ DataShield leads◇ Cloudflare AI Gateway leads◈ comparable
Cloudflare claims are drawn from developers.cloudflare.com and blog.cloudflare.com, last checked 13 September 2026. WriteGuard and identity-driven budgets were in beta at that date, so check their status before you score them.
Three things you get here that you won't get from an inference gateway
Protection that exists before the proxy does
A gateway acts on traffic it sees. Tokenization happens at ingest, so the sensitive value is gone from the dataset whether or not a request ever routes anywhere. Tokens are deterministic, so your joins still work. How the data layer works.
Logs that are evidence, not just logs
Cloudflare's own Guardrails post points at EU AI Act duties. Fair. But a log you can't prove is unaltered, on a plan that keeps 100,000 rows, is a thin answer for Article 12 or HIPAA §164.312(b). Ours is a hash chain, and the verifier tells you what broke. Try it.
The key that outlives the analyst
An analyst is offboarded at 16:00. Their agent is 20 minutes into a 40-minute batch. A spend limit won't stop it, because the budget isn't spent. Here the next governed tool call is re-checked and fails closed. How Auth does it.
Where Cloudflare AI Gateway is genuinely stronger
Nearly everything about the request path, and it isn't close. One endpoint for 70+ models. Caching that cuts real money. Failover when a provider has a bad afternoon. Streaming that survives a dropped socket. Spend limits you can scope to a person, a team, or a model, with the identity coming from Access rather than a shared API key. Guardrails can block a prompt in flight and we cannot. On the agent side they have shipped more in twelve months than most startups ship in three years: MCP Server Portals, a reference architecture, Code Mode, and WriteGuard's per-tool risk tiers. They also run all of it on a network we could not build. If you have no gateway, get one before you call us.
Here's the push-back. Every one of those controls sits on the wire, and the wire is not where your obligation lives. DLP that flags a Social Security number still means the number was in your dataset. A log with a plan-based retention cap is an operations tool, not evidence. And their own August post is refreshingly plain that User Insights spots odd behaviour and then hands it to an admin; it does not decide intent and it does not block. Gartner expects most unauthorized agent transactions through 2028 to be internal policy violations rather than attacks. Those don't look odd. They look like a permitted user doing a permitted thing they shouldn't have been permitted to do.
Questions worth asking both of us
Ask Cloudflare these. Then ask us the same ones.
What stops an agent from bypassing DataShield entirely?
Nothing, and we won't pretend otherwise. We're not an inline proxy and we don't intercept prompt traffic. The point is that bypassing us buys the caller very little. Datasets are tokenized at ingest, so an agent that skips every control finds tokens, not raw values. Reaching a governed tool still needs a valid MCP tool token from Auth with a scope ceiling on it. Ask the same question about a portal: an agent that dodges the portal reaches the real data. The protection lives in the data, not in the route.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Records commit forward, checkpoints are Ed25519-signed and chained to each other so a missing checkpoint shows up too, and verification reports which failure it found. The chain at /verify is live. Try to fool it. Cloudflare: logs, analytics, and Logpush, with retention capped by plan. We found no tamper-evidence claim in their docs. Ask them to verify a chain in front of you.
What happens to a revoked agent mid-session?
We re-check current authority on every governed tool call, so the call after a revocation fails. On the Cloudflare side, Access policies gate the connection and WriteGuard can block a write by risk tier, but we found no published description of mid-session authority downgrade. Ask for the number: after you pull someone's access, how many more calls can their running agent make?
How does WriteGuard compare to per-call authorization?
WriteGuard classifies the tool. It sorts calls into read-only, minimal impact, contained write, and critical, attaches agent attribution, and can block before the handler runs. That's a good idea and it was in private beta in August 2026. We classify the caller instead: scope ceiling, authority tier, and a revocation re-check on every governed call, then seal the decision into the chain. The honest summary is that they gate the tool and we gate the authority. The two stack neatly.
How does GDPR erasure interact with the audit trail?
We crypto-shred the subject's key material and issue an ISO 27560 receipt. Nothing is removed from the chain and it still verifies, because actor identities in it are HMAC commitments. Ask Cloudflare the hard version: a value their DLP profile missed six months ago is now in request logs and Logpush exports. What's the deletion procedure, and what does it do to the logs you were going to show an auditor?
Does DataShield have SOC 2?
No, and we won't imply otherwise. Auth is live a published threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. We're a small team next to a public company, so design-partner terms include source escrow, and the stack self-hosts, which means our uptime isn't your uptime. Security page.
- AI Gateway docs hero: "Observe and control your AI applications." Caching, rate limiting, analytics, logging, retry and fallback across providers. — developers.cloudflare.com, 13 Sep 2026
- Core AI Gateway features are free. Logs are capped at 100,000 on Workers Free and 10 million per gateway on Workers Paid; Logpush costs $0.05 per additional million requests; unified billing adds a 5% fee on credit purchases. — Cloudflare AI Gateway pricing docs, 13 Sep 2026
- Guardrails run Llama Guard 3 8B over prompts and responses with ignore, flag, or block, and are pitched at EU AI Act and DSA logging duties. — Cloudflare blog, 26 Feb 2025
- MCP Server Portals put every MCP server behind one Access-protected URL with centralized logging of tool invocations. Open beta. — Cloudflare blog, 26 Aug 2025
- WriteGuard adds per-tool risk tiers and agent attribution: "a shared policy, attribution, and auditing layer." Private beta. — Cloudflare blog, 5 Aug 2026
- Identity-aware analytics baselines each user and agent, and "does not decide intent, and it does not block anyone." — Cloudflare blog, 5 Aug 2026
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. — Gartner, 2026
Other head-to-heads
DataShield vs AI gateways
Kong, LiteLLM and Prisma AIRS. Same question, different pipe.
ComplementDataShield vs AWS Bedrock AgentCore
A hyperscaler's agent runtime, and the evidence layer it doesn't ship.
Partial overlapDataShield vs MintMCP
An MCP gateway with SSO and allowlists, against tokenized data and a verifiable chain.
AllEvery comparison
One honest scorecard per vendor.
Keep Cloudflare in front. Then look at what sits underneath it: break a live audit chain, revoke an agent mid-session, and query a tokenized dataset. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →