Head-to-head · updated 13 September 2026
DataShield vs Cloudflare AI Gateway: who governs the pipe, and who governs the data?
Cloudflare AI Gateway is a very good inference control plane. Already run on Cloudflare? Turn it on today. It routes to 70+ models, across 12+ providers. It caches responses. It fails over when a provider wobbles. Since June, it can even cap what a named user may spend. Core features cost nothing. That's a hard offer to argue with. So we won't try.
We sell the layer underneath. We tokenize datasets at ingest. Agents query tokenized data over MCP after that. Turning a token back into real data is a privileged, audited step. Every checked tool call gets checked against the agent's current authority. Each decision seals into a hash chain. Your auditor can verify it, without asking us for anything. This is a complement page. Most of our design calls assume a gateway is already in the path. The question is simple: which obligations land in the pipe, and which land in the data?
The short version
Pick DataShield when
- Someone will one day ask you to prove an agent's log wasn't edited. Gateway logs are rows on a platform you don't control. They age out, too. Ours is a hash chain, with signed, chained checkpoints. Run the verifier.
- The risk you carry is the raw PII already sitting in your datasets. A gateway can only act on traffic that passes it. We take the value out of the data.
- You need to pull an agent's authority mid-session. The very next checked tool call should fail closed.
- Your rule is that nothing leaves your account. We self-host on your own infrastructure with your keys. Cloudflare is Cloudflare's network, by design.
Pick Cloudflare AI Gateway when
- You want one endpoint for every model. Failover, caching, and streaming that survives a dropped connection. We offer none of that, and never will.
- The pain is the bill. Real-time spend limits, by model, provider, team, or user, are live. Per-user budgets ride on Cloudflare Access identity.
- You want to start this afternoon, for nothing. Core AI Gateway features are free. A default gateway now gets created on your first call.
- Your MCP problem is sprawl. MCP Server Portals put every server behind one Access-protected URL. WriteGuard adds per-tool risk tiers, too.
Bottom line: run both. Cloudflare is the best place to put your model traffic. It's not where your evidence should live. It's not where your PII should still be, either.
Feature by feature
Competitor cells describe what Cloudflare's public docs and blog say. We use the date above. If we got something wrong, email support@myorg.ai. We'll fix it and credit you.
| What matters | DataShield | Cloudflare AI Gateway | Edge |
|---|---|---|---|
| Point of control | The data layer, and the MCP tool boundary. Tokenization happens at ingest. The protection travels with the data, not the route. | The request path between your app and the model provider. Control begins where traffic passes through the edge. | n/a |
| Audit evidence | A SHA-256 hash chain, with Ed25519-signed checkpoints. Those checkpoints are chained too. The check names the exact failure: tampering, insertion, deletion, or truncation. Try the verifier. | Rich request logs, analytics, and Logpush. Guardrails logs are pitched at EU AI Act and DSA duties. We found no tamper-evidence mechanism. Log retention is capped by plan, too. | ◆ |
| Agent authorization | Every checked tool call passes a scope ceiling. It carries a declared authority tier too. It gets a revocation re-check before dispatch. Revocation lands mid-session. | Access policies sit at the portal. Plus WriteGuard per-tool risk tiers, which can block a write before the handler runs. It's the closest thing to our seam. It was still private beta in August 2026. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes on its own. It can't be quietly deleted from the log. | We found none in their docs. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts. Actor identities are HMAC commitments. The chain still verifies after the subject is gone. | Zero Data Retention support, with model providers. What about values the detector missed, then logged? We found no published erasure path for those. | ◆ |
| Data handling | Deterministic, join-preserving, vault-reversible tokens, at ingest. Plus quasi-identifier generalization, as a rule. Dates become year, decade, or age band. ZIPs become 3 or 4 digits. Phones, SSNs, and emails get partial masking too. Each column gets its own cardinality-reduction score. Plus masking-by-default SQL views. | DLP scans prompts and responses, using Cloudflare One profiles. Then it blocks or flags. It detects. It doesn't tokenize. So there's no way back, and no join key. | ◆ |
| Inline blocking and guardrails | No traffic proxy, by design. What we do have: a fail-closed gate on every value that leaves a checked dataset for a prompt. A PHI dataset refuses any AI endpoint not marked BAA-approved, too. We tokenize datasets at ingest. So the model works on tokens. | Core strength. Guardrails run Llama Guard 3 8B over prompts and responses. They can ignore, flag, or block. DLP can kill a response outright. | ◇ |
| MCP and agents | Native MCP endpoints sit on Auth, Ontology, and Lighthouse. Auth issues MCP tool tokens with scope ceilings. Per-call metering ties right back to the agent. | MCP Server Portals in Cloudflare One, a published enterprise MCP reference architecture, Code Mode, and thirteen first-party MCP servers. Deep, but split across products. | ◈ |
| Routing, caching, and cost | Not offered. We say so on sales calls. | The reason people buy it. 70+ models, 12+ providers, caching, retries, failover, rate limits, and real-time spend caps by user or team. | ◇ |
| Deployment | Self-hosted, in your own cloud or data center. Or on a dedicated single-tenant server we operate. Your keys, always. | Cloudflare's edge only. That's the product. The scale is the point. But on-prem isn't on the menu. | ◆ |
| Maturity signals | Auth, Guardian, and Lighthouse are all live in production. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet, and we say so plainly. | A public company, running one of the largest networks on earth. AI Gateway went GA in May 2024. It has shipped steadily since. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Core features free. Logs capped at 100,000 on Workers Free and 10 million per gateway on Workers Paid. Logpush $0.05 per extra million requests. Unified billing adds 5% on credit purchases. | ◈ |
◆ DataShield leads◇ Cloudflare AI Gateway leads◈ comparable
Cloudflare claims are drawn from developers.cloudflare.com and blog.cloudflare.com. Last checked 13 September 2026. WriteGuard and identity-driven budgets were in beta at that date. Check their status before you score them.
Three things you get here that you won't get from an inference gateway
Protection that exists before the proxy does
A gateway acts on traffic it sees. Tokenization happens at ingest. The sensitive value is gone from the dataset, whether a request ever routes anywhere. Tokens are deterministic, so your joins still work. How the data layer works.
Logs that are evidence, not just logs
Cloudflare's own Guardrails post points at EU AI Act duties. Fair. But a log you can't prove is unaltered is a thin answer. Especially on a plan that keeps only 100,000 rows. That's a thin answer for Article 12 or HIPAA §164.312(b). Ours is a hash chain instead. The verifier tells you what broke. Try it.
The key that outlives the analyst
An analyst is offboarded at 16:00. Their agent is 20 minutes into a 40-minute batch, unaware. A spend limit won't stop it. The budget isn't spent yet. Here, the next checked tool call gets re-checked. It fails closed. How Auth does it.
Where Cloudflare AI Gateway is genuinely stronger
Nearly everything about the request path, and it isn't close. One endpoint for 70+ models. Caching that cuts real money. Failover, when a provider has a bad afternoon. Streaming that survives a dropped socket. Spend limits you can scope to a person, a team, or a model. The identity comes from Access, not a shared API key. Guardrails can block a prompt in flight. We cannot. On the agent side, they've shipped more in twelve months than most startups ship in three years. MCP Server Portals. A reference architecture. Code Mode. WriteGuard's per-tool risk tiers. They also run all of it on a network we could not build. Have no gateway yet? Get one before you call us.
Here's the push-back. Every one of those controls sits on the wire. The wire isn't where your obligation lives. DLP that flags a Social Security number still means the number was in your dataset. A log with a plan-based retention cap is an operations tool, not evidence. Their own August post is refreshingly plain, too. User Insights spots odd behavior, then hands it to an admin. It doesn't decide intent. It doesn't block. Gartner expects most unauthorized agent transactions through 2028 to be internal policy violations, not attacks. Those don't look odd. They look like a permitted user doing a permitted thing. One they shouldn't have been permitted to do.
Questions worth asking both of us
Ask Cloudflare these. Then ask us the same ones.
What stops an agent from bypassing DataShield entirely?
Nothing, and we won't pretend otherwise. We're not an inline proxy. We don't intercept prompt traffic. The point is that bypassing us buys the caller very little. We tokenize datasets at ingest. An agent that skips every control just finds tokens, not raw values. Reaching a checked tool still needs a valid MCP tool token from Auth, with a scope ceiling on it. Ask the same question about a portal. An agent that dodges the portal reaches the real data. The protection lives in the data, not in the route.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes, it can. Records commit forward. Checkpoints are Ed25519-signed and chained to each other. A missing checkpoint shows up too. The check reports which failure it found. The chain at /verify is live. Try to fool it. Cloudflare: logs, analytics, and Logpush, with retention capped by plan. We found no tamper-evidence claim in their docs. Ask them to verify a chain in front of you.
What happens to a revoked agent mid-session?
We re-check current authority on each checked tool call. The call after a revocation fails, always. On the Cloudflare side, Access policies gate the connection. WriteGuard can block a write by risk tier, too. But we found no published description of mid-session authority downgrade. Ask for the number: after you pull someone's access, how many more calls can their running agent make?
How does WriteGuard compare to per-call authorization?
WriteGuard classifies the tool. It sorts calls into read-only, minimal impact, contained write, and critical. It attaches agent attribution too. It can block before the handler runs. That's a good idea. It was in private beta in August 2026. We classify the caller instead. Scope ceiling, authority tier, and a revocation re-check on every checked call. Then we seal the decision into the chain. The honest summary: they gate the tool, and we gate the authority. The two stack neatly.
How does GDPR erasure interact with the audit trail?
We crypto-shred the subject's key material. Then we issue an ISO 27560 receipt. Nothing gets removed from the chain, and it still verifies. Actor identities in it are HMAC commitments. Ask Cloudflare the hard version. Say a value their DLP profile missed six months ago is now in request logs and Logpush exports. What's the deletion procedure? What does it do to the logs you were going to show an auditor?
Does DataShield have SOC 2?
No, and we won't imply otherwise, ever. Auth is live now. It ships with a published threat model and a verifier anyone can run. Guardian and Lighthouse have both been live since April 2026. We're a small team, next to a public company. Design-partner terms include source escrow because of that. The stack self-hosts, too. Your uptime isn't tied to ours. Security page.
- AI Gateway docs hero: "Observe and control your AI applications." Caching, rate limiting, analytics, logging, retry and fallback across providers. - developers.cloudflare.com, 13 Sep 2026
- Core AI Gateway features are free. Logs are capped at 100,000 on Workers Free and 10 million per gateway on Workers Paid; Logpush costs $0.05 per additional million requests; unified billing adds a 5% fee on credit purchases. - Cloudflare AI Gateway pricing docs, 13 Sep 2026
- Guardrails run Llama Guard 3 8B over prompts and responses with ignore, flag, or block, and are pitched at EU AI Act and DSA logging duties. - Cloudflare blog, 26 Feb 2025
- MCP Server Portals put every MCP server behind one Access-protected URL with centralized logging of tool invocations. Open beta. - Cloudflare blog, 26 Aug 2025
- WriteGuard adds per-tool risk tiers and agent attribution: "a shared policy, attribution, and auditing layer." Private beta. - Cloudflare blog, 5 Aug 2026
- Identity-aware analytics baselines each user and agent. It "does not decide intent, and it does not block anyone," say Cloudflare themselves. - Cloudflare blog, 5 Aug 2026
- Eighty percent or more of unauthorized agent transactions through 2028 will be internal policy violations, not attacks. - Gartner, 2026
Other head-to-heads
DataShield vs AI gateways
Kong, LiteLLM and Prisma AIRS. Same question, different pipe.
ComplementDataShield vs AWS Bedrock AgentCore
A hyperscaler's agent runtime, and the evidence layer it doesn't ship.
Partial overlapDataShield vs MintMCP
An MCP gateway with SSO and allowlists, against tokenized data and a verifiable chain.
AllEvery comparison
One honest scorecard per vendor.
Keep Cloudflare in front. Then look at what sits underneath it. Break a live audit chain. Revoke an agent mid-session. Query a tokenized dataset. Demo Center access is free, with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →