Cloudflare + DataSunrise for Complete Security

Key Highlights

The two systems operate independently but complement each other. Cloudflare reduces attack surface and enforces access control. DataSunrise governs how data is accessed, modified, and exposed once a connection is established.

How the Joint Solution Works

Cloudflare processes incoming traffic before it reaches internal infrastructure. Requests are inspected against security rules, filtered through WAF policies, and validated through Zero Trust access controls.

Once a request results in a database interaction, DataSunrise evaluates the SQL query. It can log the operation, apply masking rules, or block execution depending on defined policies.

This separation ensures that access control decisions and data exposure decisions handle different layers, reducing reliance on application code for security enforcement.

Control at the SQL Layer

Database access controls typically determine whether a user can connect and which tables they can query. They do not define how much of the data should be visible within query results.

DataSunrise introduces policy-based controls that operate on the result set itself. For example, the same query can return different values depending on the role of the user. Sensitive fields such as personal identifiers, financial data, or credentials can be partially masked or fully obfuscated.

This approach avoids the need to create multiple database views or duplicate datasets. Policies are applied dynamically at runtime and remain consistent across environments.

In addition to masking, the system records query activity with full context. This includes the executed statement, user identity, affected objects, and response characteristics. The resulting audit trail supports investigation and compliance reporting.

Operational Model

The integration does not require changes to application logic or database schema. Cloudflare continues to operate at the edge, while DataSunrise is deployed as a proxy or monitoring layer near the database.

Policies are managed centrally. Security teams define rules for masking, auditing, and blocking once, and those rules apply across all supported database platforms.

This reduces the need for database-specific configurations and minimizes inconsistencies between environments such as development, staging, and production.

The separation between traffic control and data control also simplifies troubleshooting. Issues related to connectivity, access, and traffic flow remain within Cloudflare. Issues related to query behavior and data exposure remain within DataSunrise.

Audit and Visibility

Cloudflare generates logs related to traffic, access attempts, and request metadata. DataSunrise generates logs related to database activity, including executed queries and data access patterns.

When combined, these logs provide a more complete record of system behavior. Security teams can correlate external requests with internal database activity, creating a traceable path from entry point to data access.

This is particularly useful in environments that require detailed audit trails. Instead of reviewing disconnected logs, teams can analyze events as part of a continuous flow.

Who This Is For

The combined approach is relevant for environments where both access control and data exposure must be managed consistently. It applies to organizations that operate public-facing services, handle regulated data, or maintain multi-tenant systems.

Different teams benefit in different ways depending on their responsibilities and the structure of their systems.

Conclusion

Cloudflare and DataSunrise address different layers of the same system. One manages access and traffic at the edge, the other governs query behavior and data exposure at the database level.

This separation allows teams to apply controls where they are most effective, without relying on application logic or duplicating security mechanisms across environments.

The result is a more consistent model for managing access, monitoring activity, and limiting data exposure across the entire request path.

FAQ