A volunteer-support assistant processes questions about transport arrangements, some of which include a participant’s phone number or home address. The operator wants to troubleshoot slow model responses and provider errors, but does not want raw prompt bodies retained in a widely accessible dashboard. Cloudflare AI Gateway offers request logging controls, including options for payload collection. The right setting depends on the organization’s policies and the separate Logpush export path. This guide describes a hypothetical setup, not a deployed security audit.
Classify which request data is necessary
Separate operational telemetry from content. The support team may need timestamps, provider, status, latency and usage quantities to diagnose errors; it rarely needs a volunteer’s exact address or message text in ordinary troubleshooting logs. Make a data map showing who can access each field and what retention period is justified.
Use synthetic inputs during testing. If real users have already submitted sensitive prompts, investigate existing retention and deletion procedures; turning off future payload collection does not retroactively guarantee that old records disappear. Review legal and contractual duties with an appropriate privacy lead.
Understand the default logging behavior
The Cloudflare documentation states that AI Gateway logs can include prompts, responses, provider, timestamp, status, token usage, cost and duration. Logging is enabled by default for gateways, though customers and billing arrangements differ. A developer who only checks whether the API call succeeded may miss that content was also stored.
Open gateway settings and document the actual configuration rather than relying on an example from another account. Confirm access control on the gateway and dashboard. New gateways require authentication according to the current documentation; legacy configurations may deserve an explicit review.
Distinguish log entry from payload retention
The `cf-aig-collect-log` request header controls whether a gateway log entry is collected for a request. The separate `cf-aig-collect-log-payload` control governs storage of raw request and response bodies while retaining metadata where logging applies. That difference matters if staff want latency statistics but not private conversation text.
For the imagined support workflow, metadata-only logging is a reasonable design goal. Confirm which headers are supported by the selected integration and whether the request path forwards them correctly. Do not publish headers containing authentication secrets or personal records in example screenshots.
Compare raw-body logging with metadata only
A raw-body log can reveal a question such as ‘Please call my parent at 555-…,’ while a metadata-only entry may still provide model name, status, duration and token counts. The difference is not merely a visual redaction in the dashboard; it concerns which data is stored. Configure and verify the actual collection setting.
The illustration shows a filled prompt panel on one side and an intentionally blank body panel with usage metadata on the other. It is a conceptual comparison, not evidence that any specific account has erased pre-existing logs. Test the behavior with invented contact information.
Account for Logpush independently
Cloudflare’s Logpush guide explicitly states that exports can occur regardless of whether dashboard logging is enabled. The `cf-aig-collect-log` and `cf-aig-collect-log-payload` headers do not control Logpush exports. Therefore, a developer cannot infer that disabling dashboard payload storage prevents data from reaching an external bucket or log processor.
Check whether Logpush is configured, where encrypted exports land, who can decrypt them and how downstream retention is enforced. Maintain separate controls for dashboard logs and exports. This is the key policy trap in a superficially simple logging change.
Build a minimal observability dashboard
Collect status codes, latency distribution, model/provider, token usage and sanitized request identifiers. Monitor error spikes and unusual request volumes without placing names or phone numbers into a custom metadata field. If support needs a prompt excerpt for a specific investigation, design a time-limited and authorized escalation mechanism rather than retaining everything by default.
Use a stable pseudonymous incident ID to connect the application record to an AI Gateway entry. Avoid embedding private messages into free-text tags or URL query strings, since those may be captured by other monitoring layers.
Test controls with synthetic sensitive data
Send a fabricated prompt containing a conspicuous fake phone number and a marker string through a nonproduction gateway. Compare what appears in dashboard logs and any enabled downstream exports. Inspect both a successful request and a provider error. Confirm that the markers are absent from destinations configured to exclude payloads.
Do not claim this test was performed merely because the setting is documented. The exercise is an acceptance checklist for a real operator. Log the test date, gateway configuration, observed storage and any unresolved exceptions before treating the rollout as approved.
Review retention and access by customer cohort
Cloudflare documentation distinguishes newer AI Gateway customers from legacy logging arrangements, and describes different pricing or retention contexts. Avoid quoting a universal retention duration without checking the gateway’s actual account and plan. Limit dashboard access and export permissions to staff whose job requires them.
Revisit the data map after adding DLP policies, guardrails or other middleware, because additional evaluations can create log records. Ensure that audit access itself is logged where policy requires and that exports are not silently copied into unrestricted analytics tools.
Release a privacy-tested logging configuration
Have security, operations and privacy stakeholders review gateway defaults, per-request overrides, Logpush, encryption handling and downstream deletion rules. Explain to support staff what logs will and will not contain. Maintain a runbook for emergency debugging that does not invite personnel to disable safeguards permanently.
Good observability is the ability to diagnose a slow or failed AI request while minimizing unnecessary exposure. The correct outcome is documented retention and tested controls, not the misleading claim that a dashboard toggle alone eliminates all prompt copies.
How We Research
For this November 2026 editorial review, we checked the named primary documentation: Cloudflare: AI Gateway Logging, Cloudflare: AI Gateway Logpush. We compared the documented feature boundaries and terminology with the hypothetical scenario described above and checked competing explanations for unsafe or unsupported claims. We did not use a paid account, run a live integration, upload real participant data, measure model performance, or test the illustrated outcomes. All images are original conceptual instruction diagrams rather than product screenshots or measured results. Confirm current API availability, service region, privacy rules, prices and interface details with the vendor and your organization before operational use.
Frequently Asked Questions
Yes. Cloudflare documents that log records can include raw prompts and responses along with usage and diagnostic metadata, depending on collection settings.
Use the documented payload collection control where supported, and verify the resulting log entries with synthetic input under your own gateway configuration.
No. Cloudflare explicitly documents that Logpush exports are independent of the collect-log headers and dashboard logging switches.
No. Cloudflare describes different log arrangements based on when a gateway was created. Check the applicable account and plan documentation.
Not necessarily. Future collection controls do not establish deletion of previously stored records or downstream exports; check the relevant retention and deletion procedures.