Products

AI Adoption & Privacy

AI Workspace
Pricing

Network Security Pricing

Network DDoS Protection
Partners
About Myra
Login
WAAP (Myra App) AI Workspace EU CAPTCHA Partner Portal
Deutsch English Français
Emergency Demo
Products
Application Security DDoS Protection Web Application Firewall CDN Bot Management CAPTCHA Network Security Network DDoS Protection (cloud) Network DDoS Protection (on-prem) Network DDoS Protection (hybrid)

AI Adoption & Privacy

AI Workspace
Pricing

Application Security Pricing

DDoS Protection, WAF, CDN, Bot Management EU CAPTCHA

Network Security Pricing

Network DDoS Protection
Partners
About Myra

Company

About Us Careers News & Insights Events 2026 Press Contact

Why Myra?

References & Case Studies Certifications Migration Integrations GDPR Compliance Digital Sovereignty

Myra Compared

Myra vs. Competitors Cloudflare Alternative Akamai Alternative F5 Alternative
Login WAAP Login AI Workspace Login EU CAPTCHA Partner Portal Deutsch Français
Emergency Demo

Updated 12 October 2026

Cloudflare AI Gateway alternative: how Myra's gateway differs

As of 12 October 2026

Cloudflare AI Gateway is a proxy on Cloudflare's network that sits in front of 20+ model providers and adds logs and analytics, a cache, rate limits and spend limits, fallbacks, guardrails plus DLP scanning. If your apps already run on Workers, it is hard to beat. The gateway inside Myra AI Workspace covers much of the same ground as a managed service on Myra's own infrastructure, and it differs in three places that matter for European data: it replaces personal data with placeholders instead of only flagging or blocking it, its tokens are bound to one gateway, and it can refuse every non-EU route before a provider is called.

All Cloudflare statements on this page come from developers.cloudflare.com, checked on 12 October 2026 and listed under Sources.

Where Cloudflare's gateway is strong

Getting started is short. Cloudflare's own overview says it "only takes one line of code", and the OpenAI-compatible endpoint creates a default gateway on your first request. For a team with code in Workers, the env.AI.run() binding calls Workers AI models and, through Unified Billing, third-party models via the same gateway, with requests pre-authenticated inside the account.

The feature list is long and mostly self-service in the dashboard. Spend limits can be split by model, provider or any custom metadata key, so every agent or user gets its own budget bucket. Dynamic routing builds fallback chains and A/B splits in a visual editor. Logs export to your own bucket through Logpush, encrypted with an RSA public key you upload. With Unified Billing, several providers end up on one Cloudflare invoice. And if you put the gateway behind Cloudflare Access on a custom domain, requests from signed-in users carry their Access user ID as cf.user_id.

None of that is marketing gloss. For a startup building on Cloudflare's developer platform, the Cloudflare AI Gateway is the natural choice, and we would say so in a sales call.

One request, two gateways

The differences show up best on a single request. Say a support tool sends this to a frontier model: "Draft a reply to Anna Becker about the failed transfer from DE89 3704 0044 0532 0130 00." Streaming is on.

On Cloudflare, with DLP enabled and a policy checking requests for financial data, the gateway matches the IBAN. What happens next depends on the action you picked. With Flag, the prompt goes to the provider unchanged and the log entry records the match. With Block, the client gets error 2029 and the user gets nothing. Those are the two actions the setup page documents. If the policy also checks responses, Cloudflare buffers the whole stream before scanning, so time to first token grows with the length of the answer. Accounts without a Zero Trust subscription get two predefined DLP profiles, Financial Information and Social / Insurance / National Identifier Numbers; the profile for names and addresses needs a Zero Trust subscription that includes DLP.

On Myra, with the PII Protector set to "target": "both", a detection engine at Myra replaces the name and the IBAN with placeholders of the form [MYRA-REDACT-{TYPE}:…]. The provider sees the placeholders and writes its reply around them. On the way back, the gateway restores the original values, incrementally on a streamed response, holding back any token that is split across two chunks. The user reads a finished draft with the real name in it. IBANs are checked with a checksum; German identifiers such as the tax ID are checked the same way once you switch on de_recognizers, which is off by default. Masking is available in every plan.

Legally this is pseudonymisation. The mapping exists, so the data is still personal data under the GDPR; the provider simply receives less of it. And watch two defaults: without "target": "both", the reply keeps its placeholders, and fail_open lets a request through unmasked if the detection service is down, unless you set it to false or enforce masking for the tenant.

Comparison for platform teams

Question Cloudflare AI Gateway (per Cloudflare's docs) Myra AI Workspace gateway
Personal data in prompts DLP scan with Flag or Block, request and/or response Placeholders before external models, originals restored in the answer
Token scope API tokens are account-scoped; Run permission reaches every gateway in the account A gateway token works on one gateway only
Keeping traffic in a region Not compatible with Regional Services; Metadata Boundary supported, but not jurisdictional restrictions for log storage Optional EU floor per gateway or tenant, refuses non-EU routes with HTTP 403; off by default
Request logs On by default with prompt and response; a header drops payloads On by default with prompt and response (log_payloads: true); a header drops payloads
Content guardrails Llama Guard 3 8B on Workers AI, Prompt Guard 2 for injection; no streaming support Llama Guard 3 hosted locally at Myra, prompt-injection classifier, egress guard
Cache Exact match, off by default Exact match, off by default
Budgets Spend limits scoped by model or provider as well as metadata, eventually consistent Spend caps per token, gateway and tenant
Own models Workers AI catalogue Myra-hosted open-weight models on Myra's EU infrastructure¹
Audit trail Account audit log records gateway created, updated, deleted Admin changes and security events, tamper-evident via a hash chain on request; no view for customer admins

¹ On paid self-service plans, the Myra-hosted models need the “EU-Gov” add-on.

Token scope in multi-tenant setups

This one is easy to miss. Cloudflare's authentication page states that the AI Gateway Run permission "cannot be restricted to a single gateway", so a token with it can call every gateway in the account, including those holding stored provider keys. Cloudflare recommends separate accounts or a Worker binding if you need isolation between tenants. That is a clean answer if you build per-customer accounts anyway.

In Myra, each tenant has named gateways such as production and staging, and a gateway token authorises inference on exactly one of them. Personal tokens are bound to a user and a gateway and carry their own budget and rate limit. A leaked staging token does not open production.

Data location, said carefully

Cloudflare documents its options openly. Logs and analytics can sit behind the Customer Metadata Boundary, but the compatibility table marks AI Gateway as not compatible with Regional Services and notes that jurisdictional restrictions for log storage are not supported today. If you only need control over where logs land, switching off collection or exporting through Logpush to your own EU bucket may be enough.

Myra's gateway runs on Myra infrastructure with a BSI C5 Type 2 attestation; the application is outside that scope. Myra models run on Myra's own EU infrastructure. For external providers you can arm an EU-residency floor: once enabled, a route that would leave the EU is refused with 403 data_residency_blocked before the provider call, failover included. It is off by default, so a gateway only behaves this way after someone turns it on. Myra does not use customer data to train AI models; for external models, the provider's terms apply. On-premises deployment is available on request.

Stay with Cloudflare if

Look at Myra if requests must reach frontier models with names and account numbers taken out and put back, if one token must never reach another team's gateway, or if procurement asks for an EU-only routing rule you can switch on. The gateway also serves a chat workspace for employees, with projects that can be locked to Myra-hosted models.

For the category itself, read what an AI gateway does. There are parallel comparisons for LiteLLM and Portkey, and the Myra documentation has the PII Protector settings in full.

All statements about Cloudflare AI Gateway come from Cloudflare's developer documentation (see Sources), as of 12 October 2026. Cloudflare is a trademark of Cloudflare, Inc. Myra Security has no affiliation with Cloudflare. Nothing on this page is legal advice.

Frequently asked questions

Can Cloudflare AI Gateway mask personal data before it reaches the model?

Cloudflare's gateway scans prompts and responses with the same detection engines as Cloudflare DLP. The documented actions are Flag, which records the match, and Block, which stops the request or response with error 2029 or 2030. We found no option in the AI Gateway documentation that swaps a match for a placeholder and restores it in the answer (as of 12 October 2026).

Can I keep Cloudflare AI Gateway traffic and logs in the EU?

Cloudflare's Data Localization Suite compatibility table lists AI Gateway as not compatible with Regional Services, the feature that controls which data centres decrypt and process HTTPS traffic. The Customer Metadata Boundary is supported with one caveat: jurisdictional restrictions for log storage are not supported today. You can switch off log collection per gateway or per request.

Does Myra's gateway store prompts?

By default, yes. The request log keeps prompt and response text unless you set log_payloads to false on the gateway or send x-aig-collect-log-payload: false with a request. Cloudflare's default is similar: logs are on for every new gateway, and the cf-aig-collect-log-payload header drops the bodies while keeping metadata.

Is moving from Cloudflare AI Gateway to Myra a big code change?

Usually not, if your code already uses an OpenAI-compatible client. You change the base URL to /v1/{tenant}/{gateway}/compat and swap the Cloudflare token for a Myra gateway token. Model names differ: Cloudflare expects provider/model, so check the strings. Code built on Worker bindings such as env.AI.run() needs more work.

Sources