Akamai vs Cloudflare AI Inference: PII Protection at Edge
The short answer
Pick Cloudflare if you want to start today and need PII scanning in both directions without a sales call. Pick Akamai if you already buy security and delivery from Akamai and want open-weight models on reserved GPUs with zero data retention under your existing contract. Facts below are from each vendor’s documentation and product pages on October 28, 2026.
This page is the personal-data spoke of our Akamai vs Cloudflare for AI chatbot deployment comparison.
| Cloudflare | Akamai | |
|---|---|---|
| Inference service | Workers AI (serverless, 200+ cities) | Akamai Inference: Serverless (beta, request access) and Dedicated (reserved GPUs, limited availability) |
| Data retention | No retention of inputs or outputs for standard requests; no training on customer content | Zero data retention for prompts and responses |
| PII in prompts | AI Gateway DLP (free, all plans); AI Security for Apps PII detection (Enterprise paid add-on) | Firewall for AI, policy-based sensitive-data controls |
| PII in responses | AI Gateway DLP can flag or block the response | Firewall for AI inspects responses for PII and data leaks |
| Region control | Data Localization Suite: Regional Services, Customer Metadata Boundary, Geo Key Manager (Enterprise add-on) | Dedicated endpoints in the region you choose |
| Audit | AI Gateway logs (DLP events logged per gateway) | Audit logging for control-plane operations and inference calls (limited availability) |
| Pricing | Workers AI $0.011 per 1,000 Neurons, 10,000 Neurons/day free; DLP scanning free | Serverless per million tokens (beta, not published); Dedicated by contract |
| Best for | Product teams, self-serve, mixed model providers | Akamai security customers, steady high-volume open-weight inference |
Cloudflare: the privacy controls are in the docs, and most are free
Workers AI runs the model. Its data usage page states two commitments: zero data retention for standard inference requests (stateful features such as AI Search store content by design) and no training on customer content. Pricing is public: $0.011 per 1,000 Neurons above a free 10,000 Neurons a day.
AI Gateway DLP is the PII layer. It sits in front of Workers AI or any external provider — OpenAI, Anthropic, Google — and scans both the prompt going out and the response coming back. Three outcomes are possible:
- Pass — no finding; the response is cached normally.
- Flag — the original response is returned, findings go into the
cf-aig-dlpheader and the logs. - Block — the provider’s response is discarded and replaced with a DLP error; blocked responses are not cached.
DLP scanning is free on all plans. Accounts without a Zero Trust subscription get two predefined profiles: Financial Information, and Social / Insurance / National Identifier Numbers. Custom profiles and the full predefined set come with a Zero Trust subscription that includes DLP. Policies apply per gateway, so a multi-tenant app that needs different rules per customer runs separate gateways. Streaming responses are buffered for scanning, which adds latency; Cloudflare suggests a request-only check or a separate gateway for latency-sensitive traffic.
AI Security for Apps (formerly Firewall for AI) adds PII, prompt-injection and topic scores to the WAF, but those detection fields are an Enterprise paid add-on and PII detection covers incoming prompts only.
Data Localization Suite is the answer to “processed only in the EU”: Regional Services choose which data centres may decrypt and process traffic, and Customer Metadata Boundary keeps identifying logs in-region. It is Enterprise-only and paid.
Akamai: retention and region by contract
Akamai Inference is a managed service with an OpenAI-compatible API: change the base URL and key and existing OpenAI code works. The catalog covers open-weight models including Llama, Qwen and DeepSeek. Zero data retention for prompts and responses is a listed feature, and Dedicated Inference gives a private endpoint on GPUs reserved for one customer, in the region and GPU configuration you pick. Serverless Inference is a beta you request access to, and Akamai does not publish per-token prices.
Firewall for AI is the PII layer. It inspects prompts for injection and jailbreaks and inspects responses for data leaks, toxic output and personally identifiable information, either at the Akamai edge or through a REST API in front of an assistant hosted anywhere — including one that calls a closed model.
The trade-off is access: you cannot sign up and test the full stack in an afternoon the way you can on Cloudflare.
Picks by situation
- Startup handling customer data, multiple model providers: Cloudflare AI Gateway with DLP in Block mode on responses, Workers AI for open models.
- EU or other residency rule, already a Cloudflare Enterprise customer: add the Data Localization Suite; Workers AI’s no-retention commitment covers the inference itself.
- Bank, insurer or retailer on Akamai, open-weight model at steady volume: Akamai Dedicated Inference in your required region plus Firewall for AI.
- Assistant on OpenAI, Anthropic or Bedrock, only the PII filter needed: either firewall in front of it; for vendor-neutral redaction libraries and APIs see best PII redaction tools for LLM prompts.
For prompt-injection defence see Akamai vs Cloudflare for GenAI prompt injection protection, and for failover and latency see Akamai vs Cloudflare AI inference high availability.
Last verified: October 28, 2026.