VPC Service Controls can help you mitigate the risk of data exfiltration from Dialogflow. Use VPC Service Controls to create a service perimeter that protects the resources and data that you specify. For example, when you use VPC Service Controls to protect Dialogflow, the following artifacts cannot leave your service perimeter:
- Agent data
- Detect intent requests and responses
Limitations
The following limitations apply:
- Integrations let third-party applications directly connect to Agents regardless of if the Agent is within a service perimeter.
- Webhooks can be used to directly connect to a Cloud Function or Cloud Run endpoint within the same service perimeter as the Agent
- Webhooks can be used to connect to services integrated with Service Directory private network access
Any other type of webhook service is not supported and will be blocked.
Service perimeter creation
When you create a service perimeter,
include Dialogflow (dialogflow.googleapis.com) as a protected service.
You aren't required to include any additional services
for Dialogflow to function.
However, Dialogflow won't be able to reach resources outside the perimeter,
such as files in a Cloud Storage bucket that is outside the perimeter.
For more information about creating a service perimeter, see Creating a service perimeter in the VPC Service Controls documentation.