Cloudflare passes South Korea's tough data security audit

Cloudflare has been certified under South Korea's Information Security Management System, known as ISMS, using its ISMS-P framework. Auditors appointed by the Korea Internet & Security Agency (KISA) spent ten days working through 80 controls with the company. The audit also led to a visible change: people who sign up for Cloudflare from South Korea now see a different form.

What changed at sign-up

In Korea, one combined agreement is split into four labeled items. Each is marked required or optional, links to its full text, and can be accepted all at once. Three items are required. The sign-up button stays disabled until all three are checked. The fourth covers marketing only, and leaving it unchecked does not affect the account.

The harder part was the sign-up routes that skip Cloudflare's form. Globally, people can join with Google, Apple or GitHub. Those handoffs happen on the other company's screen, which Cloudflare cannot change. Instead of building a separate consent step for one country, Cloudflare turned social sign-up off in South Korea. Every account there goes through its own form.

How the form knows who is in Korea

The Korean version appears based on the country a person picks at sign-up and on their internet address showing a location in South Korea. Cloudflare notes that address-based location is an estimate. A Korean resident who is traveling, or using a VPN, may not appear to be in Korea.

So the address only decides which form shows by default. The country the user selects overrides it. In Cloudflare's words, the address says where a request came from, but only the user can say where they live.

What the certification covers

ISMS is a detailed Korean standard. It is checked against how personal data actually moves through a company's systems, and against Korea's Personal Information Protection Act. Areas covered include:

• Security policy and access control
• Authentication and permission management
• Encryption
• Incident response and risk management
• Disaster recovery

Cloudflare already holds global certifications, including ISO/IEC 27001 and 27701. ISMS does not replace them. It adds Korean legal requirements on top, which changes what auditors look for. The certification is valid for three years, with an annual audit to keep it.

Why it matters

For Korean customers, the certification shows the security program was tested against Korean law and regulators, not just general standards. For any business selling abroad, the lesson is practical. Local privacy rules can reshape something as small as a sign-up form, and sometimes the simplest fix is removing a convenient option.