- Cloudflare says Korean auditors spent ten days testing 80 controls and certified it under ISMS-P. The audit changed a sign-up page and removed social sign-up in Korea.
- Cloudflare says the certificate lists no products. A service is covered if it is delivered through the certified boundary, unlike SOC 2 or ISO 27001 scope lists.
- Buyers can confirm the certificate on KISA's public register, then ask vendors which service paths and audit periods sit inside the boundary.
When an audit changes the product, not the binder
Most compliance work ends in a document. Cloudflare says the most visible result of its South Korean certification was a changed sign-up page. In its account, the auditors looked at how the product behaves, not only at what the policy says.
Cloudflare says the audit lasted ten days and covered 80 controls. KISA, the Korea Internet & Security Agency, chose the auditors. The outcome is a Korean national certificate for managing information security (ISMS), granted under a framework called ISMS-P. This story rests on Cloudflare's own account of the audit.
What a Korean user sees
Elsewhere, one line above the sign-up button covers terms, privacy policy and cookie policy. Cloudflare says a user in South Korea sees four separate items instead. Each is marked required or optional. Each links to its full text.
Users must tick boxes for the service terms, for how personal data is collected and used, and for sending a limited set of that data overseas. A fourth, optional box covers sharing limited data with marketing third parties. Until the three required boxes are ticked, the button to create an account cannot be clicked.
Cloudflare says the audit also checked the exact wording of the consent. Auditors looked at how each notice is built and whether the items appear separately and clearly.
The hard part: sign-up routes that skip the form
Itemized consent is easy on a form a company controls. Cloudflare says the trouble was the routes that never show that form. Signing up with Google, Apple or GitHub sends the user to an outside identity provider. That provider's screen is not Cloudflare's to change. So there is no moment to show three required items.
Cloudflare weighed two options. It could build a separate consent step after login for one country. Or it could close the routes that bypass its own form. It chose the second. For Korean accounts, social sign-up is gone, and Cloudflare's form is the only way in.
This shows a cost that rarely appears on a compliance plan. Sometimes meeting a local rule means taking a convenience away from users.
Why location alone is not the trigger
Cloudflare reads a country code from the visitor's IP address. Customers see it as the CF-IPCountry header, or as request.cf.country in a Worker, which is code that runs on Cloudflare's network. The same signal is open to any customer.
Cloudflare notes that IP location is an estimate. Addresses change hands. A Korean resident abroad, on a VPN or behind a mobile carrier's shared address, may not look Korean. So the IP sets the default form, and the country the user picks overrides it. In Cloudflare's words, only the user can say "where they reside."
The lesson reaches beyond this case. A guess about location can start a process. It is weak proof of a legal duty.
The certificate covers a boundary, not a list
Cloudflare says the certificate lasts three years and needs an annual audit. KISA defines the scope as a service boundary with three parts. These are the Cloudflare entities and teams that run the service, the network and platform underneath, and the personal data flows inside it.
Cloudflare contrasts this with SOC 2 and ISO 27001. Those reports name the services they cover. The ISMS certificate lists no products.
Coverage depends on delivery instead. Cloudflare says a product is in scope when three things hold. It runs on the certified platform. The certified teams operate it. The same ISMS governs it.
That changes the question a vendor review should ask. Finding a product name on the certificate will not settle it. The reviewer must confirm how the product reaches customers.
Timing mattered too. Each ISMS audit looks at one year only. Cloudflare's preparation took longer than a year. It had to redo work for the next audit year: retranslating policies, gathering evidence again and republishing its privacy policy.
Limits of what we can verify
Cloudflare did not publish its data flow diagrams, citing confidentiality. Its post does not describe the audit findings. Cloudflare points to KISA's public register of certified organizations as the independent check to cite.
Questions to put to your team
First, check the vendor's entry on KISA's register before citing any certificate in a risk review. Second, for each vendor serving Korean users, ask which product paths run through the certified boundary. Get the answer in writing.
Third, ask when the latest annual audit took place. Fourth, review your own sign-up and login flows. Can outside identity providers let users skip a consent step you owe them? Finally, ask whether any compliance decision rests on IP location alone.
The certificate names no products. Its boundary decides what is covered.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Cloudflare.
