Cloudflare reports South Korea ISMS certification and sign-up changes

Cloudflare says it has obtained South Korea’s Information Security Management System (ISMS) certification under the ISMS-P framework. In its announcement, the company reports roughly a year and a half of preparation and ten days of auditing across 80 controls by auditors appointed by the Korea Internet & Security Agency (KISA).

The announcement also describes changes already made to account creation in South Korea, including itemized consent and the removal of social sign-up.

Korean sign-up puts consent before account creation

According to Cloudflare, new accounts in South Korea must use its own sign-up form rather than Google, Apple or GitHub social sign-up. The form presents four consent items:

• Required: Terms of Service.
• Required: Collection and use of personal information.
• Required: Transfer of a limited amount of personal information overseas.
• Optional: Sharing a limited amount of personal information with marketing third parties.

The sign-up button remains disabled until all three required items are checked. Users can also select an “Agree to all” option. Cloudflare says leaving the optional item unchecked does not prevent account creation and opts the user out of marketing communications.

IP geolocation determines the default experience, but the country selected by the user overrides that signal. Cloudflare acknowledges that IP location is an estimate and may not reflect a user’s residence. Source: Cloudflare

For identity engineers, the useful distinction is between authenticating an identity and completing account creation. In the social sign-up flows Cloudflare describes, the identity provider returned an authenticated identity without displaying Cloudflare’s consent form. The company says it considered adding a separate post-authentication consent gate but instead removed the paths that bypassed its existing form. That is a trade-off between preserving onboarding choices and centralizing consent enforcement—not an inherent limitation of social authentication. Source: Cloudflare

Coverage depends on the certified service boundary

Cloudflare describes the certified scope through three components: the entities, teams and processes operating the service; its network and platform; and the information assets and personal-data flows within that boundary.

In the company’s account, a product is covered when it is delivered through that certified boundary: running on the certified platform, operated by the certified teams and governed by the same ISMS. Coverage is not expressed as a named product list. Cloudflare also says the certification is valid for three years, subject to annual audits. Source: Cloudflare

For procurement and platform teams, the practical next step is to request scope evidence showing how a specific deployment fits that boundary, rather than assume every Cloudflare offering is covered.

Nor should the announcement be treated as a Korea-only data-residency guarantee: the disclosed sign-up consent explicitly includes limited overseas transfers of personal information.