Security / trust page — Cloudflare Zero Trust

Cited by

Facts read from this source

• ISO 27001 Report an error

  “ISO 27001:2022 Implementation of an Information Security Management System (ISMS) and security risk management processes certification.”

• ISO 27701 Report an error

  “ISO 27701:2019 Implementation of a comprehensive Privacy Information Management system (PIMS) certification.”

• ISO 27018 Report an error

  “ISO 27018:2019 Extension of an ISMS to protect personal data when being processed in the cloud; privacy certification.”

• ISO 27017 Report an error

  “ISO 27017 provides specialized guidelines for information security controls applicable to the provision and use of cloud services.”

• Fedramp high Report an error

  “FedRAMP High Federal Risk and Authorization Management Program.”

• Govramp Report an error

  “GovRAMP Government Risk and Authorization Management Program.”

• SOC 2 Report an error

  “SOC 2 Type II Certification to attest to Security, Confidentiality, and Availability controls in place in accordance to the AICPA Trust Service Criteria.”

• Pci dss Report an error

  “PCI DSS 4.0 Payment Card Industry Data Security Standard Attestation of Compliance.”

• Global cbpr Report an error

  “Global CBPR The Global Cross-Border Privacy Rules (Global CBPR) system.”

• Global prp Report an error

  “Global PRP The Global Privacy Recognition for Processors (Global PRP) system.”

• EU cloud code of conduct Report an error

  “The EU Cloud Code of Conduct is an officially approved GDPR Article 40 Code of Conduct.”

• Cyber essentials Report an error

  “Cyber Essentials Cloudflare’s certificate can be found here.”

• C5 Report an error

  “C5:2020 Cloud Computing Compliance Criteria Catalogue (C5:2020) is an auditing standard created by Germany's Federal Office for Information Security (BSI).”

• Ens Report an error

  “ENS Spain National Security framework - Esquema Nacional de Seguridad.”

• Irap Report an error

  “IRAP Information Security Registered Assessors Program, Cloudflare for Government-Australia.”

• Ismap Report an error

  “ISMAP Information System Security Management and Assessment Program, Cloudflare for Government-Japan.”

• HIPAA Report an error

  “HIPAA The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for protecting sensitive patient data. Contact your account team to request the HIPAA AoC.”

• BSI ddos Report an error

  “Cloudflare has been recognized by the German government's Federal Office for Information Security as a qualified provider of DDoS mitigation services.”

• Processunity grex Report an error

  “Cloudflare has completed the Global Risk Exchange assessment. Customers can request to access the risk assessment here.”

• Csa star Report an error

  “CSA STAR Cloud Security Alliance’s Security, Trust, Assurance, and Risk Program validates and assesses Cloudflare’s security and compliance as a Cloud Service Provider.”

• Dns privacy examination Report an error

  “Cloudflare conducted a first-of-its-kind privacy examination by a Big Four accounting firm to determine whether the 1.1.1.1 resolver was effectively configured to meet Cloudflare’s privacy commitments.”

• Wcag Report an error

  “Cloudflare's dashboard completes Voluntary Product Accessibility Template (VPAT) in compliance with international standards set forth by the Web Content Accessibility Guidelines (WCAG) 2.1 AA and in conformance with legal standards set forth by Section 508 of the Rehabilitation Act. Contact your account team to request the VPAT.”

• Korea ISMS Report an error

  “Cloudflare holds South Korea's Information Security Management System (ISMS) certification, issued under the ISMS-P scheme administered by the Korea Internet & Security Agency (KISA).”

• Data protection regulations Report an error

  “Japan's Act on the Protection of Personal Information (APPI) Australia's Privacy Act Brazil’s General Data Protection Law (LGPD) India's Digital Personal Data Protection Bill (DPDP) General Data Protection Regulations (GDPR) Singapore's Personal Protection Act (PDPA) South Korea's Personal Information Protection Act (PIPA) United States Privacy Laws”

• Financial services regulations Report an error

  “EU Digital Operational Resilience Act (DORA) UK Operational Resilience Australian Prudential Regulation Authority”

• Critical infrastructure regulations Report an error

  “EU Network and Information Security Directive 2.0 (NIS 2)”

• Encryption by default Report an error

  “Cloudflare encrypts data by default using the latest protocols, and offers granular control over where encryption keys are stored and where logs are sent.”

• Data localization Report an error

  “In many regions — including the EU — Cloudflare lets organizations control which regional data centers their traffic is inspected in and where logs are sent.”

• Dashboard access Report an error

  “Access Cloudflare’s compliance documentation through the dashboard.”

• Entity Report an error

  “© 2026 Cloudflare, Inc.”

Scores citing this record

• The DevOps Engineer Architecture, reliability & security assurance
• The DevOps Engineer European sovereignty
• The IT Lead Architecture, reliability & security assurance
• The IT Lead European sovereignty
• The MSP Technician Architecture, reliability & security assurance
• The MSP Technician European sovereignty
• The Operations Manager Architecture, reliability & security assurance
• The Operations Manager European sovereignty
• The Information Security Officer Architecture, reliability & security assurance
• The Information Security Officer European sovereignty
• The Skeptic Architecture, reliability & security assurance
• The Skeptic European sovereignty