Cloudflare compliance, certifications and attestations

An auditor's report on security, availability, confidentiality, processing integrity and privacy controls.

Type IIVendor page

A certified information security management system.

HeldVendor page

Cloud-specific security controls on top of ISO 27001.

HeldVendor page

Protection of personal data in public clouds acting as processors.

HeldVendor page

A certified privacy information management system extending ISO 27001.

HeldVendor page

Authorization to sell a cloud service to US federal agencies.

HighFedRAMP MarketplaceCloudflare for Government - High

A security verification for US state and local government cloud buyers.

ModerateGovRAMP product list and vendor pageCloudflare for Government (Authorized, Moderate)

Accessibility conformance reports (VPAT) for US federal buyers.

HeldVendor page

Validated compliance with the card industry data security standard.

HeldVendor page

Readiness for the EU Digital Operational Resilience Act for financial entities.

HeldVendor page

The vendor supports HIPAA-regulated health data and signs a Business Associate Agreement.

HeldVendor page

Self-certification under the EU-US Data Privacy Framework, with UK and Swiss extensions where noted.

HeldData Privacy Framework ListEU-US, UK extension, Swiss-US; non-HR data and HR data. Cloudflare, Inc.

Certification under the Cross-Border Privacy Rules or Privacy Recognition for Processors.

HeldVendor page

Adherence to the GDPR code of conduct for cloud processors.

HeldCSA STAR Registry and vendor pagePartner entry in the STAR Registry

A listing in the Cloud Security Alliance STAR Registry.

Level 1CSA STAR RegistryCAIQ

The UK government-backed baseline security certification.

BasicVendor page

An attestation against Germany's Cloud Computing Compliance Criteria Catalogue.

HeldVendor page

Certification under Spain's Esquema Nacional de Seguridad.

HeldVendor page

An assessment by an ASD-endorsed assessor for Australian government data.

HeldVendor page

Registration on Japan's government cloud security list.

HeldVendor page