Cloudflare gains South Korea ISMS certification after localizing consent flows and disabling social sign-up in Korea

Cloudflare says it obtained South Korea’s ISMS certification under the ISMS-P framework after a KISA-appointed audit reviewed 80 controls over 10 days. The work included Korean-specific sign-up consent with three required items and one optional marketing item, plus removing Google, Apple, and GitHub sign-up in South Korea because those flows bypass Cloudflare’s own consent form.

For builders serving Korea, the reported social-login change shows that localized consent can affect product architecture, not just legal copy. Cloudflare chose to remove bypassing sign-up paths rather than build a country-specific post-authentication gate; the trade-off is simpler compliance enforcement but less sign-up convenience, and the article notes IP geolocation alone is limited because travelers, VPNs, and carrier NATs may obscure residency.