PCI DSS 4.0

PCI DSS provides a baseline of technical and operational requirements designed to protect payment card data. PCI DSS is a set of 12 overall information security standards, each with multiple sub-requirements, for keeping card data secure.

The PCI DSS framework guides businesses with robust processes for securing cardholder transaction data and card authentication information. It is intended to protect both cardholder data and authentication data with requirements that help prevent, detect, and react to security incidents.

Payment Card Industry ("PCI") compliance means obeying a set of security policies for cardholder data. All organizations that process transactions with credit, debit, and/or prepaid cards are subject to PCI compliance requirements. Although PCI compliance is not required by US federal law, the credit card companies can impose non-compliance fees to businesses that fail to properly secure cardholder data.

For more information visit Cloudflare's Learning Center.

Yes, Cloudflare maintains PCI DSS Level 1 compliance for its network, platform and infrastructure services with a defined subset of products included within the scope of the assessment. Cloudflare has been compliant since 2014 and is audited annually by a third-party Qualified Security Assessor ("QSA").

Application Security: API Shield, Page Shield, SSL/TLS, Turnstile, WAF, Advanced Certificate Manager, Bot Management, DDoS Protection

Application Performance: Content Delivery Network (Cache/CDN), DNS, Load Balancing

Analytics and Insights: Cloudflare Logs

Zero Trust Services: Access, Browser Isolation, CASB, Cloudflare Tunnel, DLP, Gateway, Cloudflare One Client, Cloudflare Email Security, Cloudflare One (excluding DEM, Cloudflare One Multi-cloud Networking)

Network Services: Cloudflare WAN, Magic Transit, Cloudflare Network Firewall, Time Services

Developer Platform: Durable Objects, Hyperdrive, Pages, Workers, Workers KV, R2, Secrets Store

Privacy and Compliance: Data Localization Suite

Other: Cloudflare Dashboard, Notifications

Super Administrators can access common compliance documentation through the Cloudflare dashboard. Your account executive or a member of the sales team can help you get a copy. Cloudflare requires a nondisclosure agreement ("NDA") to view the AoC.

• Attestation of Compliance for Report on Compliance - Service Providers.
• PCI Responsibility Matrix.

Attestation date can be found in Section 3 of the AoC.

Cloudflare continuously introduces new features/functions across our platform throughout the year. We introduce those to our PCI scope depending on the annual audit cycle.

For detailed instructions, visit Cloudflare's guide.

• Cloudflare has been compliant since 2014 and is audited annually by a third-party Qualified Security Assessor ("QSA").
• PCI is important to Cloudflare because it serves as an independent report that customers can use to gain trust that we securely handle their and their customer's Card Holder Data ("CHD").
• PCI DSS is a global standard.

Customers are responsible for obtaining PCI DSS certification to represent their own services; however, customers can use Cloudflare's AoC for in-scope services to help meet their PCI DSS requirements. Learn more about how Cloudflare can help address PCI requirements.

Visit Cloudflare's Trust Hub to learn about additional compliance resources.

Learn more about how Cloudflare's connectivity cloud capabilities help enterprises streamline and map to compliance requirements across multiple standards by visiting our data compliance and protection page.