Compliance on Kubernetes: PCI DSS, GDPR, DORA, CIS

Auditors do not certify a platform. They certify the environment you build on it, so the honest question is not “is Cozystack compliant” but “which controls does Cozystack give me, and which ones remain mine”.

These pages answer that question one framework at a time. Each of them separates what the platform enforces by default, what it can enforce once you turn it on, and what no infrastructure product can do for you.

Cozystack is open source, so every claim on these pages points at code, documentation or a command you can run against your own cluster.

Frameworks

• PCI DSS — a requirement-by-requirement mapping of what Cozystack enforces by default, what is opt-in, and what stays with you, with commands to verify each control on your own cluster.
• GDPR — the Article 32 technical measures the platform supplies, where personal data physically sits, and the awkward parts of erasure nobody should gloss over.
• CIS Benchmark — a full kube-bench run against Cozystack on Talos Linux, with every failure sorted into real deviations, controls met another way, and checks that do not apply.
• DORA — resilience, backup and restore, incident evidence, and the ICT third-party risk chapter where an open platform on your own hardware changes the answer.
• Kubernetes Conformance — CNCF conformance results for both shapes the platform is used in: a self-hosted cluster passing 446 of 446, and a hosted platform listed in the CNCF record for three releases.