Auditors do not certify a platform. They certify the environment you build on it, so the
honest question is not “is Cozystack compliant” but “which controls does Cozystack give me,
and which ones remain mine”.
These pages answer that question one framework at a time. Each of them separates what the
platform enforces by default, what it can enforce once you turn it on, and what no
infrastructure product can do for you.
Cozystack is open source, so every claim on these pages points at code, documentation or a
command you can run against your own cluster.
Frameworks
- PCI DSS — a requirement-by-requirement mapping of what
Cozystack enforces by default, what is opt-in, and what stays with you, with commands to
verify each control on your own cluster.
- GDPR — the Article 32 technical measures the platform supplies,
where personal data physically sits, and the awkward parts of erasure nobody should gloss
over.
- CIS Benchmark — a full kube-bench run against Cozystack
on Talos Linux, with every failure sorted into real deviations, controls met another way,
and checks that do not apply.
- DORA — resilience, backup and restore, incident evidence, and the
ICT third-party risk chapter where an open platform on your own hardware changes the
answer.