Where is customer data stored, processed, and backed up?

Summary

• Databricks uses a two-plane architecture: a Databricks-managed control plane for workspace administration, orchestration, and governance, and a compute plane where your data is actually processed. Classic compute runs in your own cloud account; serverless compute runs in the Databricks account, isolated per customer.
• Your lakehouse data is stored in your own cloud object storage (Amazon S3, Azure Data Lake Storage, or Google Cloud Storage) in the region you choose; compute reads and writes to it directly, and data does not pass through the control plane during processing.
• During normal operations the control plane, compute, and storage stay within a single cloud provider region. See Databricks Geos for data-residency details.
• Data is encrypted at rest with AES-256 (with optional customer-managed keys) and in transit with TLS 1.2 or higher; ephemeral cluster disks are destroyed when compute terminates and are never shared between customers.
• For durability, cloud object storage is regional with redundancy across availability zones and workspace metadata is replicated across zones; you manage your own data backups (for example, storage replication and lifecycle policies), and Databricks Managed Disaster Recovery can replicate across regions.

Where is customer data stored, processed, and backed up?

Databricks uses a two-plane architecture that keeps your data inside your own cloud trust boundary while Databricks operates the platform. The control plane is the Databricks-managed backend for workspace administration, cluster orchestration, job scheduling, and governance. The compute plane is where your data is processed. Knowing where each type of data lives, and how it is encrypted, isolated, and made durable, is the key to answering where customer data is stored, processed, and backed up.

Why Databricks keeps your data in your control

• Two planes, clear separation. The control plane stores workspace objects such as notebooks, code, job configurations, logs, and metadata, all encrypted at rest. The compute plane processes your data: classic compute runs in your own cloud account, while serverless compute runs in the Databricks account and remains isolated per customer. Data does not pass through the control plane during processing.
• Your data stays in your object storage. Lakehouse data, including raw data and curated and managed tables, is stored in your own cloud object storage (Amazon S3, Azure Data Lake Storage, or Google Cloud Storage), and workspace clusters read and write to it directly. Follow the storage architecture recommendations to design where data lands.
• Regional data residency. During normal operations, the control plane, compute plane, and storage are located within a single cloud provider region. See Databricks Geos for how data residency is managed when processing customer content.
• Encryption at rest and in transit. Data is encrypted at rest using AES-256. Enterprise-tier customers can add customer-managed keys for control-plane data and workspace storage, so you hold the keys that protect your data. Traffic between the control plane and compute plane is encrypted with TLS 1.2 or higher. See security and compliance.
• Ephemeral, isolated compute. Cluster disks and cache are ephemeral: they are destroyed when compute terminates, are not reused across clusters, and are never shared between customers. Each serverless VM generates an in-memory AES-256 encryption key at launch and destroys it on reboot, so data written with that key becomes unrecoverable.
• Durability, high availability, and backups. Cloud object storage is regional with data redundancy across availability zones, and workspace metadata is stored in databases replicated across zones. The control plane is resilient to a zone failure and recovers automatically, typically within about 15 minutes. You own your core data and manage its backup and retention (for example, storage replication and lifecycle policies), and Databricks Managed Disaster Recovery can continuously replicate data and configuration to a secondary region.
• Governed access across the platform. Unity Catalog governs who can access stored data with fine-grained access control, lineage, and centralized audit logs, so the same rules apply however the data is queried.

Getting started

• Read the platform architecture overview to see how the control plane and compute plane divide storage and processing.
• Review security and compliance and encryption keys to configure encryption and customer-managed keys.
• Use Databricks Geos to confirm data residency for your region, and the disaster recovery guide to plan backups and cross-region resilience.

FAQs

Where is my data processed?

In the compute plane. Classic compute runs in your own cloud account, and serverless compute runs in the Databricks account isolated per customer; in both cases data is read and written directly and does not pass through the control plane.

Where is my data stored?

Your lakehouse data is stored in your own cloud object storage (Amazon S3, Azure Data Lake Storage, or Google Cloud Storage) in the region you select. The control plane separately stores workspace objects such as notebooks, metadata, and logs, encrypted at rest.

Is my data encrypted?

Yes. Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher, and Enterprise-tier customers can add customer-managed keys for control-plane data and workspace storage.

How is my data backed up?

Cloud object storage is regional with redundancy across availability zones, and workspace metadata is replicated across zones. You own your data and manage its backups with methods such as storage replication and lifecycle policies, and Databricks Managed Disaster Recovery can replicate to a secondary region.