How is our data protected from unauthorized access?

Summary

• Databricks governs all data access through Unity Catalog, a central authorization engine with hierarchical role-based access control (RBAC) and attribute-based access control (ABAC) that enforce least-privilege access consistently across notebooks, SQL, jobs, BI tools, and AI.
• Row filters and column masks shield sensitive rows and values at query time, so they cannot be bypassed with a SELECT *.
• Data is encrypted in transit and at rest (operational data with AES-256), and Enterprise-tier customers can add customer-managed keys and encryption of traffic between cluster worker nodes.
• Access stays limited to trusted users and networks through account-level SSO with multi-factor authentication, SCIM de-provisioning, front-end PrivateLink, IP access lists, and egress controls.
• Every access is captured in centralized audit logs, tenant data stays isolated in your own cloud account, and the platform is independently certified against standards including SOC 2 Type II, ISO 27001, HIPAA, PCI-DSS, HITRUST, and FedRAMP High.

How is data protected from unauthorized access on Databricks?

Keeping data safe from unauthorized access takes layered controls: only the right people and services should reach data, every request should be authenticated and authorized, sensitive values should stay hidden even from users who can query a table, and every action should be logged. The Databricks Data + AI Platform applies this defense-in-depth model across the entire data and AI lifecycle. Unity Catalog governs who can access what, encryption protects data at rest and in transit, identity and network controls keep access limited to trusted users and locations, and audit logs record every access — one consistent governance model for analytics, AI, and applications.

Why the Databricks Data + AI Platform protects your data

• Centralized access control and RBAC in Unity Catalog. Unity Catalog is the single authorization engine for the platform. It uses hierarchical role-based access control: privileges granted on a catalog flow down to its schemas, tables, and volumes, and administrators use GRANT and REVOKE to enforce least-privilege access. Because permissions are enforced at the SQL engine level, the same rules apply no matter how data is queried — notebooks, SQL, jobs, BI tools, or Genie.
• Attribute-based access control (ABAC). ABAC governs access using governed tags rather than object-by-object grants — for example, restricting any table tagged as containing personal data to authorized groups. Policies attach at the catalog, schema, or table level and inherit automatically, so protection scales without per-table configuration. ABAC is generally available in Unity Catalog. See how to scale data governance with ABAC.
• Row-level security and column masking. row filters and column masks provide fine-grained control inside a table: row filters limit which rows a user sees based on their identity, and column masks transform sensitive values (such as masking most digits of an account number) before they are returned. Both are evaluated at query time, so they cannot be bypassed with a SELECT *, and they apply consistently across SQL, notebooks, jobs, and connected BI tools. See the row-level security overview.
• Encryption at rest and in transit. Databricks encrypts data in transit and at rest, with operational data encrypted using AES-256. Enterprise-tier customers can add customer-managed keys for managed services and workspace storage, plus encryption of traffic between cluster worker nodes, keeping control of the keys that protect your data.
• Strong identity: SSO, MFA, and SCIM. Access is authenticated through account-level single sign-on with multi-factor authentication from your identity provider. SCIM and automatic identity management provision and automatically de-provision users, so access is revoked when someone leaves. OAuth token authentication uses short-lived tokens for both user-to-machine and machine-to-machine access to limit credential exposure.
• Network isolation and private connectivity. Network controls keep access limited to trusted networks: front-end PrivateLink restricts workspace access to private networks, IP access lists allow connections only from approved locations, and egress controls plus private connectivity prevent data from leaving through untrusted paths.
• Comprehensive audit logging. Every access is recorded. Unity Catalog captures centralized audit logs of who queried what and which policies applied, and credential and storage access appears in your cloud provider's audit logs, giving you a complete record for monitoring and compliance.
• Tenant isolation validated by testing. Databricks keeps most customer data in your own cloud account. Requests pass through an authenticating proxy that verifies a user's association with the target workspace, and compute receives only time-limited, scoped-down tokens for the specific data a user is entitled to. External penetration testing has validated that users cannot access other tenants' data or grant themselves access beyond what Unity Catalog permits.
• Certified and compliant. The platform is independently audited against standards including SOC 2 Type II; ISO 27001, 27017, 27018, and 27701; HIPAA; PCI-DSS; HITRUST; and FedRAMP High. See the Databricks Security and Trust Center for the current list.

Getting started

• Set up account-level SSO with MFA and use SCIM to automate user provisioning and de-provisioning — see the security best-practices guide.
• Model your access in Unity Catalog with least-privilege grants, and use ABAC tags to enforce policies at scale.
• Protect sensitive rows and columns with row filters and column masks.
• Configure customer-managed keys and network controls such as PrivateLink for your workspaces.
• Review the Databricks Security and Trust Center to benchmark your configuration and access compliance documentation.

FAQs

Who controls who can access data in Databricks?

Unity Catalog is the central authorization engine. Administrators grant least-privilege access with role-based and attribute-based access control, and permissions are enforced at the SQL engine level so the same rules apply across notebooks, SQL, jobs, BI tools, and Genie.

Can I hide specific rows or columns from some users?

Yes. Row filters restrict which rows a user can see, and column masks transform sensitive values before they are returned. Both are evaluated at query time, so they cannot be bypassed, and they apply across SQL, notebooks, jobs, and BI tools.

Is data encrypted, and can I manage my own keys?

Data is encrypted in transit and at rest, with operational data encrypted using AES-256. Enterprise-tier customers can add customer-managed keys for managed services and workspace storage, plus encryption of traffic between cluster worker nodes.

How does Databricks keep access limited to trusted users and networks?

Access requires account-level SSO with multi-factor authentication, and SCIM automatically de-provisions departed users. Front-end PrivateLink, IP access lists, and egress controls restrict access to trusted networks and help prevent data from leaving through untrusted paths.

How is data access audited?

Unity Catalog records centralized audit logs of who queried what and which policies applied, and credential and storage access is captured in your cloud provider's audit logs — giving you a complete record for monitoring and compliance.