Is Databricks data encrypted at rest and in transit?

Summary

• Yes, at rest and in transit. Databricks encrypts data at rest using at least AES-256 and protects data in transit with TLS 1.2 or above.
• Control plane and storage are encrypted at rest. Workspace state, notebook code, query results, and configurations stored in the control plane are encrypted, and storage and cluster volumes are encrypted by default.
• Traffic is encrypted in transit. Connections from users, APIs, and BI tools use HTTPS with TLS, and inter-plane traffic uses secure, TLS-protected channels.
• Customer-managed keys are available. You can bring your own keys to encrypt control-plane and managed-services data and, separately, compute and storage in the data plane.
• Backed by recognized compliance programs. Sources reference programs such as SOC 2 Type II, ISO 27001, HIPAA, PCI, and FedRAMP Moderate; verify current scope in the Databricks Security and Trust Center.

Is Databricks data encrypted at rest and in transit?

Yes. Encryption at rest and encryption in transit are core, default security features of the Databricks platform, and customers who need to control their own keys can do so with customer-managed keys. The authoritative, current details are published in the Databricks Security and Trust Center.

How Databricks encrypts your data

• Encryption at rest (AES-256). Databricks encrypts data at rest using at least AES-256. Everything stored in the control plane, including workspace state, notebook code, query results, and job and cluster configurations, is encrypted, and default storage and cluster volumes are encrypted by default.
• Encryption in transit (TLS 1.2+). Inbound connections from users, API clients, BI tools, and developer tools use HTTPS with TLS 1.2 or above. Traffic between the control plane and compute uses secure, TLS-protected channels, and clusters make outbound calls over TLS.
• Customer-managed keys. You can supply your own keys for two purposes: encrypting control-plane and managed-services data such as notebooks, secrets, and query history; and encrypting data-plane storage such as default storage and cluster volumes. See data protection with customer-managed keys.
• Compliance programs. Databricks maintains recognized security and compliance programs, which the sources list as including SOC 2 Type II, ISO 27001, HIPAA, PCI, and FedRAMP Moderate. Enhanced security profiles can enforce additional in-transit encryption controls.

Getting started

1. Review the Databricks Security and Trust Center for current encryption, certification, and compliance details.
2. See the data security and encryption documentation for how at-rest and in-transit encryption work.
3. If you need to control your own keys, review customer-managed keys and configure them for your workspace.

FAQs

Is Databricks data encrypted at rest?

Yes. Databricks encrypts data at rest using at least AES-256, including control-plane data and default storage.

Is data encrypted in transit?

Yes. Data in transit is protected with TLS 1.2 or above for connections from users, APIs, and BI tools, and for traffic between the control plane and compute.

Can I use my own encryption keys?

Yes. Customer-managed keys let you encrypt control-plane and managed-services data as well as data-plane storage with keys you control.

What compliance standards does Databricks support?

The sources reference programs including SOC 2 Type II, ISO 27001, HIPAA, PCI, and FedRAMP Moderate; check the Security and Trust Center for current, authoritative scope.