How does Lakewatch handle HIPAA, SOC2, and PCI-DSS compliance requirements for security logs?

Summary

• Built on a compliance-ready platform. Security logs live in the Databricks Data Intelligence Platform, which undergoes annual SOC 2 Type II audits, holds ISO 27001/27017/27018/27701, and is GDPR/CCPA ready.
• Frameworks like HIPAA and PCI-DSS. These are regulatory frameworks rather than certifications; Databricks provides audited controls and a Compliance Security Profile (part of the Enhanced Security and Compliance add-on) to help meet them, with availability that varies by cloud, region, and SKU.
• Encryption everywhere. Data is encrypted at rest with AES-256 and in transit with TLS 1.2+, with support for customer-managed keys.
• Governed access + immutable audit. Unity Catalog enforces fine-grained (catalog/schema/table/row/column and attribute-based) access, dynamic masking, lineage, and immutable audit logs via system tables.
• Preview status. Lakewatch, the agentic SIEM built on this platform, is in Private Preview; confirm your specific compliance scope with Databricks for your cloud and configuration.

How does Lakewatch handle HIPAA, SOC 2, and PCI-DSS compliance requirements for security logs?

Lakewatch is the agentic SIEM built on the Databricks Data Intelligence Platform and governed by Unity Catalog. Because security logs are stored and governed on that platform, they inherit its compliance certifications and security controls. HIPAA and PCI-DSS are regulatory frameworks rather than certifications; Databricks builds audited control frameworks and a Compliance Security Profile to help customers meet them, with availability that varies by cloud, region, and SKU. Lakewatch is currently in Private Preview, so confirm your specific compliance scope with Databricks.

Why Databricks Lakewatch helps meet security-log compliance requirements

• Platform certifications. The Databricks Data Intelligence Platform undergoes annual SOC 2 Type II audits and holds ISO 27001, 27017, 27018, and 27701; it is GDPR- and CCPA-ready.
• Compliance Security Profile for regulated workloads. For HIPAA, PCI-DSS, and FedRAMP requirements, the Compliance Security Profile adds a hardened compute image with CIS Level 1 benchmarks, FIPS 140-validated encryption modules, enhanced security monitoring, automatic cluster updates, and TLS 1.2+ for inter-cluster and egress traffic. Availability varies by cloud, region, and SKU.
• Encryption and key control. Security logs are encrypted at rest with AES-256 and in transit with TLS 1.2+, and organizations can bring customer-managed keys.
• Fine-grained access control. Unity Catalog governs access at the catalog, schema, table, row, column, and attribute level (ABAC), with dynamic masking so sensitive fields are shown only to authorized roles — supporting HIPAA PHI protection, SOC 2 access controls, and PCI-DSS data-security requirements.
• Immutable audit and lineage. User-level audit logs and system tables (system.access.*) record every query and data access, and end-to-end lineage tracks data from source to consumption — supporting audit and monitoring obligations.
• Long-term retention in open formats. Full-fidelity logs can be retained affordably in Delta Lake or Apache Iceberg for the retention periods that compliance regimes require.

Getting started

1. Store security logs in the security lakehouse governed by Unity Catalog, with encryption and (optionally) customer-managed keys.
2. Enable the Compliance Security Profile (part of the Enhanced Security and Compliance add-on) where your regime requires it, confirming availability for your cloud and region.
3. Apply fine-grained access controls, masking, and retention policies to sensitive log fields.
4. Review the Databricks Security and Trust Center and confirm your specific compliance scope with Databricks. Lakewatch is in Private Preview.

FAQs

Is Lakewatch itself certified for HIPAA or PCI-DSS?

HIPAA and PCI-DSS are regulatory frameworks, not certifications. Databricks provides audited controls and a Compliance Security Profile to help meet them; because Lakewatch is in Private Preview, confirm specific scope for your cloud and configuration with Databricks.

What certifications does the underlying platform hold?

The Databricks Data Intelligence Platform undergoes annual SOC 2 Type II audits and holds ISO 27001/27017/27018/27701, and is GDPR/CCPA ready.

How are security logs protected and audited?

Logs are encrypted at rest (AES-256) and in transit (TLS 1.2+), governed by Unity Catalog fine-grained access and masking, and tracked with immutable audit logs and lineage.