Does a provider’s compliance certification cover our data and workloads?

Summary

• A compliance certification covers the specific services, regions, and time period defined in the audit's scope — so the answer depends on which services and regions you use and how you configure them.
• Under the shared responsibility model, Databricks maintains the platform's security controls and certifications, while you remain responsible for configuring and operating your environment to stay compliant.
• Databricks maintains a broad set of independently audited attestations and certifications (for example SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, HIPAA, PCI DSS, and FedRAMP); availability varies by cloud, region, and tier.
• To process regulated data under standards such as HIPAA, PCI DSS, and FedRAMP, you enable the compliance security profile, which adds hardened images, enhanced monitoring, and FIPS 140-2 validated encryption.
• The authoritative, current list of certifications and downloadable audit reports lives in the Databricks Security and Trust Center.

Does a provider’s compliance certification cover our data and workloads?

A certification is scoped: it covers a defined set of services, in defined regions, over a defined audit period. Whether it covers your data and workloads therefore depends on which services and regions you use, which security tier you enable, and how you configure and operate your environment. Databricks operates under a shared responsibility model: Databricks maintains the platform's security controls and its certifications, and you remain responsible for keeping your own configuration and data handling compliant. Compliance requirements are specific to each organization, so validate coverage against your own obligations and your auditors' guidance.

How the Databricks Platform supports your compliance needs

• Independently audited certifications and attestations. Databricks maintains a broad set of third-party-audited standards — for example SOC 2 Type II, SOC 1 Type II, SOC 3, ISO 27001, ISO 27017, ISO 27018, HIPAA, PCI DSS, and FedRAMP — with additional regional standards. The set that applies to you depends on cloud, region, and configuration.
• Certification scope determines coverage. An attestation covers the services and regions named in its audit scope. Confirm that the services and regions you run are within the scope of the specific report before relying on it, using the Security and Trust Center.
• Shared responsibility model. Databricks secures and certifies the platform; you configure your cloud environment, manage access, and keep the environment correctly configured over time. For regulated workloads you deploy compliant configurations and operate them according to the model. See security, compliance, and privacy.
• Compliance security profile for regulated data. To process data governed by standards such as HIPAA, PCI DSS, or FedRAMP, enable the compliance security profile. It adds CIS-hardened compute images, enhanced security monitoring, automatic security updates, and FIPS 140-2 validated encryption modules.
• Governance that supports audits. Unity Catalog provides centralized access control, data classification, lineage, and auditing across your estate, which helps you demonstrate and maintain compliant data handling.
• Access to reports. Audit reports, attestations, and the current certification list are available through the Databricks Security and Trust Center.

Getting started

• Review security, compliance, and privacy to understand the shared responsibility model.
• Visit the Databricks Security and Trust Center for the current certification list and downloadable audit reports, and confirm your services and regions are in scope.
• If you process regulated data, enable the compliance security profile and configure your workspace accordingly.
• Validate the result against your own regulatory obligations and your auditors' requirements.

FAQs

Does a certification automatically cover my data and workloads?

No. A certification covers the platform services and regions within its audit scope. Under the shared responsibility model, you are responsible for configuring and operating your environment so that your data and workloads remain compliant.

Which compliance standards does Databricks support?

Databricks maintains standards including SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, HIPAA, PCI DSS, and FedRAMP, plus additional regional standards. Availability varies by cloud, region, and tier; the current list is in the Security and Trust Center.

How do I get Databricks audit reports?

Compliance documentation, attestations, and audit reports are available through the Databricks Security and Trust Center.