What is SOC 2 certification?

Summary

• What it is. SOC 2 is an independent attestation — performed under the AICPA's SSAE 18 standard — of how an organization's security controls align with the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. It is often referred to as a "certification."
• Type I vs. Type II. A Type I report tests only the design of controls at a single point in time; a Type II report tests both the design and the operating effectiveness of those controls over a period of time.
• Why it matters. A SOC 2 Type II report gives customers independent assurance that security controls are in place and working, and it is commonly required by enterprise customers during due diligence.
• Databricks holds it. Databricks maintains SOC 2 Type II across AWS, Azure, and GCP, alongside additional certifications; the current, authoritative status is published in the Security and Trust Center.
• Where to verify. See the Databricks Security and Trust Center.

What is SOC 2 certification?

SOC 2 is an independent attestation of an organization's security controls, performed under the AICPA's SSAE 18 standard (Statement on Standards for Attestation Engagements No. 18). Although it is commonly called a "certification," SOC 2 is technically an attestation report: an independent auditor evaluates how a service organization's controls align with the AICPA's Trust Services Criteria, which cover security, availability, processing integrity, confidentiality, and privacy.
There are two types of SOC 2 report:

• Type I tests only the suitability of the design of controls at a single point in time. It is a foundational, point-in-time assessment.
• Type II is more comprehensive: the auditor tests both the design of the controls and their operating effectiveness over a defined period, verifying that controls were in place and functioning throughout the audit window.

Because a Type II report demonstrates that controls actually operated effectively over time, it is commonly required by enterprise customers during vendor due diligence.

How Databricks addresses SOC 2

• Databricks maintains SOC 2 Type II. Coverage spans AWS, Azure, and GCP, and Databricks holds additional certifications and attestations alongside SOC 2. The current, authoritative list of certifications and compliance status by cloud and region is published in the Security and Trust Center.
• Self-service due diligence. The Security and Trust Center provides a due-diligence package — including ISO certifications and penetration-test confirmation letters — that customers can access directly.
• The full report. The SOC 2 Type II report, along with the enterprise security guide and other compliance materials, is available on request through your Databricks account team (typically under an NDA).
• Controls you inherit and configure. Beyond attestations, the platform provides governance and security controls — including Unity Catalog access controls, audit logging, and data lineage — that help customers operate their own workloads in line with frameworks such as SOC 2.

Getting started

• Visit the Databricks Security and Trust Center for the current list of certifications and compliance status by cloud and region.
• Review Databricks compliance information and download the due-diligence package.
• Request the SOC 2 Type II report and enterprise security guide through your Databricks account team.

FAQs

Is SOC 2 a certification or an attestation?

SOC 2 is technically an attestation report, produced by an independent auditor under the AICPA's SSAE 18 standard, though it is commonly referred to as a certification.

What is the difference between SOC 2 Type I and Type II?

A Type I report evaluates whether controls are suitably designed at a single point in time; a Type II report also evaluates whether those controls operated effectively over a period of time.

Does Databricks have SOC 2 Type II?

Yes. Databricks maintains SOC 2 Type II across AWS, Azure, and GCP, with the current, authoritative status published in the Security and Trust Center.

How do I get Databricks' SOC 2 report?

The SOC 2 Type II report is available on request through your Databricks account team, typically under an NDA; ISO certifications and other due-diligence materials can be downloaded from the Security and Trust Center.