Captured before automated identity checks (Oct 14, 2026): accurate as of its capture on Sep 11, 2026; our capture on Oct 21, 2026 found the same text, but its identity was not checked by them.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“all material findings must be addressed before a test can be marked as passed.”
“we also provide a contractual commitment to security written in plain language to all our customers. This commitment is captured in the Security Addendum of our customer agreement...”
“We perform daily authenticated vulnerability scans of Databricks and third-party/open-source packages used by Databricks, along with static and dynamic code analysis (SAST and DAST)...”
“we take this responsibility seriously and share our remediation timeline commitments in our Security Addendum.”
“which describes the security measures and practices that we follow to keep your data safe.”
“using trusted security scanning tools, before we promote new code or images to production.”
This document explains the security measures Databricks has committed to following to protect customer data, and those commitments are written into the customer contract — not just an informal policy. Databricks runs daily vulnerability scans, requires security checks before new code goes live, and fixes its most critical vulnerabilities before other work. Customers can review an independent third-party penetration test report through Databricks's publicly available due diligence package.
This document establishes Databricks's contractual and operational security commitments to customers, formalized through a Security Addendum that is part of the customer agreement. It defines a Vulnerability Management Program with tiered severity handling, including highest-urgency prioritization of Severity-0 vulnerabilities above other rollouts, daily authenticated vulnerability scans of first-party and third-party/open-source packages, SAST and DAST code analysis, and mandatory security scanning before code or images are promoted to production. Penetration tests are scoped to major releases, new services, and security-sensitive features, and no such test may be marked as passed while material findings remain unresolved. Databricks maintains strict access controls on internal employee access to production systems, customer environments, and customer data, and holds ISO 27001, ISO 27017, ISO 27018, and SOC 2 Type II certifications, with compliance offerings for PCI-DSS, HIPAA, and FedRAMP.
As a Databricks customer, your data is covered by enforceable security commitments documented in the Security Addendum of your customer agreement, not merely by internal policy. Databricks applies strict controls limiting which employees can access production systems, customer environments, and customer data, and remediates material vulnerabilities before closing any penetration test as passed. You can access Databricks's platform-wide third-party penetration test report and remediation timeline commitments directly through the publicly available due diligence package, without a separate request.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“all material findings must be addressed before a test can be marked as passed.”
“we also provide a contractual commitment to security written in plain language to all our customers. This commitment is captured in the Security Addendum of our customer agreement...”
“We perform daily authenticated vulnerability scans of Databricks and third-party/open-source packages used by Databricks, along with static and dynamic code analysis (SAST and DAST)...”
“we take this responsibility seriously and share our remediation timeline commitments in our Security Addendum.”
“which describes the security measures and practices that we follow to keep your data safe.”
“using trusted security scanning tools, before we promote new code or images to production.”
“Our Vulnerability Management Program is committed to treating Severity-0 vulnerabilities, such as zero days, with the highest urgency, prioritizing their fix above other rollouts.”
“We apply strict policies and controls to internal employee access to our production systems, customer environments and customer data.”
“We have automatic security scanning and automated vulnerability tracking of systems, libraries and code.”
“We have offerings for PCI-DSS, HIPAA and FedRAMP compliance, and we are ISO 27001, ISO 27017, ISO 27018 and SOC 2 Type II compliant.”
“We conduct penetration tests on major releases, new services and security-sensitive features.”
“we publicly share our platform-wide third-party test report in our due diligence package.”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
We have not recorded a change to this document since we began capturing it. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle All Material Penetration Test Findings Must Be Addressed and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.