Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that Databricks holds SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018 certifications and offers compliance configurations for PCI-DSS, HIPAA, and FedRAMP-regulated workloads.
This analysis describes what Databricks's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision distinguishes between certifications Databricks holds as an organization and compliance frameworks for which it offers specific product configurations, a distinction that is operationally significant because HIPAA and PCI-DSS compliance for customer workloads depends on the specific service tier, configuration, and whether applicable agreements have been executed.
Interpretive note: The document does not specify which Databricks service tiers, deployment regions, or account configurations are covered by each compliance offering, creating ambiguity about the scope of applicable certifications for any given customer deployment.
The document establishes that SOC 2 Type II and ISO certifications apply to Databricks as an organization, while PCI-DSS, HIPAA, and FedRAMP compliance are described as offerings, meaning customers must confirm that their specific workload configuration and executed agreements activate the applicable compliance controls.
Cross-platform context
See how other platforms handle Compliance Certifications Disclosure and similar clauses.
Compare across platforms →Monitoring
Databricks has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We have offerings for PCI-DSS, HIPAA and FedRAMP compliance, and we are ISO 27001, ISO 27017, ISO 27018 and SOC 2 Type II compliant.Excerpt from Databricks's Security Practices
(1) REGULATORY LANDSCAPE: The disclosed certifications and compliance offerings engage multiple regulatory frameworks: HIPAA and the HIPAA Security Rule (HHS OCR enforcement), PCI-DSS (PCI Security Standards Council), FedRAMP (GSA and agency-specific authorization), ISO 27001 and 27017 (cloud security controls), and ISO 27018 (cloud privacy for personally identifiable information). Each framework has distinct activation requirements for customers. (2) GOVERNANCE EXPOSURE: Medium. The distinction between organizational certifications and compliance offerings is material. Customers assuming that general Databricks usage is automatically HIPAA or PCI-DSS compliant may be operating without the required controls if they have not activated the applicable compliance configuration and executed required agreements such as a BAA for HIPAA. (3) JURISDICTION FLAGS: FedRAMP authorization is specific to authorized cloud service offerings and agency agreements; customers must confirm the applicable FedRAMP authorization level (Moderate or High) and that their specific Databricks service tier is covered. EU and UK customers should note that ISO 27017 and 27018 certifications are relevant to cloud-specific security and privacy controls for personal data in cloud services. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams onboarding Databricks for regulated workloads should confirm: (a) that the applicable compliance tier has been enabled for their account; (b) that a Business Associate Agreement has been executed for HIPAA workloads; (c) the specific FedRAMP authorization boundary and which Databricks services are in scope. The document does not specify which service tiers or deployment regions carry each certification. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should obtain current certification documentation including SOC 2 Type II reports and ISO certificates as part of annual vendor review, and confirm the certification coverage period and any scope limitations noted in those reports.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision distinguishes between certifications Databricks holds as an organization and compliance frameworks for which it offers specific product configurations, a distinction that is operationally significant because HIPAA and PCI-DSS compliance for customer workloads depends on the specific service tier, configuration, and whether applicable agreements have been executed.
The document establishes that SOC 2 Type II and ISO certifications apply to Databricks as an organization, while PCI-DSS, HIPAA, and FedRAMP compliance are described as offerings, meaning customers must confirm that their specific workload configuration and executed agreements activate the applicable compliance controls.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Databricks.