The document states that Databricks conducts 8-10 external and 15-20 internal penetration tests annually, requires all material findings to be resolved before a test is passed, and makes the platform-wide third-party test report available in a due diligence package.
This analysis describes what Databricks's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a specific, measurable penetration testing cadence with a mandatory remediation gate for material findings, and discloses that the third-party test report is available to customers through the due diligence package, providing a basis for customer-initiated security review.
This provision establishes that customers can request the platform-wide third-party penetration test report through Databricks' due diligence package, providing access to independent security testing results that may inform vendor risk assessments.
Cross-platform context
See how other platforms handle Penetration Testing and Material Findings Requirement and similar clauses.
Compare across platforms →"We perform penetration testing through a combination of our in-house offensive security team, qualified third-party penetration testers and a year-round public bug bounty program. We conduct penetration tests on major releases, new services and security-sensitive features. We typically perform 8-10 external third-party penetration tests and 15-20 internal penetration tests per year, and all material findings must be addressed before a test can be marked as passed. As part of our commitment to transparency, we publicly share our platform-wide third-party test report in our due diligence package.Excerpt from Databricks's Security Practices
(1) REGULATORY LANDSCAPE: Penetration testing and independent security assessment requirements are addressed under SOC 2 Type II audit criteria, PCI-DSS Requirement 11, FedRAMP continuous monitoring requirements, and ISO 27001 controls.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a specific, measurable penetration testing cadence with a mandatory remediation gate for material findings, and discloses that the third-party test report is available to customers through the due diligence package, providing a basis for customer-initiated security review.
This provision establishes that customers can request the platform-wide third-party penetration test report through Databricks' due diligence package, providing access to independent security testing results that may inform vendor risk assessments.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Databricks.