We also listed a provision named “Penetration Testing and Material Findings Requirement” from our summary of this document. None of its quoted text appears in any capture we hold, so it was withheld. A link to that entry now leads here. This page is a separate clause record, CA-P-074373, whose quotation is checked against a stored capture of the document.
This analysis describes what Databricks's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a specific, measurable penetration testing cadence with a mandatory remediation gate for material findings, and discloses that the third-party test report is available to customers through the due diligence package, providing a basis for customer-initiated security review.
Cross-platform context
See how other platforms handle Penetration Testing and Material Findings Requirement and similar clauses.
Compare across platforms →"We perform penetration testing through a combination of our in-house offensive security team, qualified third-party penetration testers and a year-round public bug bounty program. … We conduct penetration tests on major releases, new services and security-sensitive features. … We typically perform 8-10 external third-party penetration tests and 15-20 internal penetration tests per year, and all material findings must be addressed before a test can be marked as passed. As part of our commitment to transparency, we publicly share our platform-wide third-party test report in our due diligence package.Excerpt from Databricks's Security Practices
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision establishes a specific, measurable penetration testing cadence with a mandatory remediation gate for material findings, and discloses that the third-party test report is available to customers through the due diligence package, providing a basis for customer-initiated security review.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Databricks.