The document states that Databricks holds SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018 certifications and offers compliance configurations for PCI-DSS, HIPAA, and FedRAMP-regulated workloads.
This analysis describes what Databricks's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision distinguishes between certifications Databricks holds as an organization and compliance frameworks for which it offers specific product configurations, a distinction that is operationally significant because HIPAA and PCI-DSS compliance for customer workloads depends on the specific service tier, configuration, and whether applicable agreements have been executed.
Interpretive note: The document does not specify which Databricks service tiers, deployment regions, or account configurations are covered by each compliance offering, creating ambiguity about the scope of applicable certifications for any given customer deployment.
The document establishes that SOC 2 Type II and ISO certifications apply to Databricks as an organization, while PCI-DSS, HIPAA, and FedRAMP compliance are described as offerings, meaning customers must confirm that their specific workload configuration and executed agreements activate the applicable compliance controls.
Cross-platform context
See how other platforms handle Compliance Certifications Disclosure and similar clauses.
Compare across platforms →"We have offerings for PCI-DSS, HIPAA and FedRAMP compliance, and we are ISO 27001, ISO 27017, ISO 27018 and SOC 2 Type II compliant.Excerpt from Databricks's Security Practices
(1) REGULATORY LANDSCAPE: The disclosed certifications and compliance offerings engage multiple regulatory frameworks: HIPAA and the HIPAA Security Rule (HHS OCR enforcement), PCI-DSS (PCI Security Standards Council), FedRAMP (GSA and agency-specific authorization), ISO 27001 and …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision distinguishes between certifications Databricks holds as an organization and compliance frameworks for which it offers specific product configurations, a distinction that is operationally significant because HIPAA and PCI-DSS compliance for customer workloads depends on the specific service tier, configuration, and whether applicable agreements have been executed.
The document establishes that SOC 2 Type II and ISO certifications apply to Databricks as an organization, while PCI-DSS, HIPAA, and FedRAMP compliance are described as offerings, meaning customers must confirm that their specific workload configuration and executed agreements activate the applicable compliance controls.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Databricks.