Databricks✓

Stav’s assessment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

• security

  Documented, multi-framework security program (ISO 27001/27017/27018, SOC 2 Type II, PCI-DSS, HIPAA BAA support) aligned to NIST 800-53, plus a formal vulnerability response and disclosure program following RFC 9116 / ISO 29147 / ISO 30111.

• compliance

  Published, downloadable Data Processing Addendum incorporating the 2021 EU Standard Contractual Clauses, plus a dedicated transfer-impact-assessment FAQ addressing Schrems II/EDPB recommendations, UK and Swiss data transfers.

• transparency

  Publishes model cards, a technical blog post, and an Acceptable Use Policy for its DBRX foundation models, documenting training data scale, architecture, and known risks.

• stability

  Continued, growing EU investment: Amsterdam is described as Databricks' largest R&D centre in EMEA, and the company is establishing a new, larger London EMEA headquarters.

Published safeguards & certifications