Cockroach Labs

Cockroach Labs is certified ISO 27001, 27017, and 27018 compliant, with ISO 42001 (Responsible, Ethical, and Safe AI Governance) certification pending.Reviewed 2026-10-16View source

### SOC 2 Type II & SOC 3Reviewed 2026-10-16View source

### ISO 27001, 27017, 27018, and 42001Reviewed 2026-10-16View source

## ISO 27001 and ISO 27017Reviewed 2026-10-16View source

Before relying on it
Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.

| | | | ✓ | Cluster DB console authentication with third-party Single Sign On (SSO) using OpenID Connect OIDC or SAML |Reviewed 2026-10-16View source

| | ✓ | ✓ | ✓ | ✓ | Web console authentication with third-party Single Sign-on (SSO) using OpenID Connect OIDC |Reviewed 2026-10-16View source

Before relying on it
Test SSO enforcement, user removal and privileged-account recovery.

| | ✓ | ✓ | ✓ | SQL Role-based access control (RBAC) |Reviewed 2026-10-16View source

| | ✓ | ✓ | ✓ | ✓ | Role-based access control (RBAC) |Reviewed 2026-10-16View source

Before relying on it
Test least-privilege roles and cross-tenant access with separate test accounts.

On GCP, it is recorded in Cloud Audit Logs for the project.Reviewed 2026-10-16View source

Before relying on it
Verify administrative and data-access events, retention and export.

CockroachDB supports GDPR compliance requirements including Data Residency, Right to Access, Right to Be Forgotten, and Privacy by Design with distributed SQL transactions and features such as Regional by Row, Referential Integrity, and global SELECT-DELETE.Reviewed 2026-10-16View source

Since June 4, 2021, Cockroach Labs’ DPA relies on Standard Contractual Clauses to address Privacy Shield invalidation on July 16, 2020.Reviewed 2026-10-16View source

Any defined terms which are not defined in this DPA are as defined in the Agreement.Reviewed 2026-10-16View source

Before relying on it
Review DPA, subprocessors, retention, deletion, residency and AI training use.

See Disaster Recovery.Reviewed 2026-10-16View source

Security Incident Response ManagementReviewed 2026-10-16View source

Before relying on it
Request SLA, incident history, recovery targets and support escalation terms.

In Cockroach Labs' Performance Under Adversity benchmarking (as of September 2025), CockroachDB was 5x more resilient than Oracle GDD, measured by minutes of outage under adverse conditions.Reviewed 2026-10-16View source

Cockroach Labs has worked with CIS to build CockroachDB Benchmarks as a blueprint for customers to deploy hardened CockroachDB configurations.Reviewed 2026-10-16View source

Before relying on it
Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.