# Cockroach Labs

Distributed SQL database foundation

Research: https://www.safecli.org/company/cockroachlabs.com
Company: https://cockroachlabs.com

## Evidence status

Procurement review needed
Source review: 2026-10-16T03:30:08.037Z
API: Unknown

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Mixed claims — review

> Cockroach Labs is certified ISO 27001, 27017, and 27018 compliant, with ISO 42001 (Responsible, Ethical, and Safe AI Governance) certification pending.

Source: https://www.cockroachlabs.com/trust-center/
Reviewed: 2026-10-16T03:30:08.037Z

> ### SOC 2 Type II & SOC 3

Source: https://www.cockroachlabs.com/trust-center/
Reviewed: 2026-10-16T03:30:08.037Z

> ### ISO 27001, 27017, 27018, and 42001

Source: https://www.cockroachlabs.com/trust-center/
Reviewed: 2026-10-16T03:30:08.037Z

> ## ISO 27001 and ISO 27017

Source: https://docs.cockroachlabs.com/docs/cockroachcloud/compliance
Reviewed: 2026-10-16T03:30:08.037Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Company-published

> | | | | ✓ | Cluster DB console authentication with third-party Single Sign On (SSO) using OpenID Connect OIDC or SAML |

Source: https://www.cockroachlabs.com/docs/cockroachcloud/security-overview
Reviewed: 2026-10-16T03:30:08.037Z

> | | ✓ | ✓ | ✓ | ✓ | Web console authentication with third-party Single Sign-on (SSO) using OpenID Connect OIDC |

Source: https://www.cockroachlabs.com/docs/v26.3/security-reference/security-overview
Reviewed: 2026-10-16T03:30:08.037Z

- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Company-published

> | | ✓ | ✓ | ✓ | SQL Role-based access control (RBAC) |

Source: https://www.cockroachlabs.com/docs/cockroachcloud/security-overview
Reviewed: 2026-10-16T03:30:08.037Z

> | | ✓ | ✓ | ✓ | ✓ | Role-based access control (RBAC) |

Source: https://www.cockroachlabs.com/docs/v26.3/security-reference/security-overview
Reviewed: 2026-10-16T03:30:08.037Z

- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Company-published

> On GCP, it is recorded in Cloud Audit Logs for the project.

Source: https://docs.cockroachlabs.com/docs/cockroachcloud/byoc-security
Reviewed: 2026-10-16T03:30:08.037Z

- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Mixed claims — review

> CockroachDB supports GDPR compliance requirements including Data Residency, Right to Access, Right to Be Forgotten, and Privacy by Design with distributed SQL transactions and features such as Regional by Row, Referential Integrity, and global SELECT-DELETE.

Source: https://www.cockroachlabs.com/trust-center/
Reviewed: 2026-10-16T03:30:08.037Z

> Since June 4, 2021, Cockroach Labs’ DPA relies on Standard Contractual Clauses to address Privacy Shield invalidation on July 16, 2020.

Source: https://www.cockroachlabs.com/trust-center/
Reviewed: 2026-10-16T03:30:08.037Z

> Any defined terms which are not defined in this DPA are as defined in the Agreement.

Source: https://www.cockroachlabs.com/cloud-terms-and-conditions/data-processing-addendum/
Reviewed: 2026-10-16T03:30:08.037Z

- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> See Disaster Recovery.

Source: https://www.cockroachlabs.com/docs/cockroachcloud/security-overview
Reviewed: 2026-10-16T03:30:08.037Z

> Security Incident Response Management

Source: https://www.cockroachlabs.com/security/
Reviewed: 2026-10-16T03:30:08.037Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Company-published

> In Cockroach Labs' Performance Under Adversity benchmarking (as of September 2025), CockroachDB was 5x more resilient than Oracle GDD, measured by minutes of outage under adverse conditions.

Source: https://cockroachlabs.com/
Reviewed: 2026-10-16T03:30:08.037Z

> Cockroach Labs has worked with CIS to build CockroachDB Benchmarks as a blueprint for customers to deploy hardened CockroachDB configurations.

Source: https://www.cockroachlabs.com/trust-center/
Reviewed: 2026-10-16T03:30:08.037Z

- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: