The database estate keeps growing, and so does the work of running the databases underneath them. Most teams want to hand that work to a vendor. Many of them can't, because their data has to stay in their own cloud account. Until now, those two needs have been pulled in opposite directions: a fully managed service runs the database in the vendor's account, and self-hosting keeps it in yours but leaves the operations to you.
The tradeoff is getting harder to deal with in the modern operational landscape. As applications multiply, more teams want to offload database operations but the ones under data-residency, procurement, or cloud-commit constraints are exactly the teams who can't hand over the account. BYOC removes the choice.
With BYOC, CockroachDB runs inside your own cloud account, in your VPC, in the region you pick — and we operate it. Row data, query results, and unredacted logs never leave your account. We provision, patch, upgrade, back up, monitor, and carry the pager against the same uptime SLA we offer on our own infrastructure. Your cloud commitments and discounts still apply, because the compute is yours.
Today, CockroachDB BYOC is generally available on AWS, Azure, and Google Cloud. Financial-services and regulated teams ran production workloads on BYOC throughout preview, keeping data in accounts they control while meeting internal residency and procurement requirements.
What GA means for production
BYOC is CockroachDB Cloud, deployed into your account. Clusters carry the same uptime commitments as CockroachDB Advanced: 99.99% for single-region clusters and 99.999% for multi-region. It is the same commitment, delivered by the same control plane, the same automation, the same SRE rotations, and the same upgrade pipelines that run our fully managed fleet.
The division of labor is published in full in our shared responsibility model.
How it works
Reference architecture. Specific components may vary by cloud provider and are subject to change.
Everything that touches your data stays in your cloud account: the CockroachDB nodes, the Kubernetes layer they run on, storage, networking, and your backup buckets. The management software that provisions, patches, upgrades, backups, monitors, and heals those nodes runs in our account in the United States.
The two are connected by a scoped cross-account identity that you create and own: an IAM role on AWS, a service principal on Azure, a service account on GCP. There's no VPN, no tunnel, and no inbound path into your VPC. Our control plane talks to your cloud provider's APIs using credentials you granted, and you can revoke them at any time.
Your applications connect to a load balancer or PrivateLink endpoint inside your own account, so application traffic never passes through Cockroach Labs. The only things that leave are operational telemetry and redacted logs, which is what lets us patch, heal, back up, and support the cluster. Row data, query results, and unredacted logs stay put.
Our approach to BYOC security
Cockroach Labs engineers have no standing access to your account. Access is granted just-in-time, expires on its own, and requires a written justification. It goes through a named role, so every action lands in your own audit log and you can alert on it.
If you ever want us out, you can revoke the trust policy. From that point, our control plane can’t provision, patch, run backups or heal the cluster, and the availability commitment ends.The database itself remains unaffected and simply keeps serving traffic.
The same holds if our control plane is ever unavailable. SQL traffic, Raft consensus, replication, range healing, and already-scheduled backups are all independent of it. What pauses is the Console, the API, and Terraform.
BYOC's compliance posture is backed by ISO/IEC 27001:2022 certification (Surveillance 2 audit completed Oct 20, 2025, covering cloud controls under 27017 and PII controls under 27018), a SOC 2 Type I report and Type II Readiness Letter, with the Type II audit underway and report targeted for Dec 18, 2026, PCI DSS Level 1 Service Provider certification, and an annual third-party penetration test.
Getting started
BYOC is generally available today. To set up a cluster, reach out to your Cockroach Labs account team. We'll walk through the IAM setup in your account and provision the cluster from there.
If you'd rather read first, the BYOC documentation covers the architecture and data flow, details the security and compliance model, and can answer other questions you may have. We also recently updated documentation to better support customers through the full BYOC lifecycle.
You keep the data, the account, and the cloud commit. We keep the pager.
Happy building!
