How is your database being protected?

CockroachDB Cloud encrypts data at rest and in transit on every plan. Cluster disks are encrypted at rest by your cloud provider, managed backups are encrypted, and every connection uses TLS 1.3. On the Advanced plan, Customer-Managed Encryption Keys (CMEK) add a layer protected by a key you control.

Customer-Managed Encryption Keys (CMEK) let you protect Mission Critical cluster data and managed backups with a key that stays in your own cloud account. CMEK supports AWS KMS, Google Cloud KMS and Azure Key Vault (Azure in Preview). Cockroach Labs never holds the key material. CMEK is not available on the Standard edition.

Yes. With CMEK, you can revoke access to your key at any time from your own cloud KMS, and the data stored at rest becomes unreadable.

On every CockroachDB Cloud plan, clusters running CockroachDB v26.2 or later use hybrid post-quantum key exchange by default for TLS 1.3 connections. This feature is currently in Preview.

CockroachDB Cloud stores API keys only as a SHA-256 hash, never in a form that can be read back. Keys are compared in constant time, so attackers can't learn anything from response times.

No, not by default. Cockroach Labs support engineers have no standing access to customer clusters. When access is needed, it lasts 2 to 12 hours, a person approves it with a written reason, and it's logged.

Yes. CockroachDB Cloud supports sign-in with GitHub, Google or Microsoft on every plan. With Cloud Organization SSO, you can connect your own identity provider, such as Okta or Microsoft Entra ID, over SAML or OIDC, require SSO, and limit sign-in to your email domains.

Yes. Organization admins can require multi-factor authentication for every password-based Cloud Console user. Users who sign in through SSO get MFA from your identity provider. MFA enforcement is currently in Preview and requires Cloud Organization SSO.

Yes. CockroachDB Cloud supports SCIM 2.0, so you can add and remove users and groups automatically from Okta or Microsoft Entra ID and assign roles to whole groups.

CockroachDB Cloud lets you assign roles to users, groups and service accounts at the organization, folder or cluster level. Roles are checked on the server for every request. For example, only a Cluster Admin can change a SQL user's password, and billing roles can't act on clusters.

Yes. CockroachDB supports policy-based row-level security, generally available since v25.2, so you can control which rows each role can read or change.

Yes. CockroachDB Cloud Advanced supports AWS PrivateLink, Google Cloud Private Service Connect and VPC peering, and Azure Private Link. Standard supports AWS PrivateLink and Google Cloud Private Service Connect. On AWS and Google Cloud, Advanced also offers private clusters whose nodes have no public IP addresses.

Yes. On every plan, you can allow connections only from the IP ranges you approve. On Advanced, you set this separately for SQL clients and the DB Console, and new clusters accept no connections until you authorize a network.

Yes. On Mission Critical, egress perimeter controls deny outbound traffic by default. Backups, changefeeds, exports and logs can then only reach destinations you approve.

Yes. SQL audit logging records access to the tables you choose. Cloud organization audit logs record events such as members added or clusters created, and you can retrieve them through the Cloud API. On Standard and Advanced, you can export logs to Amazon CloudWatch or Google Cloud Logging, with redaction.

 Cockroach Labs monitors its cloud environments and clusters around the clock, correlating cloud, Kubernetes and identity logs to flag unusual access. Alerts page a security engineer on call 24 hours a day, 365 days a year.

No. CockroachDB Cloud control-plane services get short-lived credentials through their cloud workload identity; AWS tokens, for example, expire after one hour. Production secrets live in a dedicated secrets manager, not in source code, and every repository is scanned for secrets.

Cockroach Labs holds SOC 2 Type II, SOC 3, and ISO 27001, 27017 and 27018 certifications. CockroachDB Cloud Advanced is certified by a Qualified Security Assessor as a PCI DSS 4.0 Level 1 Service Provider, and meets HIPAA requirements when configured with advanced security features. ISO 42001 certification is pending.

CockroachDB Cloud Advanced, with advanced security features turned on, meets HIPAA requirements on AWS, Google Cloud and Azure when configured appropriately, so you can store protected health information. On Azure, some required features, such as CMEK, are in Preview. Cockroach Labs can sign a Business Associate Agreement (BAA).

Yes. CockroachDB Cloud Advanced, with advanced security features, is certified by a Qualified Security Assessor as a PCI DSS 4.0 Level 1 Service Provider. PCI DSS workloads require the Advanced plan.

CockroachDB helps you meet GDPR requirements such as data residency and the right to be forgotten, using features such as Regional by Row and data domiciling. Its ability to survive node, zone and region failures helps you meet DORA's resilience requirements.

Yes. An independent third party tests CockroachDB Cloud every year. A summary of the latest test is available under NDA through your account team.

Cockroach Labs runs a public Responsible Disclosure Program for researchers. Security advisories are published in the CockroachDB documentation.

Cockroach Labs' MOLT migration tools help you check schema compatibility, move data and verify the results. Our team can walk you through what that would look like for your workloads.