How many subprocessors does CockroachDB use?

CockroachDB lists 7 subprocessors on its published list, including AWS (Amazon Web Services, Inc.), Azure (Microsoft, Inc.), GCP (Google, Inc.), Stripe, Inc., and Cockroach Labs Canada, Inc. and 2 more.

Where does CockroachDB process customer data?

The subprocessors named by CockroachDB are located in Canada, India, and UK, as stated on its list.

How quickly does CockroachDB report a personal data breach to customers?

According to its DPA, CockroachDB reports a personal data breach to customers without undue delay, with no set deadline: “Cockroach Labs will notify Company of any Security Breach without undue delay”

How much notice does CockroachDB give before adding a subprocessor?

CockroachDB's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “will add the names of new and replacement sub-processors to the list thirty (30) days prior to them starting sub-processing of Personal Data”

How does CockroachDB transfer personal data outside the EU?

CockroachDB's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “the parties agree that the EU SCCs will apply in respect of that processing and are incorporated into this DPA”

When was CockroachDB's subprocessor list last checked?

ClauseTrail last checked CockroachDB's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when CockroachDB adds or removes a subprocessor?

ClauseTrail monitors CockroachDB's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

CockroachDB Subprocessors List (September 2026): Changes and History

CockroachDB names 7 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

CockroachDB subprocessors (September 2026)

#	Subprocessor	Purpose	Location	Data
1	AWS (Amazon Web Services, Inc.)	Operating the services.	—	Customer data, if customer elects AWS as cloud provider
2	Azure (Microsoft, Inc.)	Operating the services.	—	Customer data, if customer elects Azure as cloud provider
3	GCP (Google, Inc.)	Operating the services	—	Customer data, if customer elects GCP as cloud provider
4	Stripe, Inc.	To process customer payments	—	Credit card processing information
5	Cockroach Labs Canada, Inc.	—	Canada	—
6	Cockroach Labs Technologies India Private Limited	—	India	—
7	Cockroach Labs UK Limited	—	UK	—

Get an email when CockroachDB changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track CockroachDB free

Key DPA terms at CockroachDB

What CockroachDB's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“Cockroach Labs will notify Company of any Security Breach without undue delay”
DPA, www.cockroachlabs.com ↗
Notice of a new subprocessor: 30 days ahead

“will add the names of new and replacement sub-processors to the list thirty (30) days prior to them starting sub-processing of Personal Data”
DPA, www.cockroachlabs.com ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions

“the parties agree that the EU SCCs will apply in respect of that processing and are incorporated into this DPA”

“Cockroach Labs self-certifies to EU-US Data Privacy Framework, the UK extension to the Data Privacy Framework”

“"Adequate Country" means a country or territory recognised as providing an adequate level of protection for Personal Data under an adequacy decision”
DPA, www.cockroachlabs.com ↗
Customer data after the contract ends: Deleted within 30 days of the contract ending

“Cockroach Labs will delete the Personal Data as soon as reasonably practicable and no later than thirty (30) days following such termination”
DPA, www.cockroachlabs.com ↗
Audit rights: Through certifications and audit reports only

“Company agrees to thoroughly review and provide due consideration to such third-party certifications, audits or reports (such as ISO 27001, SSAE 16 II, SOC1, or SOC2) as Cockroach Labs may provide in order to demonstrate its compliance with its obligations under this DPA before making any request for additional information or inspection hereunder”
DPA, www.cockroachlabs.com ↗

Documents we track for CockroachDB

DPA: checked September 28, 2026 www.cockroachlabs.com ↗
Privacy policy: checked September 28, 2026 www.cockroachlabs.com ↗
Subprocessor list: checked September 28, 2026 www.cockroachlabs.com ↗
Trust page: checked September 28, 2026 www.cockroachlabs.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

CockroachDB subprocessors FAQ

How many subprocessors does CockroachDB use?: CockroachDB lists 7 subprocessors on its published list, including AWS (Amazon Web Services, Inc.), Azure (Microsoft, Inc.), GCP (Google, Inc.), Stripe, Inc., and Cockroach Labs Canada, Inc. and 2 more.
Where does CockroachDB process customer data?: The subprocessors named by CockroachDB are located in Canada, India, and UK, as stated on its list.
How quickly does CockroachDB report a personal data breach to customers?: According to its DPA, CockroachDB reports a personal data breach to customers without undue delay, with no set deadline: “Cockroach Labs will notify Company of any Security Breach without undue delay”
How much notice does CockroachDB give before adding a subprocessor?: CockroachDB's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “will add the names of new and replacement sub-processors to the list thirty (30) days prior to them starting sub-processing of Personal Data”
How does CockroachDB transfer personal data outside the EU?: CockroachDB's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “the parties agree that the EU SCCs will apply in respect of that processing and are incorporated into this DPA”
When was CockroachDB's subprocessor list last checked?: ClauseTrail last checked CockroachDB's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when CockroachDB adds or removes a subprocessor?: ClauseTrail monitors CockroachDB's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.