Databricks✓

United States0 models on Stav

Databricks is a private US company, so it is subject to the CLOUD Act and FISA 702 whatever region the data sits in. Its enterprise governance is mature: it offers a DPA with SCCs, participates in the EU-US Data Privacy Framework, publishes a security addendum, holds SOC 2 and ISO certifications, and runs a public bug bounty. The main model-level risks are a US class action over the training data of its MPT/DBRX models, which survived a motion to dismiss in April 2026, and the restrictive custom DBRX licence. I found no evidence that it has signed the EU GPAI Code of Practice.