Skip to main content
PlanetScale logo

PlanetScale

Security and trust center evidence

PlanetScale offers the world’s fastest and most scalable cloud hosting for Vitess, Neki, and

planetscale.comData platformsLast verified 2 Nov 2026
Request the report Are you PlanetScale?

Summary

HIPAA mark, CertReports state Vendor-stated as of 30 Sep 2026HIPAAVendor-statedSOC 2 mark, CertReports state Vendor-stated as of 30 Sep 2026SOC 2Vendor-statedGDPR mark, CertReports state Vendor-stated as of 30 Sep 2026GDPRVendor-statedPCI DSS mark, CertReports state Vendor-stated as of 30 Sep 2026PCI DSSVendor-statedSOC 1 mark, CertReports state Vendor-stated as of 30 Sep 2026SOC 1Vendor-statedEU-US Data Privacy Framework mark, CertReports state Verified as of 2 Nov 2026DPFVerifiedCCPA / CPRA mark, CertReports state Vendor-stated as of 30 Sep 2026CCPAVendor-stated

PlanetScale has 1 registry-verified row and 6 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is HIPAA: Vendor displays a HIPAA badge on its trust centre (claim; BAA availability not yet captured). This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

PlanetScale is listed in the EU-US Data Privacy Framework registry as active for the EU-US, Swiss-US and UK Extension certifications, issued 26 Oct 2023 and expiring 19 Nov 2026, as of 17 Sep 2026. PlanetScale states on its trust centre that it holds a SOC 2 Type II report and a SOC 1 Type II report, as of 18 Sep 2026. PlanetScale states on its trust centre that it maintains PCI-DSS 4.0, as of 18 Sep 2026. PlanetScale states on its trust centre that it complies with GDPR and CCPA, as of 18 Sep 2026. PlanetScale displays a HIPAA badge on its trust centre, though BAA availability is not documented in the evidence, as of 18 Sep 2026.

  • EU-US Data Privacy Framework: active (EU-US, SW-US, UK Extension), issued 26 Oct 2023, expires 19 Nov 2026 - as of 17 Sep 2026
  • Vendor states on its trust centre: SOC 2 Type II report, SOC 1 Type II report, PCI-DSS 4.0 - as of 18 Sep 2026
  • Vendor states on its trust centre: GDPR, CCPA and a HIPAA badge with BAA availability undocumented - as of 18 Sep 2026

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 20 Sep 2026; it is regenerated whenever a row changes.

Among data platforms vendors

1verified rows

Category median 0, across 69 indexed data platforms vendors. PlanetScale has more verified rows than 51 percent of them.

database hostingmanaged databasemysqlpostgres

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for FedRAMP, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Subprocessors (20)

  • Amazon Web Services logo
    Amazon Web ServicesData Hosting · United States
  • CL
    ClearFeedChat-based Customer Support · United States
  • CL
    ClickHouseData hosting and analytics · United States
  • DA
    DatadogApplication monitoring · United States
  • Fivetran logo
    FivetranData synchronization · United States
  • GitHub logo
    GitHubCode hosting · United States
  • Google Cloud logo
    Google CloudData Hosting, and Internal Infrastructure · United States
  • KO
    KoalaSales Pipeline Generation · United States
  • Okta logo
    OktaCentralized identity provider · United States
  • PA
    PantherSecurity Information & Events Management · United States
  • PL
    Pusher Ltd.Real-time Notification Service · United States & United Kingdom
  • Salesforce logo
    SalesforceCustomer Relationship Management · United States
  • Segment logo
    SegmentCustomer Analytics · United States
  • Sendgrid logo
    SendgridTransactional Mail Service · United States
  • Sentry logo
    SentryApplication monitoring · United States
  • Slack logo
    SlackInternal communications · United States
  • Stripe logo
    StripePayment processing · United States
  • Vercel logo
    VercelWeb hosting · United States
  • WO
    WorkOSSingle sign-on and directory sync · United States
  • Zendesk logo
    ZendeskCloud-based Customer Support · United States

Security profile

Pen test cadence
annual
Data residency
EU, US

Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.

Change history

  1. 18 Sep 2026Subprocessor added: PantherPanther appeared on the subprocessor list.
  2. 18 Sep 2026CCPA / CPRA evidence addedA CCPA / CPRA row entered the index with state Vendor-stated.
  3. 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
  4. 18 Sep 2026HIPAA evidence addedA HIPAA row entered the index with state Vendor-stated.
  5. 18 Sep 2026PCI DSS evidence addedA PCI DSS row entered the index with state Vendor-stated.
  6. 18 Sep 2026SOC 1 evidence addedA SOC 1 row entered the index with state Vendor-stated.
  7. 18 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.
  8. 18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
  9. 18 Sep 2026Subprocessor added: ClearFeedClearFeed appeared on the subprocessor list.
  10. 18 Sep 2026Subprocessor added: ClickHouseClickHouse appeared on the subprocessor list.

Evidence against regulations

All regulations for PlanetScale

How much of each regulation’s vendor requirements PlanetScale’s public evidence reaches.

Reviewing a vendor on public evidence

All articles