MariaDB Trust

Security

MariaDB utilizes an end-to-end security strategy that enables us to deliver a world-class service while protecting customer data. Below are some of the major controls we leverage to secure our cloud service infrastructure:

Access Control and Monitoring

MariaDB teams must go through an IDENT proxy and jump server requiring multi-factor authentication (MFA) in order to perform maintenance and support operations on behalf of customers.

MariaDB Enterprise Server is preconfigured for production environments, including default security parameters to remove remote root access and all anonymous access.

Infrastructure and Network Isolation

MariaDB SkySQL is hosted on service providers (Google Cloud Platform (GCP) and Amazon Web Services (AWS)), which operate data centers in accordance with security best practices. SkySQL offers options for single tenant or multi-tenant deployments based on service tier. SkySQL database access is restricted to allowlisted IP addresses with encrypted connections via firewall rules.

MariaDB Enterprise Server includes replication and clustering for high availability (HA), as well as the MariaDB MaxScale database proxy to enable automatic failover.

Secure Development Life Cycle (SDLC)

MariaDB employs a secure by design philosophy; building security into our products before any code is written. Strict security and quality gates are utilized in every step of our development life cycle – from design to coding, testing and deployment.

MariaDB Enterprise Server undergoes an extensive and comprehensive quality assurance process to ensure reliability for production deployments. In addition, critical features and bug fixes in future releases are backported to ensure long-term stability and support.

Customer Data Protection

MariaDB utilizes state-of-the-art encryption technology to protect customer data both at rest and in transit. Data at rest is encrypted on storage volumes using the Advanced Encryption Standard (AES) algorithm with 256-bit key length and all network traffic is encrypted using transport layer security (TLS).

MariaDB Enterprise Server’s storage engine encrypts data before writes and decrypts data during reads, ensuring that the data is unencrypted only when accessed directly through the server.

Reporting a Security Concern

For details on reporting a security concern, see our vulnerability reporting procedures.

Compliance

MariaDB is committed to safeguarding the privacy and security of our customers. This includes a robust compliance program that carefully considers data protection matters, including ISO 27001, GDPR and HIPAA requirements. MariaDB operates in accordance with the following compliance requirements:

ISO/IEC 27001:2013

MariaDB has established and maintains an Information Security Management System (ISMS) in accordance with the ISO/IEC 27001:2013 certification standards for SkySQL, MariaDB ID and Remote DBA systems.

ISO/IEC 27001:2013 is a globally recognized standard for the establishment and certification of an Information Security Management System (ISMS). The standard specifies the requirements for the implementation of a continuous security program with adequate and proportionate security controls.

MariaDB’s third party ISO Certification was performed by Coalfire and is available for download here.

SOC 2 Type II

The SOC 2 is a report based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) existing Trust Services Criteria (TSC). The purpose of this report is to evaluate an organization’s information systems relevant to security, availability and confidentiality.

MariaDB has achieved SOC 2 Type II which measures the effectiveness of policies and procedures as operated over a period of six months. Coalfire performs the MariaDB SOC 2 Type II audit on an annual basis.

HIPAA

MariaDB enables customers that are subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to use MariaDB SkySQL’s database-as-a-service (DBaaS) to process, maintain and store protected health information (PHI).

HIPAA provides federal data privacy and security safeguards for PHI. It applies to organizations that are HIPAA “covered entities,” including healthcare providers, health plans and healthcare clearinghouses.

The HIPAA requirements also extend to “business associates,” or businesses that work with the covered entities to create, receive, maintain or transmit PHI. Business associates are required to enter into a Business Associate Addendum (BAA) with covered entities to ensure that PHI is adequately protected. Under the HIPAA regulations, MariaDB and other database service providers are considered business associates.

To begin the process of entering into a BAA with MariaDB for MariaDB SkySQL, please speak to your sales representative or contact us at legal@mariadb.com.

Please note that each customer is responsible for independently evaluating its own use of MariaDB’s services as appropriate to support its legal and compliance obligations. There is no certification recognized by the U.S. Department of Health and Human Services for HIPAA compliance, and complying with HIPAA is a shared responsibility between the customer and MariaDB.

GDPR

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that regulates the use of personal data of EU residents and provides individuals rights to exercise control over their data. We are committed to our customers’ success, including supporting their GDPR compliance efforts. Additional information can be found in our Privacy Policy and GDPR FAQ.

Data Processing Addendum
We make it easy to sign and submit the MariaDB Data Processing Addendum (DPA). MariaDB offers a DPA as a means of meeting GDPR adequacy and security requirements. You can submit it by sending a signed copy to legal@mariadb.com.

Subprocessors
MariaDB owns and controls logical access, as applicable, to the infrastructure and services maintained by the entities set forth below, while such entities maintain the physical security of their respective servers, networks and data centers. You can opt in to receive an email notification upon changes to our subprocessors via the form below.

• AgileBits
• Amazon Web Services (AWS)
• Chargify
• Cloudflare
• CMDWatch Security Inc.
• Docusign
• Gong
• Google Cloud Platform (GCP)
• Google Workspace
• Highspot
• Kinsta
• Lacework
• LearnUpon
• LinkedIn
• Marketo
• Monday.com
• Netsuite
• On24
• Rackspace
• Salesforce (SFDC)
• Salesloft
• ServiceNow
• Slack
• Stripe
• Zoom Communications
• Zoominfo