PingCAP | Trust Hub FAQs

The customers will always be the owners of the data that they entrust to us, and as a service provider, we use their data only in accordance with their documented instructions. We provide our customers with tools to control their data on their own terms and implement stringent security measures to safeguard their data.

Customer data belongs to our customers, and therefore, we strictly follow documented instructions from our customers, i.e. to fulfill our contractual obligation to deliver our services, and will not process the data in a way that is incompatible with the stated purposes. We follow the general principles of lawfulness, fairness and transparency, and will NEVER sell your data to any third parties. Customer data will be processed in a way that ensures its security, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage. We hold ourselves responsible for compliance with regulations including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and privacy best practices.

We work diligently to earn your trust. We’ve obtained industry-leading compliance audits and certifications for our Cloud services, including:

• SOC 1, SOC 2, and SOC 3
• ISO/IEC 27001 for information security management
• ISO/IEC 27701 for privacy information management
• PCI-DSS for payment card data security
• HIPAA as a Business Associate for handling healthcare data
• GDPR compliance for EU residents
• CCPA compliance for California residents

These certifications reflect our commitment to maintaining the highest security and privacy standards, and they prove that effective security practices are inherent in all of our activities, including product development and deployment, vulnerability management, incident management, and threat-handling processes. To learn more, navigate to our Compliance page.

At PingCAP, protecting customer trust is our highest priority. We enforce strict controls under our internal Data Classification and Access Policy, ensuring that support personnel only access the minimum data necessary to deliver assistance.

Customer data
No one on the PingCAP side has access to your customer data. All customer data remains under your exclusive control.

Diagnostic data
Diagnostic logs, metrics, and traces are collected through secure telemetry channels. Before this data is made available to support, we make best efforts to ensure that no customer data is exposed by automatically redacting sensitive fields. In certain cases, we may request additional diagnostic information to assist in troubleshooting, but this will never include direct access to customer data.

Cluster operations (Start, Pause, Modify, Scale, etc.)
When support or engineering assistance is needed to perform cluster-level operations, access will be authorized only after going through multiple approvals, and will be audited regularly. On top of that, personal data such as customer name will be completely masked. Data masking is the process of hiding or obscuring sensitive personal or confidential information in service tickets, such as names, email addresses, phone numbers, account numbers, or financial data. As such, our support staff will NOT be able to see any such personal data.

Support ticket handling
PingCAP provides 24×7 global support coverage through centers in the US, Japan, Singapore, Malaysia and the EU. Our support teams use the information you provide in the ticket, along with sanitized diagnostic data and masked data, to investigate and resolve issues while remaining fully compliant with applicable regulations. We mask data to prevent unauthorized access and reduce the risk of data leaks. This protects user privacy and helps us comply with data protection regulations such as GDPR, HIPAA, and CCPA.

PingCAP leverages Cloud Service Providers like Amazon Web Services (AWS), Google Cloud and Microsoft Azure to deliver our Cloud services. We offer global hosting options through these providers, allowing you to choose the region that best meets your data residency requirements. By default, backups are stored in the same region as your selected deployment location. We adhere to data sovereignty principles, ensuring that data is stored and processed within the legal jurisdiction of the relevant region.

PingCAP’s support personnel are strictly precluded from accessing any of your data stored in the TiDB database. Any access or utilization of any other data that you may provide requires explicit customer approval, and internal access at PingCAP is strictly governed—only permitted after rigorous approval workflows involving both the business and security teams.

PingCAP does not process payment information; rather, PingCAP relies on Stripe as our service provider (See here) to ensure the secure handling of payment card information. Nevertheless, we comply with the Payment Card Industry Data Security Standard (“PCI-DSS”) to demonstrate and ensure that our services adhere to the industry standards (see here).

Yes, please see here for a list of service providers that we use as our sub-processors. We periodically evaluate the privacy and security controls of all sub-processors that may access customer personal data.

TiDB Cloud includes features designed to support compliance with GDPR and other global data protection and privacy regulations. To help meet your GDPR contractual obligations, we offer a Data Processing Addendum (DPA). Additionally, PingCAP adheres to the Data Privacy Framework for processing personal data received from the European Union, United Kingdom, and Switzerland (see here).

We rely on current Standard Contractual Clauses (SCCs, see here) – including the controller-processor or processor-processor module (as applicable) with our customers and the processor-processor module with our sub-processors – and on our participation in the Data Privacy Framework for European data transfers to the US, as well as on robust supplementary measures (see here).

Yes, PingCAP is certified under the EU-US Data Privacy Framework (see here). To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/s/.

Depending on the region, all global customers are supported by staff located in the US, Japan, Singapore, Malaysia and the EU.

PingCAP is compliant with ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II, PCI-DSS and HIPAA. To learn more, navigate to our Compliance page.

SOC 2 (Service Organization Control 2) is a widely recognized standard for evaluating the security, availability, processing integrity, confidentiality, and privacy of systems. SOC 2 compliance demonstrates that TiDB has implemented strong controls to protect your data and ensure the reliability of our services. We undergo regular independent audits to verify our adherence to these standards.

As a HIPAA Business Associate, PingCAP is responsible for ensuring the security and privacy of Protected Health Information (“PHI”) . We comply with HIPAA requirements for Business Associates, including encryption, access controls, and security monitoring, to protect healthcare data in accordance with U.S. regulations. We also maintain Business Associate Agreements (“BAAs”) with our healthcare partners to ensure compliance.