CockroachDB Cloud BYOC FAQ

This feature is in and subject to change. To share feedback and/or issues, contact Support. This page answers frequently asked questions about deployments of CockroachDB Cloud. For more detail, refer to the pages linked in each answer.

​

Architecture and data

​

What runs in my cloud account, and what runs at Cockroach Labs?

The CockroachDB nodes, their storage, the managed Kubernetes layer, the load balancers, the networking, and the backup bucket all run in your account. Cockroach Labs runs the control plane, which provisions, patches, backs up, and monitors the cluster. Refer to .

​

Does my application traffic go through Cockroach Labs?

No. Your application connects to a load balancer or private endpoint inside your own account and reaches the nodes directly.

​

What data leaves my cloud account?

Infrastructure and cluster metrics, health signals, operational job telemetry, and CockroachDB logs that are redacted before they leave.

​

Does Cockroach Labs see my data?

Not through telemetry, metrics, or the redacted log stream. Query text can reach Cockroach Labs in two circumstances, both of which you control:

• When a runs a statement in the in the CockroachDB Cloud Console, which the control plane proxies.
• When you authorize a support engineer to conduct a live investigation, which requires just-in-time elevation, is time-bounded, and is recorded in your own cloud provider audit log.

Database, table, and column names are also visible in the Console.

​

Where do my logs go?

Two places. Redacted logs go to Cockroach Labs, in the United States, and are used to operate and support your cluster. Unredacted logs go only to a sink in your own cloud account, and only if you configure log export.

​

Where is the control plane hosted?

In the United States.

​

Is my data encrypted at rest, and can I use my own keys?

Yes to both. Cluster storage is encrypted at the infrastructure level using your cloud provider’s disk encryption, independently of any configuration you apply. You can additionally enable customer-managed encryption keys (CMEK), supported with AWS KMS, Google Cloud KMS, and Azure Key Vault, covering both cluster-level encryption and managed backups. Key material stays in your own account. Refer to .

​

Is data encrypted in transit between my account and Cockroach Labs?

Yes. Node-to-node traffic uses TLS 1.3, and client connections use TLS 1.2 or TLS 1.3.

​

Security and access

​

Is there a VPN or agent connecting Cockroach Labs to my network?

Yes, there is a Tailscale router pod deployed in your Kubernetes cluster. This router is used as a jumpbox by our Cockroach Labs for debugging purposes, gated by per-session access controls.

​

Can I view every action Cockroach Labs takes in my account?

Yes, in your own cloud provider audit log: CloudTrail on AWS, the Activity Log on Azure, and Cloud Audit Logs on Google Cloud Platform.

​

Do Cockroach Labs engineers have standing access to my account?

No. Access is just-in-time, requires a recorded justification, expires, and is authenticated through the Cockroach Labs identity provider with multi-factor authentication.

​

How quickly is a departing Cockroach Labs engineer’s access removed?

There is no persistent grant to remove. The engineer’s identity provider account is deactivated within one business day of termination, and they held no standing entitlement to your account before that.

​

Can I revoke Cockroach Labs access?

Yes, immediately and unilaterally. Cluster management, patching, backups, and the availability commitment stop. SQL traffic continues.

​

Can I reduce the permissions, or apply conditional or time-based policies?

No. The published set is the minimum required across the cluster lifecycle. Reducing it typically fails weeks later, during a patch, node replacement, or backup, rather than at the moment of the change.

​

Can I use different permissions for production and non-production?

Not within a single policy. To separate production and non-production environments by identity and blast radius, deploy them into separate cloud accounts, each with its own cross-account identity. Because multiple BYOC clusters can share one cloud account, this separation is a deployment choice that you must make deliberately.

​

Compliance

​

What is the compliance status of BYOC specifically?

A SOC 2 Type I report and a SOC 2 Type II readiness letter are available under a non-disclosure agreement (NDA). The SOC 2 Type II audit begins in September 2026, with report delivery targeted for December 18, 2026. BYOC is also covered by ISO/IEC 27001:2022 certification, PCI DSS Level 1 Service Provider validation, and an annual third-party penetration test.

​

How do I obtain the reports?

Through your Cockroach Labs account team, under an NDA.

​

Does BYOC meet EEA data residency requirements?

Row-level data stays in your own account, in the region you select, and Cockroach Labs does not process it. Cockroach Labs processes redacted operational telemetry and log data, which contain no personal or payment data, in the United States.

​

Availability

​

What happens if the Cockroach Labs control plane goes down?

Your database keeps serving traffic. replication, healing, and already-scheduled continue, and a failed node is still replaced automatically. The Console, , and Terraform provider become unavailable, as do operations that change the cluster’s shape. The control plane recovery time objective is 4 hours.

​

What voids the availability commitment?

Removing or restricting the cross-account identity or its permissions, exhausting required service quotas, or modifying managed resources in the account outside of Cockroach Labs.

​

Limitations and operations

​

Can I run more than one cluster in a single cloud account?

Yes. Multiple BYOC clusters can share a single cloud account. On AWS, the account must not contain a BYOC cluster created before July 27, 2026. If it does, you must delete that cluster or migrate its data first. The account must still be dedicated to CockroachDB infrastructure and free of other workloads at the time of setup.

​

Does BYOC support VPC or VNet peering?

BYOC only supports VPC peering on GCP, which is the same support limitation as other CockroachDB Cloud clusters. On AWS and Azure, applications only connect privately through your cloud provider’s private endpoint service. Refer to .

​

Which regions and machine types can I use?

BYOC region availability follows . Machine type availability varies by cloud provider. Refer to and the deployment guide for your cloud provider.

​

Who collects diagnostic bundles on a BYOC cluster?

Cockroach Labs support collects on a BYOC cluster as part of the managed service.

​

Do I need to open support tickets with my cloud provider?

Occasionally, yes. Because the account is yours, you must raise some issues with your cloud provider, such as service quota increases or capacity availability in a region.

​

How do I delete a BYOC deployment?

Use the CockroachDB Cloud Console or the . Some resources, including your backups and the identity you granted, remain in your account after deletion. Refer to the deployment guide for your cloud provider.

​

Next steps