We at ClickHouse are excited to share some great news: HIPAA and PCI self-service deployments are now generally available in ClickHouse Cloud! This is a game-changer, empowering our customers to manage their crucial data security needs with ease and confidence.

### Protecting Health Information

The Health Insurance Portability and Accountability Act (HIPAA) is a cornerstone of U.S. law, dedicated to safeguarding the most sensitive medical information. We’re talking about **electronic protected health information (ePHI or PHI)**, which includes any information relating to a patient’s condition in the past, present or future, provision of healthcare, or payment thereof, that can be associated with a person’s identity. HIPAA outlines the requirements for both **covered entities** (like doctors, hospitals, and health plans) and their **business associates** (organizations like ClickHouse that help covered entities and other business associates process this vital data). ClickHouse built a compliance program around the HIPAA [Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html), ensuring we provide robust administrative and technical safeguards, and work with our cloud providers to ensure compliance down to the hardware.

### Securing Payment Card Data
Payment Card Industry Data Security Standards ([PCI DSS](https://www.pcisecuritystandards.org/standards/pci-dss/)) are a set of robust standards set forth by the PCI Security Standards Council designed to protect **payment card data** as it is stored, processed and transmitted. At ClickHouse, we proudly adhere to the stringent Level 1 Service Provider requirements of the PCI DSS, ensuring that your customers’ sensitive cardholder data is always safe.

:::global-blog-cta:::

## Performance Meets Protection

ClickHouse empowers our customers to store and process ePHI and payment card data at scale with lightning fast performance. Customers currently enjoying the speed, efficiency and security of our HIPAA services include pioneers in pharma, ground breaking medical research institutions, innovative user engagement services, meticulous client management, cutting-edge artificial intelligence, and robust security services, all designed to support the healthcare industry. Our PCI customers are the vigilant heroes of fraud detection services, where every millisecond counts! We made the effort to understand the most vital security features our customers need, ensuring the continuous privacy and security of the data they entrust to us. Beyond our already formidable security framework, these specialized environments offer enhanced isolation from other workload types, fortified access controls, and granular auditing, providing complete transparency and control. 

We didn’t stop there! We partnered with a trusted advisor in security and compliance to perform an independent audit of our environment, and the results are a source of pride. Our SOC 2 Type II + HIPAA and PCI Level 1 Service Provider AOC, a testament to our dedication to excellence and compliance, is readily available for download in our [Trust Center](https://trust.clickhouse.com). We encourage our customers to explore our [security shared responsibility model](https://clickhouse.com/docs/cloud/security/shared-responsibility-model) to handpick security controls tailored to their unique requirements, ensuring a comprehensive security posture. 

It is our honor to be your service provider of choice, especially when it comes to the most stringent and non-negotiable of privacy and security demands. We are here to support your success.

## Empowerment at Your Fingertips

ClickHouse customers with **Enterprise** organizations, the path to secure data is now incredibly simple and direct! 

HIPAA customers can request a Business Associate Agreement (BAA) directly on your Organization page within the console. Once that’s completed, you can deploy HIPAA services to certified cloud providers and regions with confidence, knowing your healthcare data is in a compliant environment.

PCI customers can seamlessly enable PCI services by simply activating the PCI compliance feature on your Organization page in the console. PCI services can be deployed to our certified cloud providers and regions, ready to secure your payment data and maintain compliance.

For even more details on our currently supported HIPAA and PCI cloud providers and regions, be sure to visit our comprehensive [supported cloud regions](https://clickhouse.com/docs/en/cloud/reference/supported-regions) page. The future of data security is here!

HIPAA and PCI self-service deployments are now generally available in ClickHouse Cloud

large_474642773-598579ee-714d-4e3e-aadc-9f676bb75c9b.png

medium_474642773-598579ee-714d-4e3e-aadc-9f676bb75c9b.png

small_474642773-598579ee-714d-4e3e-aadc-9f676bb75c9b.png

thumbnail_474642773-598579ee-714d-4e3e-aadc-9f676bb75c9b.png

474642773-598579ee-714d-4e3e-aadc-9f676bb75c9b.png

HIPAA and PCI Compliance at ClickHouse

We are excited to introduce ClickHouse Government, a solution specifically designed for the public sector. Performance, cost savings, ease of deployment, and security. Intrigued? Read on and join our [waitlist](https://clickhouse.com/government)! 

## Our story

ClickHouse, Inc., founded in 2021 and headquartered in the California Bay Area, is incorporated in Delaware. As the creators of the widely adopted open-source ClickHouse database, the company launched the proprietary cloud-native architecture supporting ClickHouse Cloud on AWS in December, 2022. Today, ClickHouse Cloud runs globally across AWS, GCP, and Azure, with support for Bring Your Own Cloud (BYOC) deployments on AWS.

## Architecture

Our cloud-native architecture is built for separation of compute and storage, which significantly improves resource utilization. We deploy compute via Kubernetes due to its built-in functionality for scaling, scheduling, monitoring, and easy integration with load balancers. The ClickHouse Operator enables automating cluster configuration and events. ClickHouse utilizes object storage such as AWS’s Simple Storage Service (S3) to achieve scalability and cost benefits while maintaining insert and query performance.

ClickHouse Government is built using this architecture to achieve the same performance we enjoy in our own cloud environment, packaged to be deployed to yours. The package is initially available in AWS, and we are taking requests for additional clouds or hardware-based environments.

![ClickHouse Government Diagram.webp](/uploads/Click_House_Government_Diagram_4d513727c3.webp)

## Feature-rich

In addition to the separation of compute and storage we enjoy in our cloud, ClickHouse Government will stay close to the version we run in ClickHouse Cloud. This provides proprietary features, such as [SharedMergeTree](https://clickhouse.com/docs/cloud/reference/shared-merge-tree). This unique table engine offers higher insert throughput, improved throughput of background merges, improved throughput of mutations, and more lightweight strong consistency for select queries. Additionally, as we add new features, functionality is thoroughly tested to ensure it continues to meet our standards.

## Compression

ClickHouse Cloud also benefits from the [ZSTD compression algorithm](https://clickhouse.com/docs/data-compression/compression-in-clickhouse#compression-in-clickhouse-cloud), which has the advantage of being consistently fast on decompression (around 20% variance) and having the ability to be parallelized. Based on the vendor and use-case, some customers have reported using 50% less disk space than Postgres, 38% better compression than Snowflake and 30x better compression than BigQuery (learn more on our [Use Cases](https://clickhouse.com/use-cases) page).

## Performance and cost efficiency

Architecture, features, and efficient compression ratios working hand-in-hand have helped ClickHouse Cloud customers achieve near unbelievable levels of speed and compression, resulting in 2-10x improved performance and 3-5x cost savings over other providers. At a time when government missions are expanding while budgets are tightening, ClickHouse Government is built with the same architecture, features and compression ratios as ClickHouse Cloud, enabling public sector customers to achieve both cost reduction while delivering performance improvements.

![2025-06-09_10-21-04.png](/uploads/2025_06_09_10_21_04_412d17efeb.png)

## Ease of implementation

ClickHouse Government is pre-configured for FIPS 140-3 level encryption utilizing OpenSSL and baseline security hardening. Deployment is initially supported via Helm charts using a pull-based process to respect the most secure of boundaries. Build guides are available to configure required resources and will be improved and automated over time.

## Security and compliance

While ClickHouse Government comes pre-configured with additional security controls, we also make the process of fulfilling security needs such as FedRAMP Moderate, FedRAMP High, IL 2, 4, 5, and 6 to obtain an Authorization to Operate (ATO), we also want to make your journey a little easier. This package is accompanied by National Institute for Standards and Technology (NIST) Risk Management Framework (RMF) documentation and NIST 800-53 control mapping. 

## Availability

ClickHouse Government on AWS will be available in private preview starting June 10. Come visit our booth at the AWS Summit in Washington, DC on June 10 and 11 to learn more or join our [waitlist](https://clickhouse.com/government) where you can ask about this offering or future cloud or bare metal deployments.


We are excited to introduce ClickHouse Government, a solution specifically designed for the public sector. 

large_ClickHouse Government Blog Banner.png

medium_ClickHouse Government Blog Banner.png

small_ClickHouse Government Blog Banner.png

thumbnail_ClickHouse Government Blog Banner.png

ClickHouse Government Blog Banner.png

Introducing ClickHouse Government on AWS

![Screenshot 2024-06-18 at 4.57.03 PM.png](/uploads/Screenshot_2024_06_18_at_4_57_03_PM_f038c417c5.png)

<h4>Introduction</h4>

<p>
We value our Open Source community and are taking steps to improve our security communications. We launched the ClickHouse Cloud Trust Center in 2022 which describes our security controls, compliance efforts, and enables customers to subscribe for updates to our program. 
</p>

<p>
Today, we are excited to announce the launch of a Trust Center supporting ClickHouse Open Source Software (OSS)! Our <a href="https://trust.clickhouse.com/?product=clickhouseoss">ClickHouse OSS Trust Center</a> is a one-stop shop for links to our Bug Bounty program, policies, and configurations. We will also leverage our Trust Center to send notifications of vulnerability fixes.
</p>

<h4>What benefits come with subscribing to our ClickHouse OSS Trust Center?</h4>

<p>
Our ClickHouse OSS vulnerability management program enables us to receive notifications of potential vulnerabilities through our Bug Bounty program, code scans, and reports from our contributors. We begin investigations within five (5) working days of receiving a notification. If a vulnerability is confirmed, we work to fully understand and classify the vulnerability, and then prioritize it for work. 
</p>

<p>
Once remediation is available via a fix or configuration, we may take a couple of paths to let our community know. Where the fix is straightforward and the risk of exploit is lower, we add the fix to our security change log, update our public repository, and issue a <a href="https://www.cve.org/About/Overview">Common Vulnerabilities and Exposures</a> (CVE) record. 
</p>

<p>
Fixes that may be more complex and have a higher risk of exploit qualify for our new Embargo Notification Program, where we will provide Trust Center subscribers advance notification before making the information public. There will usually be a short window between embargo notification and the additional steps to add the issue to our change log and issue a CVE.
</p>

<h4>What is the purpose of an embargo notification?</h4>

<p>
In the event that a vulnerability is not publicly or widely known and an exploit represents a high risk to our open-source users, we want to afford our users an opportunity to implement the fix before threat actors are made aware that the issue exists. It is both easy to enroll in the embargo notification program and easy to opt out should the notifications no longer be relevant to you. 
</p>

<h4>CVE Reporting</h4>

<p>
To ensure vulnerability information is available as broadly as possible, we not only issue notifications and fixes through our Trust Center and Open Source repository, but are also proud participants in the <a href="https://www.cve.org/PartnerInformation/ListofPartners/partner/ClickHouse">CVE Numbering Authority (CNA)</a> program. We ensure vulnerability information is made available through the CVE database with clear descriptions and remediation instructions. We also watch for relevant CVEs that are reported to ensure accurate classification, descriptions, and fixes. 
</p>

<h4>How to subscribe</h4>

<p>
Want to know more or sign up for notifications? Visit us at the <a href="https://trust.clickhouse.com/?product=clickhouseoss">ClickHouse OSS Trust Center</a>.
</p>

Today, we're excited to announce the launch of our Trust Center for open source ClickHouse!

large_340767906-4cf6f562-7bb7-47f0-8668-2c8c7728b7da.png

medium_340767906-4cf6f562-7bb7-47f0-8668-2c8c7728b7da.png

small_340767906-4cf6f562-7bb7-47f0-8668-2c8c7728b7da.png

thumbnail_340767906-4cf6f562-7bb7-47f0-8668-2c8c7728b7da.png

340767906-4cf6f562-7bb7-47f0-8668-2c8c7728b7da.png

Introducing Our New ClickHouse OSS Trust Center

![SOC 2.png](/uploads/SOC_2_1a99b636eb.png)

We are here for the data. Data gives us insights. It helps us tell compelling stories. It drives innovation. We developed [ClickHouse Cloud](/cloud) to put the world’s fastest database at your fingertips. To enable you to do your best work without worrying about all the things that come with delivering solid infrastructure. That is why we are excited to announce ClickHouse Cloud is now SOC 2 Type II compliant! 

## But what does this mean for you?

If you were waiting to sign up because you need to show your security and compliance teams that ClickHouse Cloud meets their requirements, this is for you! 

## What’s SOC 2 Type II?
SOC 2 Type II is an independent, third party attestation that we meet the commitments we make to you in terms of the security, availability, processing integrity, and confidentiality of your ClickHouse Cloud environment. It shows we not only have policies and procedures in place, but that we consistently apply those practices in our environment over time.

## What’s in the report?
Like others that complete SOC 2 Type II audits, we meet the strict requirements from the [Trust Services Criteria](https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria.pdf) for security, availability, processing integrity, and confidentiality. However, we went the extra mile to make this more than another tick in the box. We worked with our auditors, [Prescient Assurance](https://www.linkedin.com/company/prescient-assurance/), to fit our system description to our customer’s specific needs. It contains a plain language description of our environment, and specifically designed controls tailor made to the best way to run ClickHouse in the cloud. 

## Looking for something specific?
The controls contained in our SOC 2 Type II are also described in our [Trust Center](https://trust.clickhouse.com/). This site contains searchable descriptions of our controls, copies of our compliance reports, links to more information for critical ClickHouse functionality, and the ability to submit your own questionnaires if you need more information.

If you are responsible for implementing or reviewing security within ClickHouse Cloud, check out our [Security Companion Guide](https://trust.clickhouse.com/?itemUid=74d4cee1-4637-4da1-bdf0-8faf71ac3d9e). It takes you through available settings and has a shared responsibility matrix to make it easy to understand who manages what.

Visit our [Trust Center](https://trust.clickhouse.com/) to request a copy of our SOC 2 Type II. Share it with your security and compliance teams. And keep doing amazing things in ClickHouse Cloud!

If this has removed the barrier your company had to trialing ClickHouse Cloud, why not [start a trial now](https://clickhouse.cloud/signUp?loc=blog)! Also [register](https://clickhouse.com/company/events/clickhouse-workshop) for our free 6 hour training workshop to give your 2023 plans a head start.


Our security and compliance commitment to you, third party verified and now available for download.

Leticia Webb

Blog posts by Leticia Webb

HIPAA and PCI Compliance at ClickHouse

Introducing ClickHouse Government on AWS

Introducing Our New ClickHouse OSS Trust Center

ClickHouse Cloud is now SOC 2 Type II Compliant