ClickHouse Workload for Microsoft Fabric: Vendor Attestation

We, the vendor, ClickHouse, Inc., confirm and attest to reviewing, meeting, and complying with the requirements outlined in the Microsoft Fabric Extensibility Toolkit, specifically the Publish Workload Requirements.

The following sections document details, exceptions, or variances regarding the attestation of adherence to the Publish Workload Requirements.

Workload Information

Business Requirements

Value To Customers

The ClickHouse workload for Microsoft Fabric provides an acceleration layer on top of OneLake, delivering sub-second, cost-efficient analytical queries for interactive analytics and AI workloads. Customers can sync OneLake tables into ClickHouse, query them from a built-in SQL console inside Fabric, connect to BI tools, build with client libraries like .NET, and expose governed, read-only access to agents and AI tooling via MCP.

Trial

We provide a free trial and simple way to explore the full value offered from the ClickHouse workload for a limited time.

☒ Yes ☐ No

Note: A trial organization and dedicated ClickHouse service are provisioned automatically when a user creates a ClickHouse item; sign-up requires no separate registration (Microsoft Entra identity). The trial includes credits and 30 days in accordance with Microsoft trial guidelines. Trials are available directly in Microsoft Fabric and default to the ClickHouse Scale tier, with service idling enabled by default.

Monetization

The workload is available on the marketplace for the customer to procure with or without a trial in accordance with the monetization guidelines.

☒ Yes ☐ No

Note: Available via Azure Marketplace; the trial converts to paid through the existing ClickHouse Cloud Azure Marketplace offer or by providing a credit card in ClickHouse Cloud console. Marketplace transaction data is covered by the existing marketplace terms and privacy policy. Link: ClickHouse Cloud on Microsoft Marketplace

Technical Requirements

Microsoft Entra Access

The workloads use Microsoft Entra authentication and authorization.

☐ No other authentication and authorization mechanisms are used

☒ Different authentication and authorization mechanisms are used for stored data in Fabric

Note: All user authentication into the workload uses Microsoft Entra via the Fabric Workload Client SDK (acquireAccessToken). The fabric-api backend validates the Entra token and performs a token exchange to establish the corresponding ClickHouse Cloud identity (deterministically derived from tenant ID + object ID; no passwords created; Microsoft SSO for console access). OneLake access uses Entra on-behalf-of tokens (trial) or a customer-provided service principal (paid). The primary PII exchanged is the admin's Microsoft Entra email address.

OneLake

Workloads integrate with OneLake to store data in the standard formats supported by the Fabric platform so that other services can take advantage of it.

☐ All data and metadata is stored in OneLake or Fabric Data Stores

☒ Not all data and metadata is stored in OneLake or Fabric Data Stores

Note: OneLake remains the source of truth. Tables selected for acceleration are copied/synced into the customer's dedicated ClickHouse Cloud service running on Azure. Metadata (saved queries, service configuration, user references) is stored in the ClickHouse Cloud control plane. Query results are rendered in the Fabric workspace.

Microsoft Entra Conditional Access

Enterprise customers require centralized control and management of the identities and credentials used to access their resources and data via Microsoft Entra to further secure their environment via conditional access.

☒ Works in its entirety ☐ Works with limitations ☐ Doesn't work

Admin REST API

Admin REST APIs are an integral part of the Fabric admin and governance process. These APIs help Fabric admins in discovering workspaces and items, and enforcing governance such as performing access reviews, etc. Basic functionality is supported as part of the Workload Development Kit and doesn't need any work from Partners.

☐ Microsoft Fabric Admin APIs are being used (/admin/*)

☒ No Microsoft Fabric Admin APIs are being used

Customer Facing Monitoring & Diagnostics

Health and telemetry data needs to be stored for a minimum of 30 days including activity ID for customer support purposes, including Trials.

☒ Minimum 30 days requirement is adhered to

☐ Vendor stores the data for __ days beyond the minimum requirement

Note: Health and telemetry data are stored in the ClickHouse Cloud control plane.

B2B

The implementation of the workload is in line with Microsoft Fabric's sharing strategy focused on allowing customers to collaborate with their business partners, customers, vendors, subsidiaries, etc. It also means users from other tenants can potentially be granted access to items partners are creating.

☐ Cross tenant B2B collaboration supported

☒ Workload Item Access only within the tenant

Note: Access is scoped to the tenant; a Fabric workspace maps 1:1 to a ClickHouse organization. Customers cannot share data in their ClickHouse service across tenants through the workload.

Business Continuity and Disaster Recovery

The vendor has a comprehensive Business Continuity and Disaster Recovery (BCDR) plan designed to tackle unplanned disasters and recovery steps.

Note: ClickHouse maintains documented BCDR plans, tests them at least annually, uses backups and cloud-native resiliency, and handles events through incident response procedures. ClickHouse's business continuity and disaster recovery controls are also covered as part of our ISO 27001 program. This certification can be viewed on our trust center at trust.clickhouse.com.

Performance

The Workload implementation takes measures to test and track performance of their Items.

☐ Performance metrics available via the monitoring hub

☒ Separate monitoring UI

☐ Not currently available to the end user; vendor support personnel can monitor via internal instrumentation

Note: Service monitoring is available to customers via the linked ClickHouse Cloud console.

Presence

To ensure that customer expectations independent of their home or capacity region are met, vendors need to align with Fabric regions and clouds. Availability in certain restrictions also impacts your Data Residency commitments.

☒ Service availability and colocation/alignment in the following Fabric regions.

Services are provisioned and hosted in the same ClickHouse Cloud Azure region as the user's Fabric region, where available (supported regions). Where no equivalent region exists, the nearest available supported ClickHouse Cloud Azure region is used for hosting.

☒ All or part of the service doesn't reside in Azure

Note: The ClickHouse Cloud control plane operates replicas in AWS; customer data may transit through or be processed by the control plane. Certain other parts of the service are provided by subprocessors in locations specified here.

Public APIs

Fabric Public APIs are the backbone of automation, enabling seamless communication and integration for both customers and partners within the Fabric ecosystem. Fabric Public API empowers users to build innovative solutions, enhance scalability, and streamline workflows.

☒ The workload uses Fabric Public APIs

Design / UX Requirements

Common UX

The workload and all item types the partner provides as part of it comply with the Fabric UX guidelines.

☒ The following variance and/or exceptions have been granted by Microsoft: designs follow the Fabric UX System and were reviewed with the Microsoft design team. Custom components styled to match Fabric are used where the Fabric library lacks primitives, per Microsoft guidance that look-and-feel is the requirement, not a specific library. No formal exceptions requested.

Item Creation Experience

The item creation experience is in accordance with the Fabric UX System.

☒ Yes ☐ No

Note: Item creation follows the Fabric UX System.

Monitoring Hub (long-running operations)

All long running operations need to integrate with the Fabric Monitoring Hub.

☐ Yes ☒ No

Note: Long running operations that copy data from Fabric to ClickHouse Cloud can be monitored in the ClickHouse Cloud console.

Trial Experience

The workload provides a Trial Experience for users as outlined in the design guidelines.

☒ Trial Supported ☐ Trial Not Supported

Monetization Experience

The monetization experience is in line with the design guidelines provided.

☒ Integrated with the marketplace and compliant with the guidelines

☐ BYOL ☐ Free / Freemium ☐ Other

Accessibility

The user experience is in compliance with the Fabric UX design guidelines for Accessibility.

☒ Compliant with the guidelines

World Readiness / Internationalization

English is supported as the default language. Localization, though optional, should be considered.

☒ English is the only supported language ☐ The following languages are supported

Item Settings

Item settings are implemented as a part of the ribbon as outlined in the UX guidelines.

☒ Yes ☐ No

Samples

Samples are optionally provided that preconfigure items of their type to help customers get started more easily.

☒ Samples not provided ☐ Samples provided

Note: Fabric users can use the built-in OneLake sample data to sync with ClickHouse to try out the Fabric workload with a trial.

Custom Actions

Custom actions can be optionally provided as a part of the item editor.

☒ Not implemented ☐ Implemented

Workspace settings

Workspace settings provide a way that workloads can be configured on a workspace level.

☐ Supported ☒ Not Supported

Global Search

Searching for items in Fabric is supported through the top search bar.

☐ Supported ☒ Not supported

Security / Compliance Requirements

Security general

Protection of customer data and metadata is of paramount importance. Workloads must go through a security review and assessment. Vendor attests that the security review and assessment was completed and will be periodically performed as enhancements and changes are made. Security issues discovered which could have a detrimental impact on the customer should be addressed promptly and customers notified where applicable.

Note: Our ClickHouse Security Standards that highlight our information security program and certifications can be found here: Security Addendum

ClickHouse maintains a secure development lifecycle including automated code scanning and periodic penetration testing. OneLake credentials (client secrets) are held in KMS and never exposed to or stored on the ClickHouse instance, and the on-behalf-of token flow was approved by ClickHouse product security. Certifications: SOC 2 Type II, ISO 27001. For details: trust.clickhouse.com.

Privacy

Partners that build workloads also have a responsibility to protect that data when they access it. Every workload goes through a privacy assessment and a privacy review. Vendor attests that privacy review was completed and is periodically performed as enhancements and changes are made.

Extra Requirements:

☐ Only essential HTTP-only cookies, only after positive authentication

☐ No third-party cookies

☐ Entra tokens obtained via the Fabric Workload Client SDK JavaScript APIs

Note: The Fabric Workload and ClickHouse Cloud console, accessible via an "Open ClickHouse" link, place certain first and third-party cookies for essential, functional, and analytical purposes. See our cookie policy.

Data Residency

Microsoft Fabric is making an Enterprise Promise around data not leaving the geography of the tenant for stored data and data in transit. As a workload in Fabric directly and users need to be aware what your commitments to Data Residency are. Define what your commitments are to the Data Residency of customer data.

Note: OneLake data that Fabric users transmit through a Workload to ClickHouse Cloud is stored in the ClickHouse Cloud Azure region nearest to the customer's Fabric region. Data that customers ingest into ClickHouse Cloud services they independently create outside of a Fabric Workload are hosted in the location the customer selects from among the cloud service providers and regions we support. Customers should be aware that, in either case: (1) ingested data may be processed by subprocessors in locations as described in our subprocessor list; and (2) support and engineering personnel receive access to cloud production environments to maintain infrastructure and provide support.

Compliance

The publisher attests to the following security, data, and compliance regulations and standards.

Note: ClickHouse maintains a SOC 2 Type II certification covering ClickHouse Cloud, and an ISO 27001 certification. The ClickHouse Cloud terms of service include a data processing addendum to help customers meet GDPR requirements, and we offer HIPAA-qualified compliance services options for customers that execute a Business Associate Agreement with us for processing of Protected Health Information (PHI). Details: trust.clickhouse.com.

Support

Live site

Partner workloads are an integral part of Fabric that requires that the Microsoft support teams are aware of how to contact you in case customers are reaching out to us directly.

Supportability

Vendors are responsible for defining and documenting their support parameters (Service level agreement, contact methods, ...). This information needs to be linked from the Workload page and should always be accessible to customers. In addition, the Marketplace criteria need to be taken into account for the listing of the SaaS offer.

☒ Vendor attests that support information is published to the marketplace offering and available to users/customers directly via the workload

Service Health and Availability

Vendors need to host a service health dashboard that shows their service health and availability to customers. This information can be included on the Supportability page.

Service health dashboard: status.clickhouse.com

Fabric Features

Application Life Cycle Management (ALM)

Microsoft Fabric's lifecycle management tools enable efficient product development, continuous updates, fast releases, and ongoing feature enhancements.

☐ Supported ☒ Not Supported

CI/CD

The workload supports CI/CD pipelines to enable automated deployment and integration workflows within Microsoft Fabric.

☐ Supported via the Fabric CICD manifest section ☒ Not supported

Item Definition Portability

Items can be exported with their full definition and restored in other workspaces, enabling lifecycle management and cross-workspace deployment.

☐ Items restorable in other workspaces ☒ Not restorable

Private Links

In Fabric, you can configure and use an endpoint that allows your organization to access Fabric privately.

☐ Supported ☒ Not Supported

Note: Azure Private Link is supported from ClickHouse Cloud console but it is not configurable through the Fabric workload. Link: Azure Private Link

Data Hub

The OneLake data hub makes it easy to find, explore, and use the Fabric data items in your organization that you have access to. It provides information about the items and entry points for working with them.

☐ Supported ☒ Not Supported

Data Lineage

In modern business intelligence (BI) projects, understanding the flow of data from the data source to its destination can be a challenge, especially for advanced analytical projects spanning multiple data sources, data items, and dependencies.

☐ Supported ☒ Not Supported

Sensitivity labels

Sensitivity labels from Microsoft Purview Information Protection on items can guard your sensitive content against unauthorized data access and leakage. They're a key component in helping your organization meet its governance and compliance requirements.

☐ Supported ☒ Not Supported

Terms of Service

• General Terms and Conditions
• ClickHouse Cloud Addendum
• ClickHouse for Fabric Addendum