OceanBase has successfully completed the first adherence process for the EU Cloud Code of Conduct (EU Cloud CoC). This achievement showcases OceanBase’s commitment to transparently demonstrate how OceanBase Cloud services meet GDPR compliance requirements.

The EU Cloud CoC is a comprehensive framework that enables cloud providers to legally demonstrate their GDPR compliance efforts and by that promotes standardization, transparency, and accountability. Greenlit by the European Data Protection Board (EDPB), the Code has become a trusted benchmark for safeguarding personal data, supporting risk assessments, and harmonizing compliance practices across the cloud industry.

To achieve adherence to the Code, cloud providers must undergo a robust compliance assessment performed by an independent, accredited monitoring process. This recognition underscores the company's dedication to delivering secure and reliable cloud services, enabling customers to benefit from transparency, consistency, and legal certainty.

To gain further insights on OceanBase’s adherence, access the EU Cloud CoC Public Registry and download the Public Report.

ISO27001 stipulates the best practices for the establishment and implementation of information security management systems (ISMS).

OceanBase has perfected the management of the company's physical security, network security and data security. OceanBase invited the British Standards Institution (BSI) to review the company's information security management system and obtained the certificate.

ISO27701 is a management system for privacy data protection and a guide for establishing, implementing, maintaining and continuously improving a privacy information management system (PIMS).

As a data controller, OceanBase complies with applicable laws and regulations in the collection, use and storage of personal data. As a data processor, OceanBase provides technical support for customers to process personal data. OceanBase provides a series of security capabilities to enhance the security of customer personal data and defines the responsibilities of OceanBase and its customers for data processing through data processing addendum. OceanBase invited the British Standards Institution (BSI) to review the company's privacy information management system and obtained the certificate.

ISO27018 provides best practices for personal data processors to protect personal data in public cloud environments.

OceanBase public cloud services provide database services to many customers. To protect the security of customer personal data, OceanBase has formulated a series of systems and established a dedicated SRE team and security team. OceanBase invited the British Standards Institution (BSI) to review the company's public cloud personal information protection management system and obtained the certificate.

ISO9001 certification is a globally recognized quality management system (QMS). ISO9001 provides a complete framework and methodology that can help companies provide customers with continuous high-quality products and services, and can also ensure that the company's daily management complies with legal and regulatory requirements.

OceanBase has implemented a quality management system (QMS) to safeguard the consistency of products and services. OceanBase invited CEPREI to review the company's quality management system and obtained the certificate.

ISO20000 is an IT service management system (ITSM). ISO20000 manages IT issues through "IT service standardization", develops service plans based on service level agreements (SLAs), and monitors the implementation of service plans.

OceanBase provides an L1-L2-L3 level after-sales service system that can provide customers with 7*24 hours of uninterrupted service. OceanBase conducts customer service satisfaction surveys twice a year and makes continuous improvements based on the survey results. OceanBase invited CEPREI to review the company's service management system and obtained the certificate.

The ISO22301 management system framework can help enterprises develop an integrated management process, enable enterprises to identify and analyze potential disasters, and provide an effective management mechanism to prevent or offset these threats and reduce the losses caused by disasters to enterprises.

OceanBase completes business continuity risk assessments every year and develops emergency response plans for identified important risks. OceanBase conducts regular drills based on the emergency response plans. OceanBase invited CEPREI to audit the company's business continuity management system and obtained the certificate.

SOC is formulated by the American Institute of Certified Public Accountants (AICPA) and covers five aspects: security, availability, confidentiality, integrity, and privacy. The purpose is to ensure that service providers can manage data securely and protect the privacy and interests of users.

OceanBase invites Ernst & Young as a third-party to audit corporate governance, security capabilities, operation and maintenance processes every year, and provide OceanBase cloud services with SOC Type II reports on security, availability, and confidentiality.

PCI DSS is an information security standard developed by the PCI Standards Security Council and is applicable to companies that transmit, store, and process cardholder data.

OceanBase invites Atsec as a third-party organization to audit the company's security governance every year. After the audit, it is determined that OceanBase cloud service complies with the PCI DSS standard and becomes a PCI DSS certified service provider. Therefore, if you need to pass the PCI DSS certification, after using the OceanBase cloud database service, you can submit the AOC report of the OceanBase cloud database to the Qualified Security Assessor which can simplify database testing.