Mosaic AI

Not found in the public sources scanned — ask the vendor directly.

Requires written confirmation — see Before you sign ↓

Databricks documents OpenAI's safety retention policy in its own product documentation: for gpt-5.5, gpt-5.5-pro and future models, OpenAI may retain content its classifiers flag as potentially violating usage policies for customers doing software engineering or acting as model-access intermediaries.

Requires written confirmation — see Before you sign ↓

Anthropic, PBC and OpenAI, L.L.C. are both registered as subprocessors for AI-backed services in the United States, each marked "Customer Selected" - so their engagement follows a customer decision rather than being a platform default.

Databricks publishes a Data Processing Addendum incorporating the Standard Contractual Clauses, forming part of the Master Cloud Services Agreement governing use of the Databricks Services.

Databricks publishes an RFC 9116 security.txt naming a security contact, a PGP key, its trust page as policy and a HackerOne bug bounty programme.

Confirm in writing: Ask the vendor to state this in writing before signing.

Databricks documents, in its own model serving pages, that OpenAI may retain flagged content for coding and model-intermediary customers on newer models, and that Anthropic retains data for safety purposes on Fable 5 and future Mythos-class models for all customers.

Almost no platform vendor publishes the retention behaviour of the models it resells - it is normally left for the buyer to find in the provider's own terms, if at all. Disclosing it inside the product documentation, where an engineer configuring an endpoint will actually see it, is materially better practice than a link in a subprocessor list.

Question for vendor: Which of our workloads fall inside OpenAI's "coding and routing customers" definition, and can we route around models with mandatory safety retention?

Anthropic and OpenAI are both registered subprocessors for AI-backed services, each marked "Customer Selected", and externally hosted model endpoints are centrally governed from within Databricks.

The "Customer Selected" marking is the useful part: no customer content reaches a third-party model until someone in the organisation configures an endpoint that sends it there. That supports a staged rollout and makes the AI supply chain a matter of configuration a buyer controls rather than a platform default they inherit.

Databricks-hosted foundation models such as Meta Llama run through Foundation Model APIs, while externally hosted models such as OpenAI GPT-4 are reached through External models. Both are served through the same Model Serving interface.

The interface being uniform is the point of the product and also the risk. A prompt served by a Databricks-hosted model stays inside the platform boundary; the same prompt routed to an external model leaves it, and the retention disclosures above then apply. A governance position has to distinguish the two, and the interface does not force that distinction on the person configuring it.

Question for vendor: How do we detect or restrict which endpoints route to external providers, and is that visible in audit logs?

AI Gateway is documented as the control point for guardrails, rate limits and quality monitoring, alongside Unity Catalog model registration, automated access controls and data lineage across the agent workflow.

This is a genuinely strong control surface for an AI platform, and it is the reason a regulated buyer would choose a platform over assembling the parts. The material collected is product documentation rather than assurance evidence, so it establishes the controls exist and are documented - not that they are independently tested.

Question for vendor: Are AI Gateway guardrails and Unity Catalog access controls in scope of your SOC 2 Type II?

Databricks refers to ISO certifications, an annual penetration test confirmation letter, an Enterprise Security Guide and a SOC 2 Type II report, all available through a due diligence package or the account team rather than published.

Nothing here suggests the certifications are absent - a platform at this scale in regulated industries would not survive without them. But scope is what decides whether they reach Mosaic AI, and scope cannot be read from a sentence saying documents are available on request. This is the single largest gap on the record and the one worth closing first.

Question for vendor: Please provide the ISO/IEC 27001 certificate and SOC 2 Type II report, and confirm whether Mosaic AI and Model Serving are named in their scope.

Databricks publishes a coordinated vulnerability disclosure route through HackerOne and a security contact, but nothing collected covers breach notification timeframes or how customers are told when a hosted foundation model is changed, deprecated or replaced.

Model deprecation is the live one for this product. An agent tuned against a specific hosted model behaves differently when that model is retired, and the notice period governs whether an organisation can re-validate before the change lands. It is an ordinary contract schedule item and should be requested directly.

Question for vendor: What notice do you give before deprecating or replacing a hosted foundation model, and what are your breach notification timeframes?

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Atlassian as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Google as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Google appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on AWS as a platform provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — AWS appears to be involved as a platform provider: confirm whether this dependency exists, and whether it processes customer data.