GDPR checklist for database tools.
Database services store the records of your application, which is often the core of your personal data. Compare 23 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Supabase | Usually a processor | Set per account or project | Published by the vendor |
 Firebase | Usually a processor | Set per account or project | Published by the vendor |
 MongoDB Atlas | Usually a processor | Set per account or project | Published by the vendor |
 Neon | Usually a processor | Set per account or project | Obtained through the vendor |
 PlanetScale | Usually a processor | Set per account or project | Published by the vendor |
 Snowflake | Usually a processor | Set per account or project | Obtained through the vendor |
 Databricks | Usually a processor | Set per account or project | Obtained through the vendor |
 Redis | Usually a processor | Set per account or project | Published by the vendor |
 Upstash | Usually a processor | Set per account or project | Published by the vendor |
 CockroachDB | Usually a processor | Set per account or project | Published by the vendor |
 Pinecone | Usually a processor | Set per account or project | Published by the vendor |
 Weaviate | Usually a processor | Set per account or project | Published by the vendor |
 Elastic Cloud | Usually a processor | Set per account or project | Published by the vendor |
 Aiven | Usually a processor | Set per account or project | Published by the vendor |
 Timescale | Usually a processor | Set per account or project | Published by the vendor |
 ClickHouse | Usually a processor | Set per account or project | Published by the vendor |
 Couchbase | Usually a processor | Set per account or project | Published by the vendor |
 Neo4j | Usually a processor | Set per account or project | Published by the vendor |
 SingleStore | Usually a processor | Set per account or project | Obtained through the vendor |
 Hasura | Usually a processor | Set per account or project | Published by the vendor |
 MotherDuck | Usually a processor | Set per account or project | Obtained through the vendor |
 Redpanda | Usually a processor | Set per account or project | Published by the vendor |
 Confluent | Usually a processor | Set per account or project | Obtained through the vendor |
What to check for database tools
- Confirm the region chosen when the database was created.
- Check backup retention, since deleted records can live on in backups.
- Review who has access to production data and how that access is logged.
- Record any transfer outside the EEA and its safeguard.
All database tools
- SupabaseDatabase
- FirebaseDatabase
- MongoDB AtlasDatabase
- NeonDatabase
- PlanetScaleDatabase
- SnowflakeDatabase
- DatabricksDatabase
- RedisDatabase
- UpstashDatabase
- CockroachDBDatabase
- PineconeDatabase
- WeaviateDatabase
- Elastic CloudDatabase
- AivenDatabase
- TimescaleDatabase
- ClickHouseDatabase
- CouchbaseDatabase
- Neo4jDatabase
- SingleStoreDatabase
- HasuraDatabase
- MotherDuckDatabase
- RedpandaDatabase
- ConfluentDatabase
Questions, answered.
What should I check before using a database tool under the GDPR?
Confirm the region chosen when the database was created. Check backup retention, since deleted records can live on in backups. Review who has access to production data and how that access is logged. Record any transfer outside the EEA and its safeguard.
Do I need a data processing agreement with a database provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which database tools does Privacyboard cover?
Supabase, Firebase, MongoDB Atlas, Neon, PlanetScale, Snowflake, Databricks, Redis, Upstash, CockroachDB, Pinecone, Weaviate, Elastic Cloud, Aiven, Timescale, ClickHouse, Couchbase, Neo4j, SingleStore, Hasura, MotherDuck, Redpanda, Confluent. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.