Neon
Neon, LLC (a subsidiary of Databricks, Inc.) ·neon.com· As of: 2026-09-18
Work through this tool with an AI
Our verdict
A database keeps nobody ahead. Running it so that every change gets its own copy shortens lead time into production; skipping that leaves the team working against one shared test database that slows everyone down. The advantage stays purchasable, because a competitor can buy the same branching tomorrow.
Evidence:the contracting party is Databricks, Inc. as parent company of Neon, LLC; the Neon schedule deletes section 7 of the data processing addendum and names Grafana Labs as an additional subprocessorOpen sourceusage data may be used for product development and may contain queries entered by users, excluding the results of those queries; version dated 20.02.2026Open sourcedeletion within thirty days of a written request after the agreement ends, section 9.3; backup and disaster recovery are not part of the service under section 9.1; version v3 dated 21.07.2023Open sourceaudit log covering console, API and pgAudit only with HIPAA logging enabled, no self-serve access, retrieval through a support request, events may be missing under heavy loadOpen sourceplan overview: metrics and log export, the uptime commitment and the compliance and security row appear for the Scale plan aloneOpen sourceprices per CU-hour and GB-month, no monthly minimum, history window and extra branches billed separatelyOpen sourceEU region Frankfurt selectable on every plan, fixed at project creation and unchangeable afterwards; Azure regions deprecatedOpen sourcethe permission model can only raise access and any member may manage protected branches; no single sign-on over SAML documented, membership by verified email domain insteadOpen sourceEU-US Data Privacy Framework certification covering Databricks, Inc. and Neon, LLC; standard contractual clauses as the transfer basisOpen sourcethe schema is shared with Amazon Bedrock for the SQL editor assistant, actual data is not, per the vendorOpen sourcecustomer data backups are retained for thirty days, encryption is AES-256 at rest and TLS 1.2/1.3 in transitOpen sourceprice comparison Supabase: USD 25 per month on the Pro plan as a fixed base fee, single sign-on for the dashboard from the Team plan at USD 599 per monthOpen source
Who it fits
Solo
suitable
The free plan gives 100 CU-hours of compute and 0.5 GB of storage per project. A database that only runs when accessed stays inside that.
Mid-market
suitable
Billing follows usage with no base fee. The calculation has to include the history window at USD 0.20 per GB-month and extra branches at USD 1.50 per branch-month, both of which sit alongside storage.
Enterprise
suitable with caveats
Four points hold you up. The Neon schedule dated 05.08.2026 deletes section 7 of the data processing addendum and points to the SOC 2 report for audits. The audit log arrives only on the Scale plan after accepting the Business Associate Agreement, and per the vendor only through a support request. By its own documentation the permission model can only raise access, and any member may manage protected branches. The contracting party is Databricks, Inc. in the United States; the documentation names no single sign-on over SAML.
Buy, switch or build
Off-the-shelf
Amazon RDS for PostgreSQL
A fixed instance at a fixed size that runs continuously and produces an invoice known before the month starts. Large companies stay with it because procurement runs through the existing framework agreement with the cloud provider, because that provider's attestations have long since been reviewed and filed there, and because reserved capacity makes costs predictable over years. Branching per change is something you build yourself out of backups, and that takes minutes instead of seconds.
AI-native
Supabase
Bundles the same Postgres with authentication, file storage and a generated API, which makes it the default behind many application generators. The price is cut differently: USD 25 per month as a fixed base fee on the Pro plan, where Neon bills purely by usage with no minimum, and single sign-on for the dashboard starts on the Team plan at USD 599 per month, as of 18.09.2026. Taking the kit buys four primitives under one contract and gives up fine-grained control over compute.
Build it yourself
Self-hosted PostgreSQL
PostgreSQL runs on your own machine or in a container, backed up with pgBackRest, failed over with Patroni, rolled out through GitHub from this same catalogue, watched through Sentry, and the operating scripts get written by Claude Code or Cursor in days. For a dataset in the hundreds of gigabytes we assume ten to fifteen person-days to build, at an assumed day rate of EUR 1,200, plus machine and backup storage in the low hundreds per month. Failure comes later: at the restore that was never rehearsed, at the annual major version upgrade, at the on-call page at three in the morning, and on the day the builder leaves the company.
Our advice
- Solo: Take the free plan; it carries a real small application.
- Mid-market: Take it, and set the history window as tight as recovery allows.
- Enterprise: Before procurement, settle whether the SOC 2 report satisfies your audit and how the log reaches your own evidence without self-serve access.
Who is behind it
Staying power: Established
Since the acquisition the vendor belongs to a group, and its legal texts have run through that group's master agreement ever since. The procurement question is therefore the tie to that group, which is a different question from whether the vendor stays around.
- Ownership: subsidiary of Databricks, Inc.; the contracting party is the parent companythe contracting party is Databricks, Inc. as parent company of Neon, LLC; the Neon schedule deletes section 7 of the data processing addendum and names Grafana Labs as an additional subprocessorOpen source · As of 2026-09-18
- Acquisition: acquisition agreement announced on 14.05.2025databricks.com/…Open source · As of 2025-05-14
- Time in market: first commit March 2021, open access December 2022, general availability 15.04.2024, per the vendorneon.com/aboutOpen source · As of 2026-09-18
- Product maintenance: changelog updated weekly, latest entry 11.09.2026neon.com/docs/changelogOpen source · As of 2026-09-18
- Platform shift: Azure regions deprecated, new projects on AWS onlyEU region Frankfurt selectable on every plan, fixed at project creation and unchangeable afterwards; Azure regions deprecatedOpen source · As of 2026-09-18
Cost of leaving: Moderate
The data comes out, because Postgres speaks what every target reads. What is missing after the export is everything else: branching per pull request, the cost profile of a database that costs nothing while idle, and anything built on the vendor's other primitives, from authentication through object storage to model access. The region binds as well: it is fixed when the project is created and cannot be changed afterwards, so moving means a new project and a migration.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, no condition attachedyes, public and incorporated by referencethe contracting party is Databricks, Inc. as parent company of Neon, LLC; the Neon schedule deletes section 7 of the data processing addendum and names Grafana Labs as an additional subprocessorOpen sourceThe parent company's data processing addendum applies in version v3 dated 21.07.2023, which the master agreement dated 20.02.2026 incorporates in its then-current form; it therefore also covers self-service customers without a separate signature and contains the standard contractual clauses in modules two and three. The Neon schedule dated 05.08.2026 deletes section 7 on audits in full and replaces it: the audit right is exercised by the vendor supplying the SOC 2 report and summaries of the penetration testing reports on request. Anyone reading only the group agreement sees a broader audit right than the one that applies to this product.As of 2026-09-18 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, no condition attachedEU region Frankfurt selectable on every plan, fixed when the project is createdEU region Frankfurt selectable on every plan, fixed at project creation and unchangeable afterwards; Azure regions deprecatedOpen sourceAWS Europe (Frankfurt) with the identifier aws-eu-central-1 is available at no surcharge and with no plan restriction, as is London. The choice is made when the project is created and cannot be changed afterwards; moving region means creating a new project and migrating the data. The Azure regions are deprecated, among them Germany West Central, and new projects are created on AWS only. Object storage, functions and model access are available in Frankfurt, but not in London.As of 2026-09-18 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, tied to a conditionpublic group-wide list with purpose and country, incomplete for this productdatabricks.com/legal/databricks-subprocessorsOpen sourceThe list dated 09.06.2026 names purpose and country for each entry and, alongside the cloud providers, includes Anthropic and OpenAI for AI-backed services as well as Twilio, Atlassian, Salesforce, Slack and SupportLogic for communication and support, plus the group companies, one of them German. It is the group's list. The only Neon-specific subprocessor, Grafana Labs in the United States, appears only in the Neon schedule. Reviewing the chain means reading both documents.As of 2026-09-18 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, no condition attachedstandard contractual clauses in the data processing addendum, plus the EU-US Data Privacy FrameworkEU-US Data Privacy Framework certification covering Databricks, Inc. and Neon, LLC; standard contractual clauses as the transfer basisOpen sourceThe certification under the EU-US Data Privacy Framework names both companies explicitly, Databricks, Inc. and Neon, LLC. That is the rarer and the better version, because it lets the basis be matched to the recipient.As of 2026-09-18 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, but unfavourablequeries may flow into product development as usage data, results may notusage data may be used for product development and may contain queries entered by users, excluding the results of those queries; version dated 20.02.2026Open sourceThis is where the product pages and the contract diverge. For the AI assistant in the SQL editor the documentation states that the schema is shared with Amazon Bedrock and that no actual data is shared. The master agreement dated 20.02.2026 separately permits the vendor to collect usage data and use it to develop, improve, operate and support its products, and it defines usage data so that it may contain queries entered by authorised users, carving out only the results of those queries. With a database the personal part regularly sits in the query itself, in conditions carrying names, addresses or identifiers. As of 18.09.2026 we found no contractual exclusion of model training on customer content in the master agreement, the Neon schedule or the privacy notice.As of 2026-09-18 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, tied to a conditiondeletion within 30 days of a written request, backup excluded as a servicedeletion within thirty days of a written request after the agreement ends, section 9.3; backup and disaster recovery are not part of the service under section 9.1; version v3 dated 21.07.2023Open sourceSection 9.3 of the data processing addendum commits to deleting personal data or assisting with deletion within thirty days of the agreement ending, though only following a written request. Section 9.1 states at the same time that backup and disaster recovery for customer data are not part of the service and that backing up remains the customer's obligation. That sits next to a product offering snapshots, instant restore and a history window of up to thirty days. For operations both statements hold at once; for procurement the contractual one governs.As of 2026-09-18 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, tied to a conditionSOC 2 Type 1 and 2, SOC 3, ISO 27001, ISO 27701, HIPAA via the Scale planneon.com/docs/security/complianceOpen sourceThe attestations belong to the vendor itself and are named. Two conditions come with them: the reports arrive through the trust centre on request, and in the plan overview the compliance and security row is filled in for the Scale plan alone. The page names neither the versions of the standards nor the scope of the audits. For procurement along German lines, C5 and the EU Cloud Code of Conduct are absent.As of 2026-09-18 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, but unfavourableno statement from the vendorthe schema is shared with Amazon Bedrock for the SQL editor assistant, actual data is not, per the vendorOpen sourceThe product carries AI features: an assistant in the SQL editor running on Amazon Bedrock, third-party chat helpers and its own gateway to language models. On Regulation (EU) 2024/1689 we found no statement on 18.09.2026 in the terms of service, the Neon schedule, the compliance page, the AI use page or the parent company's index of legal texts. The transparency duty under Article 50 falls on the operator of the application in any case, and the operator can meet it, because no AI here speaks directly to end customers.As of 2026-09-18 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, but unfavourableaudit log only on the Scale plan through the HIPAA feature, retrieved via a support requestaudit log covering console, API and pgAudit only with HIPAA logging enabled, no self-serve access, retrieval through a support request, events may be missing under heavy loadOpen sourceA complete audit log does exist: actions in the console and the API, plus Postgres statements through the pgAudit extension. Three conditions make it hard to plan around for evidence duties. It hangs on the HIPAA feature, which requires the Scale plan and acceptance of the Business Associate Agreement. Self-serve access is not supported per the documentation, and retrieval runs through a support request. And the vendor states explicitly that events may go unlogged under exceptionally heavy load, because it weights database availability higher. The page names no retention period for the log. Separate from this is the export of metrics and Postgres logs to Datadog, Grafana Cloud and OpenTelemetry, which is likewise reserved for the Scale plan and covers operational monitoring.As of 2026-09-18 |
What it really costs
Entry price
Free plan with 100 CU-hours of compute and 0.5 GB of storage per project. The Launch plan bills USD 0.106 per CU-hour and USD 0.35 per GB-month, with no monthly minimum.prices per CU-hour and GB-month, no monthly minimum, history window and extra branches billed separatelyOpen source
As of 2026-09-18
What gets expensive
The Scale plan doubles compute to USD 0.222 per CU-hour and is at the same time the only one carrying an uptime commitment, log export, private networking over PrivateLink and the attestations. Anyone who needs one of those pays the higher rate on all compute rather than on the affected part alone. On top come the history window at USD 0.20 per GB-month, extra branches at USD 1.50 per branch-month and network transfer beyond 500 GB per project at USD 0.10 per GB.
What it displaces
- Your own Postgres instance for development and preview
- One shared test database for the whole team
Interfaces
- Postgres wire protocol
- HTTP API and command line tool
- Terraform provider
- GitHub and Vercel integrations
Matching methods
- DORA Delivery DiagnosticThe diagnosis measures lead time into production and time to restore after a failure, and for most teams both hang on the database: one shared test database queues changes up, a copy per branch clears the queue.
- DORA AI Capabilities Model (Seven AI Capabilities)Among the seven capabilities are accessible internal data and an internal platform, and that is exactly where a database an agent can create, fill and throw away on its own does its work.
- Regulatory Density TestThe test asks whether a rule hits you specifically, and here the answer becomes technical: the region is fixed at project creation, the audit right is reduced to inspecting reports, and the log arrives only through a request.
Alternatives
- Supabase
Sources
- 1.the contracting party is Databricks, Inc. as parent company of Neon, LLC; the Neon schedule deletes section 7 of the data processing addendum and names Grafana Labs as an additional subprocessor (opens in a new tab)neon.com/platform-terms · As of 2026-09-18
- 2.usage data may be used for product development and may contain queries entered by users, excluding the results of those queries; version dated 20.02.2026 (opens in a new tab)databricks.com/legal/mcsa · As of 2026-09-18
- 3.deletion within thirty days of a written request after the agreement ends, section 9.3; backup and disaster recovery are not part of the service under section 9.1; version v3 dated 21.07.2023 (opens in a new tab)databricks.com/legal/dpa · As of 2026-09-18
- 4.audit log covering console, API and pgAudit only with HIPAA logging enabled, no self-serve access, retrieval through a support request, events may be missing under heavy load (opens in a new tab)neon.com/docs/security/hipaa · As of 2026-09-18
- 5.plan overview: metrics and log export, the uptime commitment and the compliance and security row appear for the Scale plan alone (opens in a new tab)neon.com/docs/introduction/plans · As of 2026-09-18
- 6.prices per CU-hour and GB-month, no monthly minimum, history window and extra branches billed separately (opens in a new tab)neon.com/pricing · As of 2026-09-18
- 7.EU region Frankfurt selectable on every plan, fixed at project creation and unchangeable afterwards; Azure regions deprecated (opens in a new tab)neon.com/docs/introduction/regions · As of 2026-09-18
- 8.the permission model can only raise access and any member may manage protected branches; no single sign-on over SAML documented, membership by verified email domain instead (opens in a new tab)neon.com/docs/manage/organizations · As of 2026-09-18
- 9.EU-US Data Privacy Framework certification covering Databricks, Inc. and Neon, LLC; standard contractual clauses as the transfer basis (opens in a new tab)databricks.com/legal/privacynotice · As of 2026-09-18
- 10.the schema is shared with Amazon Bedrock for the SQL editor assistant, actual data is not, per the vendor (opens in a new tab)neon.com/docs/security/ai-use-in-neon · As of 2026-09-18
- 11.customer data backups are retained for thirty days, encryption is AES-256 at rest and TLS 1.2/1.3 in transit (opens in a new tab)neon.com/docs/security/security-overview · As of 2026-09-18
- 12.price comparison Supabase: USD 25 per month on the Pro plan as a fixed base fee, single sign-on for the dashboard from the Team plan at USD 599 per month (opens in a new tab)supabase.com/pricing · As of 2026-09-18
- 13.databricks.com/… (opens in a new tab)As of 2025-05-14
- 14.neon.com/about (opens in a new tab)As of 2026-09-18
- 15.neon.com/docs/changelog (opens in a new tab)As of 2026-09-18
- 16.databricks.com/legal/databricks-subprocessors (opens in a new tab)As of 2026-09-18
- 17.neon.com/docs/security/compliance (opens in a new tab)As of 2026-09-18
Last reviewed: 2026-09-18 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.
From tool to decision
The offer that fits this tool
A tool profile tells you what the tool does and what it means for compliance. Whether it gets priority in your company is a management decision, and it takes one working day: the executive AI workshop ranks your initiatives by business value, risk, data readiness and ownership.