Is DigitalOcean HIPAA compliant?
BAA on select plansPHI with conditionsSOC 2 Type II
Will DigitalOcean sign a HIPAA BAA?
Sometimes — DigitalOcean signs a HIPAA BAA only on specific plans or add-ons.
DigitalOcean presents a standard (generally non-negotiable) BAA. To run HIPAA workloads, customers must execute the BAA AND subscribe to Standard or Premium Support, and restrict ePHI to designated Covered Products (Droplets, Kubernetes, Spaces, Volumes, Load Balancers, Firewalls, VPC, Monitoring, Backups/Snapshots).
PHI eligibility
ePHI may only be processed, stored, or transmitted on DigitalOcean Covered Products, and only after executing the BAA and purchasing Standard or Premium Support.
SOC 2
SOC 2 Type II
Trust center
Sub-processors
—
Notes
HIPAA eligibility is recent (select Covered Products). A paid Standard/Premium Support plan is a hard prerequisite alongside the BAA. SOC 2 Type II confirmed on DigitalOcean's certification-reports page (Schellman auditor).
Get notified when this changes
We track DigitalOcean's BAA and HIPAA status. Leave your email and we'll send one note if the verdict on this page changes.
How to request and sign a BAA with DigitalOcean
Sometimes — DigitalOcean signs a HIPAA BAA only on specific plans or add-ons.
Request routeBy request — via trust center or support
- 1Get on a qualifying planDigitalOcean presents a standard (generally non-negotiable) BAA. To run HIPAA workloads, customers must execute the BAA AND subscribe to Standard or Premium Support, and restrict ePHI to designated Covered Products (Droplets, Kubernetes, Spaces, Volumes, Load Balancers, Firewalls, VPC, Monitoring, Backups/Snapshots).
- 2Request the Business Associate AgreementDigitalOcean provides the BAA on request. Open a request through DigitalOcean's trust center and ask for the current Business Associate Agreement covering your plan.
- 3Confirm what PHI is allowed before you store anyePHI may only be processed, stored, or transmitted on DigitalOcean Covered Products, and only after executing the BAA and purchasing Standard or Premium Support. Match your configuration to this scope before putting protected health information into DigitalOcean.
Last verified 2026-05-31 · Plan tiers and BAA terms change often — confirm the current process directly with DigitalOcean before you rely on it. This is cited public information, not legal advice.
Frequently asked questions
Does DigitalOcean sign a HIPAA Business Associate Agreement (BAA)?
Sometimes — DigitalOcean signs a HIPAA BAA only on specific plans or add-ons. DigitalOcean presents a standard (generally non-negotiable) BAA. To run HIPAA workloads, customers must execute the BAA AND subscribe to Standard or Premium Support, and restrict ePHI to designated Covered Products (Droplets, Kubernetes, Spaces, Volumes, Load Balancers, Firewalls, VPC, Monitoring, Backups/Snapshots).
Is DigitalOcean HIPAA compliant?
DigitalOcean can be HIPAA-compliant only on the specific plans or add-ons where it will sign a Business Associate Agreement (BAA). ePHI may only be processed, stored, or transmitted on DigitalOcean Covered Products, and only after executing the BAA and purchasing Standard or Premium Support.
Can you store PHI (protected health information) in DigitalOcean?
ePHI may only be processed, stored, or transmitted on DigitalOcean Covered Products, and only after executing the BAA and purchasing Standard or Premium Support.
Is DigitalOcean SOC 2 certified?
DigitalOcean reports a SOC 2 Type II attestation according to its public security documentation.
How do I request a HIPAA BAA from DigitalOcean?
DigitalOcean provides the BAA on request. Open a request through DigitalOcean's trust center and ask for the current Business Associate Agreement covering your plan. Confirm current terms directly with DigitalOcean before storing PHI.
What plan do I need to sign a BAA with DigitalOcean?
DigitalOcean presents a standard (generally non-negotiable) BAA. To run HIPAA workloads, customers must execute the BAA AND subscribe to Standard or Premium Support, and restrict ePHI to designated Covered Products (Droplets, Kubernetes, Spaces, Volumes, Load Balancers, Firewalls, VPC, Monitoring, Backups/Snapshots).
Sources
https://www.digitalocean.com/trust/hipaa-at-do
https://www.digitalocean.com/trust/certification-reports
This page is cited public information, not legal or compliance advice. A BAA's availability can depend on your specific plan, region, and contract. Always confirm current terms with DigitalOcean before processing protected health information.
Check another vendor
See all HIPAA compliant cloud infrastructure & hosting →
Browse all 105 vendors by category →