PostgreSQL Global Development Group Due Diligence
Run due diligence on PostgreSQL Global Development Group: check compliance and get alerts when suppliers change.
United States · www.postgresql.org · 8 vendors
The PostgreSQL Global Development Group is a worldwide community of developers and volunteers that maintains PostgreSQL, a powerful, open-source object-relational database system. It uses and extends the SQL language, known for its reliability, data integrity, robust feature set, and extensibility. The group formed in 1997, following the release of PostgreSQL Version 6.0.
Resilience scores
- Digital Sovereignty: 75
- Digital Resilience: 7
- Financial Resilience: 7
Technology vendors
- Amazon Web Services (aws) — Technology — United States
- F5 — Technology — United States
- Varnish Software AB — Technology — Sweden
- and 5 more
Services catalogue
2 services in catalogue across 1 category; runs on 8 sub-vendors.
- Databases
- PostgreSQL
Insights
Last updated 2026-08-11 · revision 11
8 direct vendors, 135 subvendors
Direct vendors by controlling owner country (sample)
- United States: 6
- Austria: 1
- Sweden: 1
Subvendors by controlling owner country (sample)
- Canada: 4
- New Zealand: 1
- Sweden: 4
Compliance
5 in-scope frameworks identified; showing 3.
CPRA — No public evidence
Evidence: https://www.postgresql.org/about/policies/privacy/, https://www.postgresql.org/about/donate/
Open Source Software Supply Chain Security — No public evidence
Evidence: https://www.postgresql.org/support/security/, https://www.postgresql.org/about/governance/
SOC 2 (source) — No public evidence
Evidence: https://www.postgresql.org/about/governance/sysadmin/, https://www.postgresql.org/support/security/, https://www.postgresql.org/about/governance/
Financials
Three-year financials
- 2024:
- 2023:
- 2022:
Financial Resilience Score: 7/10
PostgreSQL Global Development Group (PGDG) is not a corporate entity but an unincorporated open-source project with no revenue, EBIT, equity, or employees. Traditional financial resilience metrics do not apply. However, the project itself demonstrates strong operational resilience as an ongoing concern through its diversified corporate contributor base (EDB, Crunchy Data, Microsoft, AWS, Google, Fujitsu, NTT, VMware/Broadcom, Cybertec, Percona), permissive licensing that encourages broad commercial adoption, and 35+ years of continuous development since 1986. The project benefits from a strong ecosystem economics model where PostgreSQL-based commercial businesses have created a multi-billion-dollar market that reinvests developer resources upstream. Governance stability is high with a long-standing Core Team and Committer group, and release cadence has been reliably annual for over a decade. Associated non-profits (US PostgreSQL Association, PostgreSQL Europe, JPUG) have combined budgets well under USD 1 million per year, funding community infrastructure through donations and conference sponsorships. Key risks include no central budget for emergency work, dependence on donations/sponsors for infrastructure, occasional trademark and governance disputes, and contributor concentration where a handful of committers do a large share of code review. Enterprises cannot sign support contracts directly with PGDG, requiring third-party vendor relationships.
Key strengths: Diversified corporate contributor base with no single-sponsor risk, Permissive PostgreSQL License encourages broad commercial adoption, 35+ years of continuous development since 1986, Multi-billion-dollar commercial ecosystem reinvests into upstream project, Stable governance with long-standing Core Team and Committer group, Reliable annual release cadence sustained for over a decade, #1 most-used database in Stack Overflow Developer Surveys 2023 and 2024, DB-Engines DBMS of the Year multiple times (2017, 2018, 2020, 2023)
Risk factors: No central budget to fund emergency work such as major security incidents, Infrastructure funding depends on donations and sponsors via regional non-profits, Occasional trademark and governance disputes, Contributor concentration - handful of committers do large share of code review, Not a counterparty - enterprises cannot sign support contracts with PGDG directly, Loss of key individual committers would slow releases
Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.