Adobe
Design · adobe.com · last read 2026-10-12
Identity
| Legal entity | Adobe Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | US |
| EU contracting entity | Adobe Systems Software Ireland Limited |
| LEI | FU4LY2G4933NH2E1CP29 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | adobe.com · 2026-10-09 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | adobe.com | 2026-10-09 |
EU: Creative Cloud for enterprise applications are hosted in data centers in several locations, including Europe. Content is stored in the regional data store assigned when the user is provisioned in the Adobe Admin Console. The document does not say whether this is limited to a plan or costs extra.
Subprocessor chain
58 third parties · 1 of the vendor's own group companies · 58 with a country outside the EEA · all read 2026-10-09
| Subprocessor | Country | Purpose |
|---|---|---|
| Aiven Ltd | US, EU | Storage and Infrastructure for Cloud Services |
| Akamai Technologies Inc. | US, EU, GB, IN, CH | Akamai provides Adobe with content delivery network services. |
| Amazon Inc. (Connect) | US | Customer Support for Cloud Services |
| Amazon Web Services, Inc. | US, EU, AU, SG, JP, IN | Storage and Infrastructure for Cloud Services |
| Appcues Inc. | US | Product Functionality and User Experience for Cloud Services |
| BellSystem 24 Inc. | JP | Customer Support for Cloud Services |
| Black Forest Labs (BFL GmbH) | DE, US | AI Models |
| Box, Inc. | US, EU, GB | Storage and Infrastructure for Cloud Services |
| Brave Software, Inc. | US, FR, DE | Product Functionality and User Experience for Cloud Services (Document Cloud) |
| Brightcove | US, GB | Storage and Infrastructure for Cloud Services |
| BytePlus Pte. Ltd | SG, MY, ID | BytePlus Pte.’s Seedance video generation models are available for users within Adobe Firefly. |
| Cloudflare, Inc. | US | Storage and Infrastructure for Cloud Services |
| Concentrix Corporation | US, EU, KR, IN | Customer Support for Cloud Services |
| Crowdstrike Holdings, Inc. | US | Security for Cloud Services |
| Databricks | US | Storage and Infrastructure for Cloud Services |
| Datadog Inc | US | Product Functionality and User Experience for Cloud Services |
| Elastic N.V. | US | Product Functionality and User Experience for Cloud Services |
| ElevenLabs Ltd. | GB, US | ElevenLabs’s multilingual speech generation models are available for users within Adobe Firefly. |
| Fastly, Inc. | US, EU, GB | Storage and Infrastructure for Cloud Services (Advertising Cloud) |
| Features and Labels Inc (“fal.ai”). | SG, US, MY | AI Models |
| Google (Alphabet) | US | AI Models (Document Cloud) |
| Google (Alphabet) | — | Storage and Infrastructure for Cloud Services |
| Hoodoo Digital LLC | US | Customer Support for Cloud Services |
| Humain | SA | Humain’s image generation models are available for users within Adobe Firefly. |
| Intercom Inc. | US, EU, GB, AU | Customer Support for Cloud Services |
| Khoros LLC | US, GB | Customer Support for Cloud Services |
| Kuaishou Technology | SG | Kuaishou Technology’s Kling Image video generation and video-modification models are available for users within Adobe Firefly. |
| LexisNexis Risk Solutions Group | US | Security for Cloud Services |
| Luma AI Inc. | US | Luma AI’s Ray video generation and video-modification models are available for users within Adobe Firefly. |
| Merkle, Inc. | US, IN | Customer Support for Cloud Services |
| Microsoft Corporation | US, EU, GB, CA, IN, AU | Storage and Infrastructure for Cloud Services |
| Microsoft Corporation (Dynamics) | US, EU | Customer Support for Cloud Services |
| Mitek Systems Inc. | US, EU | Security for Cloud Services |
| Mitto AG | US, EU, GB, RS | Security for Cloud Services |
| MongoDB, Inc. | US, EU | Storage and Infrastructure for Cloud Services |
| New Relic Inc. | US, EU | Storage and Infrastructure for Cloud Services |
| Okta, Inc. | US, EU, GB | Security for Cloud Services |
| OpenAI | US, EU | AI Models (Document Cloud) |
| Platform.sh | US, EU | Storage and Infrastructure for Cloud Services |
| Red Hat, Inc. | US | Storage and Infrastructure for Cloud Services |
| Redis Cloud | US | Storage and Infrastructure for Cloud Services |
| Runway AI Inc. | US | Runway AI Inc.’s Runway image video generation and video-modification models are available for users within Adobe Firefly. |
| SCSK Serviceware Corporation | JP | Customer Support for Cloud Services |
| Second Nature AI, Inc. | US, EU | Product Functionality and User Experience for Cloud Services |
| Semrush Enterprise Solutions | US | Storage and Infrastructure for Cloud Services |
| SendGrid, Inc. | US, EU | Product Functionality and User Experience for Cloud Services |
| Sinch AB | US | Product Functionality and User Experience for Cloud Services |
| Sisense Ltd. | US, FR | Product Functionality and User Experience for Cloud Services |
| Slack Technologies | US, EU | Customer Support for Cloud Services |
| Snowflake Computing Inc. | US, EU, IN | Storage and Infrastructure for Cloud Services (Advertising Cloud) |
| Speechmatics | US, GB | Product Functionality and User Experience for Cloud Services |
| Splunk, Inc. | US, EU, GB | Security for Cloud Services |
| Stream | US, EU | Product Functionality and User Experience for Cloud Services |
| Teleperformance | US, EU, JP, CN, IN | Customer Support for Cloud Services |
| Telesign Corporation | US, EU, GB, RS | Security for Cloud Services |
| Topaz Labs LLC | US | AI Models |
| Twilio, Inc. | US | Security for Cloud Services |
| Zendesk Inc. | US, EU | Customer Support for Cloud Services |
Adobe's own group companies listed as subprocessors (1)
| Company | Country | Purpose |
|---|---|---|
| Semrush Inc. | US | All provide technical and customer support services depending on region of customer. |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · adobe.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC (module not stated) |
| Notice of new subprocessors | 14 days in advance, by email to addresses subscribed via the Sub-processor website |
| Notice of new subprocessors | At least 14 days before the new sub-processor processes personal data, by email to addresses subscribed via Adobe's sub-processor website |
| If you object to one | Customer may object in writing on reasonable grounds during the 14-day Objection Period; the parties then discuss the objection in good faith (the rest of this clause is cut off in this part) |
| If you object to one | Written objection on reasonable grounds during the Objection Period; parties discuss in good faith; if unresolved, customer's sole remedy is to terminate the affected parts of the Sales Order, with a refund of prepaid unused fees |
| Breach notification | without undue delay, per the notice provision in the Agreement |
| Transfer impact assessment | On written request, Adobe Ireland provides evidence of its evaluation of privacy and security controls for the third-country transfer, covering additional measures, safeguards and risk considerations |
| Audit | Certifications/attestations documentation; if insufficient, audit no more than once annually with 60 days' prior written notice, scope subject to Adobe pre-approval, each party bears own costs, no physical access |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| BSI C5 · C5 | Claimed | — | adobe.com | 2026-10-09 |
| CJIS | Claimed | — | adobe.com | 2026-10-09 |
| CSA STAR Level 2 · CSA | Claimed | — | adobe.com | 2026-10-09 |
| Spain ENS · ENS | Claimed | — | adobe.com | 2026-10-09 |
| FedRAMP Class B · FedRAMP | Claimed | — | adobe.com | 2026-10-09 |
| FedRAMP Class C · FedRAMP | Claimed | — | adobe.com | 2026-10-09 |
| IRAP Protected · IRAP | Claimed | — | adobe.com | 2026-10-09 |
| ISMAP | Claimed | — | adobe.com | 2026-10-09 |
| ISO 22301 · ISO22301 | Claimed | — | adobe.com | 2026-10-09 |
| ISO 27001 · ISO27001 | Claimed | — | adobe.com | 2026-10-09 |
| ISO 27017 · ISO27017 | Claimed | — | adobe.com | 2026-10-09 |
| ISO 27018 · ISO27018 | Claimed | — | adobe.com | 2026-10-09 |
| ISO 9001 · ISO9001 | Claimed | — | adobe.com | 2026-10-09 |
| Adobe Acrobat Sign Aadhaar Assessment | Claimed | Adobe Acrobat Sign | adobe.com | 2026-10-09 |
| CMMC Level 1 | Claimed | — | adobe.com | 2026-10-09 |
| EN 301 549 V3.2.1 (Harmonized European Accessibility Standard) | Claimed | — | adobe.com | 2026-10-09 |
| FERPA-Ready | Claimed | — | adobe.com | 2026-10-09 |
| GLBA-Ready | Claimed | — | adobe.com | 2026-10-09 |
| KFSI CSP Self-assessment Checklist (Korea) | Claimed | — | adobe.com | 2026-10-09 |
| SSPA (Microsoft) | Claimed | — | adobe.com | 2026-10-09 |
| TPN Blue Shield (Self-assessment) | Claimed | — | adobe.com | 2026-10-09 |
| PCI DSS 4.0 ROC · PCIDSS | Claimed | — | adobe.com | 2026-10-09 |
| PCI DSS 4.0 SAQ-D · PCIDSS | Claimed | — | adobe.com | 2026-10-09 |
| SOC 1 · SOC1 | Claimed | — | adobe.com | 2026-10-09 |
| SOC 2 · SOC2 | Claimed | — | adobe.com | 2026-10-09 |
| SOC 2 + HIPAA · SOC2T2 | Claimed | — | adobe.com | 2026-10-09 |
| SOC 3 · SOC3 | Claimed | — | adobe.com | 2026-10-09 |
| TISAX | Claimed | — | adobe.com | 2026-10-09 |
| Section 508 of the Rehabilitation Act of 1973 · VPAT | Claimed | — | adobe.com | 2026-10-09 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| ACN qualified cloud (Italy) | Adobe Customer Journey Analytics · ADOBE SYSTEMS SOFTWARE IRELAND LIMITED | qualified | QC1 (SaaS) | 2028-08-22 | 2026-10-09 |
| ACN qualified cloud (Italy) | Adobe Journey Optimizer · ADOBE SYSTEMS SOFTWARE IRELAND LIMITED | qualified | QC1 (SaaS) | 2028-08-22 | 2026-10-09 |
| ACN qualified cloud (Italy) | Adobe Real Time CDP · ADOBE SYSTEMS SOFTWARE IRELAND LIMITED | qualified | QC1 (SaaS) | 2028-08-22 | 2026-10-09 |
| ACN qualified cloud (Italy) | Adobe Target · ADOBE SYSTEMS SOFTWARE IRELAND LIMITED | qualified | QC1 (SaaS) | 2028-08-22 | 2026-10-09 |
| ACN qualified cloud (Italy) | AEM as a Cloud Service · ADOBE SYSTEMS SOFTWARE IRELAND LIMITED | qualified | QC1 (SaaS) | 2028-08-22 | 2026-10-09 |
| ACN qualified cloud (Italy) | AEM as Managed Services su AWS · ADOBE SYSTEMS SOFTWARE IRELAND LIMITED | qualified | QC1 (SaaS) | 2028-09-22 | 2026-10-09 |
| ACN qualified cloud (Italy) | AEM as Managed Services su Azure · ADOBE SYSTEMS SOFTWARE IRELAND LIMITED | qualified | QC1 (SaaS) | 2028-09-22 | 2026-10-09 |
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Adobe Inc. | Active | non-HR data | 2026-10-17 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Adobe Inc. | Active | non-HR data | 2026-10-17 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Adobe Inc. | Active | non-HR data | 2026-10-17 | 2026-10-09 |
| FedRAMP Marketplace (US) | Adobe Acrobat Sign for Government · Adobe | FedRAMP Authorized | Moderate | — | 2026-10-09 |
| FedRAMP Marketplace (US) | Adobe Analytics · Adobe | FedRAMP Authorized | LI-SaaS | — | 2026-10-09 |
| FedRAMP Marketplace (US) | Adobe Campaign · Adobe | FedRAMP Authorized | LI-SaaS | — | 2026-10-09 |
| FedRAMP Marketplace (US) | Adobe Connect Managed Services (ACMS-GC) · Adobe | FedRAMP Authorized | Moderate | — | 2026-10-09 |
| FedRAMP Marketplace (US) | Adobe Creative Cloud for Enterprise · Adobe | FedRAMP Authorized | LI-SaaS | — | 2026-10-09 |
| FedRAMP Marketplace (US) | Adobe Document Cloud including Adobe Acrobat, Adobe Acrobat Sign, Adobe Acrobat AI Assistant, Adobe Acrobat Analyzer, and Adobe Acrobat Services (APIs) · Adobe | FedRAMP Authorized | LI-SaaS | — | 2026-10-09 |
| FedRAMP Marketplace (US) | Adobe Experience Manager Managed Services (AEMMS-GC) · Adobe | FedRAMP Authorized | Moderate | — | 2026-10-09 |
| FedRAMP Marketplace (US) | Adobe Learning Manager · Adobe | FedRAMP Authorized | LI-SaaS | — | 2026-10-09 |
| Global LEI Index (GLEIF) | ADOBE INC. · ADOBE INC. | ISSUED | US-DE | 2027-07-12 | 2026-10-09 |
| Global LEI Index (GLEIF) | ADOBE SYSTEMS SOFTWARE IRELAND LIMITED · ADOBE SYSTEMS SOFTWARE IRELAND LIMITED | ISSUED | IE | 2027-09-12 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, 7 entries under Adobe; Adobe Inc.; Adobe Systems Software Ireland Limited
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Adobe; Adobe Inc.; Adobe Systems Software Ireland Limited
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Adobe; Adobe Inc.; Adobe Systems Software Ireland Limited
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Adobe; Adobe Inc.; Adobe Systems Software Ireland Limited
- FedRAMP Marketplace (US): checked 2026-10-12, 8 entries under Adobe; Adobe Inc.; Adobe Systems Software Ireland Limited
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Adobe; Adobe Inc.; Adobe Systems Software Ireland Limited
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Acrobat Pro 2024 (formerly known as Acrobat Classic) | 2029-07-15 | Declared | unknown | helpx.adobe.com | 2026-10-11 |
Vulnerability reporting: app.intigriti.com, [email protected] (security.txt, expires 2027-07-30; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Refused | full | 200 | 2026-10-09 |
| dpa | Public | full | 200 | 2026-10-09 |
| identity | Refused | partial | 403 | 2026-10-09 |
| lifecycle | Refused | partial | 200 | 2026-10-11 |
| residency | Refused | full | 200 | 2026-10-09 |
| subprocessors | Refused | full | 200 | 2026-10-09 |
History
Nothing has moved since we started watching this vendor on 2026-10-09. Changes appear here only after a human has reviewed them.