Elastic Cloud
Observability · elastic.co · last read 2026-10-12
Identity
No identity observation recorded yet.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | elastic.co | 2026-10-08 |
EU: EU regions such as AWS EU (Frankfurt) are listed as available for ECH deployments. The customer picks the region, and the page names no plan or price for it.
Subprocessor chain
22 third parties · 13 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services EMEA SARL | — | Hosting (in Europe, the Middle East, and Africa) |
| Amazon Web Services, Inc. | US | Backup |
| Amazon Web Services, Inc. | — | Hosting (other than in Europe, the Middle East, and Africa) |
| Amazon Web Services, Inc. | US | Hosting for https://support.elastic.co and the Elastic Uploader Service |
| Atlassian Statuspage | — | Public status-page monitoring: https://status.jina.ai/ |
| Cloudflare, Inc. | — | CDN / edge proxy for Jina AI APIs and dashboard |
| Google Ireland Limited (GCP) | IE | Email correspondence with support via Gmail |
| Google Ireland Limited (GCP) | — | Hosting |
| Google LLC (GCP) | US | Hosting and inference for embeddings, rerank, and related public API services(api.jina.ai) |
| Google LLC (GCP) | US, BE, SG | Hosting for EIS(Elastic Inference Service) executors on Jina GCP |
| Google LLC (GCP) | US, BE | Hosting for Jina AI Reader and Search (r.jina.ai, s.jina.ai) |
| International Business Machines Corporation (IBM Cloud (Softlayer)) | US | Hosting |
| Microsoft Corporation (Azure) | — | Hosting |
| MongoDB, Inc. | US, BE | Caching layer and database for Jina Reader |
| Okta, Inc. | US | Access authentication |
| Salesforce.com, Inc. | US | Customer support ticketing via Service Cloud |
| Serper | US, SG | SERP API (Google Search) for Jina Search |
| Stripe, Inc. | US | Payment processing for prepaid tokens |
| Supabase, Inc. | US | Account, API key, and prepaid-wallet database |
| ThorData | — | Residential proxy when Reader cannot fetch a URL directly |
| Tines Automation, Inc. | US | Enterprise workflow automation based on alerts from the customer's Elastic Products (servicing customers in the US, Canada, and Mexico) |
| Tines Security Services Limited | IE | Enterprise workflow automation based on alerts from the customer's Elastic Products (servicing customers in all locations except the US, Canada, and Mexico) |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · elastic.co
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | At least 30 days in advance of changes, by email to customers subscribed to the RSS feeds at the subprocessor list URLs |
| If you object to one | Customer may object in writing with reasonable grounds within 30 calendar days of notice; parties discuss in good faith; if unresolved, Elastic at its sole discretion either does not appoint the subprocessor or lets customer suspend or terminate the affected offerings without liability |
| Breach notification | without undue delay, by email to the Organization Owner's customer-designated address |
| Audit | Under US privacy laws, customer may take reasonable and appropriate steps to ensure compliance, following the audit parameters in Section 3.4 (Audits) |
| Audit | written responses to reasonable information requests and security/audit questionnaires, confidential, no more than once per 12-month rolling period; also when requested by a data protection authority |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CSA STAR · CSA | Claimed | — | elastic.co | 2026-10-08 |
| Cyber Essentials Plus · CyberEssentialsPlus | Claimed | — | elastic.co | 2026-10-08 |
| FedRAMP High · FedRAMP | Claimed | — | elastic.co | 2026-10-08 |
| FedRAMP Moderate · FedRAMP | Claimed | — | elastic.co | 2026-10-08 |
| HIPAA | Claimed | — | elastic.co | 2026-10-08 |
| IRAP Assessed: Protected B · IRAP | Claimed | — | elastic.co | 2026-10-08 |
| ISO/IEC 27001 · ISO27001 | Claimed | — | elastic.co | 2026-10-08 |
| ISO/IEC 27017 · ISO27017 | Claimed | — | elastic.co | 2026-10-08 |
| ISO/IEC 27018 · ISO27018 | Claimed | — | elastic.co | 2026-10-08 |
| CyberGRX | Claimed | — | elastic.co | 2026-10-08 |
| PCI DSS · PCIDSS | Claimed | — | elastic.co | 2026-10-08 |
| SOC 2 · SOC2 | Claimed | — | elastic.co | 2026-10-08 |
| SOC 3 · SOC3 | Claimed | — | elastic.co | 2026-10-08 |
| TISAX | Claimed | — | elastic.co | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| FedRAMP Marketplace (US) | Elastic Cloud Hosted - High · Elastic Cloud Hosted | FedRAMP Authorized | High | — | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Elastic Cloud
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Elastic Cloud
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Elastic Cloud
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Elastic Cloud
- FedRAMP Marketplace (US): checked 2026-10-12, 1 entry under Elastic Cloud
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Elastic Cloud
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Elastic Cloud Enterprise | 30 months | Declared | unknown | elastic.co | 2026-10-11 |
| Elastic Cloud on Kubernetes | 30 months | Declared | unknown | elastic.co | 2026-10-11 |
| Elasticsearch | 30 months | Declared | unknown | elastic.co | 2026-10-11 |
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.