Element
Messaging · element.io · last read 2026-10-12
Identity
| Legal entity | Element Creations Ltd |
|---|---|
| HQ | GB |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | Element Software SARL (and 1 other EU entity by country) |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | element.io · 2026-10-08 |
Data location
No data-location observation recorded yet.
Subprocessor chain
6 third parties · 5 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services (AWS) | US, NL, DE, GB | Infrastructure services: Cloud services and data centre services |
| Hubspot. Inc. | US | Web analytics & marketing automation |
| Posthog | US, DE | Web analytics |
| Stripe | GB | Payments Processor |
| Twillio | US | SMS Multi Factor Authentication |
| Zammad | DE | Customer service communication |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · static.element.io
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | UK IDTA |
| Notice of new subprocessors | Prior notice of any new sub-processor, with full details of the processing (period not stated) |
| If you object to one | Customer may terminate the Agreement without liability (no-fault) if it has reasonable grounds that the change would put it in breach of data protection law; requires at least 30 days' written notice of termination |
| Breach notification | without undue delay on becoming aware |
| Audit | Audits by the Customer or its designated auditor, only as far as necessary to demonstrate compliance; at least 30 days' notice required and parties must agree the scope, duration and purpose |
| Audit | Element keeps records and allows audits by the Customer or its designated auditor, only as far as needed to demonstrate compliance; requires at least 30 days' notice and agreed scope, duration and purpose |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| Cyber Essentials Plus · CyberEssentialsPlus | Claimed | — | element.io | 2026-10-08 |
| ISO/IEC 27001:2022 · ISO27001 | Claimed | Element is independently audited and certified as compliant with the ISO/IEC 27001:2022 information security management standard | element.io | 2026-10-08 |
| BITV 2.0 | Available on request | Accessibilty conformance reports available for clients | element.io | 2026-10-08 |
| Cyber Resilience Act | Claimed | — | element.io | 2026-10-08 |
| EN 301 549 | Claimed | accessibility across Element's product set; the page says Element aligns its efforts with these criteria, with ongoing audits (no conformance claimed) | element.io | 2026-10-08 |
| ISO/IEC 5230 | Claimed | Element's products are developed in accordance with ISO/IEC 5230 ("OpenChain"), an international standard for open source license compliance | element.io | 2026-10-08 |
| WCAG 2.1 Level AA · VPAT | Claimed | accessibility across Element's product set; the page says Element aligns its efforts with these criteria, with ongoing audits (no conformance claimed) | element.io | 2026-10-08 |
| WCAG AA 2.2 · VPAT | Available on request | Accessibilty conformance reports available for clients | element.io | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-09, no entry under Element; Element Creations Ltd; Element Software SARL
- DORA critical ICT third-party providers (ESAs): checked 2026-10-09, no entry under Element; Element Creations Ltd; Element Software SARL
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-09, no entry under Element; Element Creations Ltd; Element Software SARL
- FedRAMP Marketplace (US): checked 2026-10-09, no entry under Element; Element Creations Ltd; Element Software SARL
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-09, no entry under Element; Element Creations Ltd; Element Software SARL
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Element Server Suite Pro | 12 months | Declared | unknown | element.io | 2026-10-11 |
Vulnerability reporting: [email protected] (security.txt, expired 2025-01-30; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.