Grafana Labs
Observability · grafana.com · last read 2026-10-12
Identity
| Legal entity | RAINTANK, INC. DBA GRAFANA LABS |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 254900C887Y5T9RPKQ79 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | grafana.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | grafana.com | 2026-10-08 |
EU: The regional availability table lists EU locations (Belgium, Germany, Ireland, Netherlands, Sweden) for Grafana Cloud stacks, but names no plan or cost for them.
Subprocessor chain
8 third parties · 8 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| AlphaAI Technologies (Tavily) | US | Optional: AI feature |
| Alphabet Inc., Google (GCP) | US | Infrastructure, Cloud Service Provider, Optional: AI feature |
| Amazon.com Inc. (AWS) | US | Infrastructure, Cloud Service Provider, Optional: AI feature |
| Anthropic | US | Optional: AI feature |
| Microsoft Corporation (Azure) | US | Infrastructure, Cloud Service Provider |
| OpenAI | US | Optional: AI feature |
| Palantir Technologies Inc. | US | For customers using Grafana’s Federal Cloud offering |
| Twilio Inc. (Sendgrid) | US | Email, Alerting for SaaS |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · a-us.storyblok.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | UK IDTA |
| Notice of new subprocessors | Via notification mechanism on Grafana Labs legal webpage (https://grafana.com/legal) for customers who subscribe; no advance notice period stated |
| If you object to one | Object in writing to [email protected] within 30 days of notice on reasonable data protection grounds; Processor considers accommodations; if none within 60 days, either party may terminate the affected Services; no objection within 30 days is deemed authorization |
| Breach notification | without undue delay after detecting |
| Transfer impact assessment | Data Transfer Assessment for transfers to the US, published at https://grafana.com/legal |
| Audit | Copy of most recent third-party audit report on written request; if insufficient or for a regulator audit, a mutually agreed audit plan by an independent third party, no more than once a year, billed to customer at Grafana Labs' rates |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CSA Security Trust Assurance and Risk (STAR) · CSA | Certificate published | — | grafana.com | 2026-10-08 |
| GDPR | Claimed | General Data Protection Regulation Data Processor Agreement (DPA) available. | grafana.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | — | grafana.com | 2026-10-08 |
| PCI Compliance · PCIDSS | Claimed | through third-party approved scanning vendors for the Grafana Labs corporate environment for client payment processing | grafana.com | 2026-10-08 |
| SOC 2 Type 2 · SOC2T2 | Claimed | — | grafana.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Grafana Labs | Active | non-HR data | 2027-01-23 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Grafana Labs | Active | non-HR data | 2027-01-23 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Grafana Labs | Active | non-HR data | 2027-01-23 | 2026-10-09 |
| Global LEI Index (GLEIF) | RAINTANK INC. · RAINTANK INC. | ISSUED | US-DE | 2027-01-19 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Grafana Labs; RAINTANK, INC. DBA GRAFANA LABS
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Grafana Labs; RAINTANK, INC. DBA GRAFANA LABS
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Grafana Labs; RAINTANK, INC. DBA GRAFANA LABS
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Grafana Labs; RAINTANK, INC. DBA GRAFANA LABS
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Grafana Labs; RAINTANK, INC. DBA GRAFANA LABS
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Grafana Labs; RAINTANK, INC. DBA GRAFANA LABS
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| self-managed Grafana | 9 months | Declared | unknown | grafana.com | 2026-10-11 |
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.