New Relic
Observability · newrelic.com · last read 2026-10-12
Identity
| Legal entity | New Relic, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 549300AB8FY2HQILL804 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | newrelic.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | docs.newrelic.com | 2026-10-08 |
EU: The customer can choose the EU region when creating an organization at signup; the default is the US region. No plan is named as a requirement. The document says only that "Costs for data ingest may vary depending on your data center region" and refers to the pricing page. It does not state a specific uplift.
Subprocessor chain
18 third parties · 13 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Atlassian/Jira | US | Management of customer support tickets |
| AWS | — | Data storage and diagnostics |
| AWS | US | Data storage and diagnostics (for CodeStream customers) |
| CloudFlare | — | Traffic routing, TLS Termination and security services |
| EzProtect (Adaptus) | US | Cybersecurity solution scanning content uploaded or sent to New Relic to ensure it is not malicious |
| Fastly | — | Traffic routing & TLS Termination |
| Fivetran | US | Connector and extract, transform and load (ETL) services |
| Google Cloud Platform | — | Data storage and diagnostics |
| Google Cloud Platform | — | Data storage and diagnostics (for Pixie customers) |
| Kentik | US | Network Synthetic monitoring |
| Microsoft Azure | US | Cloud computing, storage, and related services |
| Pinecone.io | US | Vector database providing vector storage, search, matching, and document retrieval for New Relic's AI-assisted services |
| PubNub | US | Real-time messaging between the CodeStream client extensions and Cloudstream's API service in the cloud |
| Salesforce Service Cloud | US | Management of customer support tickets |
| Sendgrid | US | Email messaging services |
| Sendgrid | US | Emails messaging services (for CodeStream customers) |
| Snowflake | US | Data warehouse services |
| Zendesk | US | Management of customer support tickets |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · newrelic.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | 21 days' prior notice of new core third-party sub-processors, provided customer signs up for notifications at the New Relic sign-up URL |
| Notice of new subprocessors | For non-core sub-processors tied to optional new features the customer must deliberately enable: notice given at the same time as the feature announcement |
| Notice of new subprocessors | Prior notice of Sub-Processor changes under SCC Clause 9 Option 2; period set out in Section 9.2 of the Addendum (not stated in this part) |
| If you object to one | Customer may send a reasonable written objection within 10 business days of notice; if it does not, the new sub-processor counts as approved |
| If you object to one | New Relic uses reasonable efforts to offer a change that avoids the sub-processor; if none within a reasonable period (max 45 days), customer may terminate the affected order |
| Breach notification | without undue delay after becoming aware of a Personal Data Breach |
| Audit | Customer may audit once annually, on its own behalf or at a supervisory authority's direction; New Relic provides its third-party certifications and audits, to Customer or a non-competitor independent auditor |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| FedRAMP | Claimed | — | docs.newrelic.com | 2026-10-08 |
| HIPAA enabled capabilities · HIPAA | Claimed | — | docs.newrelic.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | — | docs.newrelic.com | 2026-10-08 |
| ISO 42001 · ISO42001 | Claimed | — | docs.newrelic.com | 2026-10-08 |
| PCI DSS · PCIDSS | Claimed | — | docs.newrelic.com | 2026-10-08 |
| SOC 1 · SOC1 | Claimed | — | docs.newrelic.com | 2026-10-08 |
| SOC 2 · SOC2 | Claimed | — | docs.newrelic.com | 2026-10-08 |
| TISAX | Claimed | — | docs.newrelic.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · New Relic | Active | non-HR data | 2027-08-12 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · New Relic | Active | non-HR data | 2027-08-12 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · New Relic | Active | non-HR data | 2027-08-12 | 2026-10-09 |
| FedRAMP Marketplace (US) | New Relic · New Relic | FedRAMP Authorized | Moderate | — | 2026-10-09 |
| Global LEI Index (GLEIF) | NEW RELIC, INC. · NEW RELIC, INC. | ISSUED | US-DE | 2026-12-19 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under New Relic; New Relic, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under New Relic; New Relic, Inc.
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under New Relic; New Relic, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under New Relic; New Relic, Inc.
- FedRAMP Marketplace (US): checked 2026-10-12, 1 entry under New Relic; New Relic, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under New Relic; New Relic, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Java agent v9.5.0 | 2027-09-25 | Declared | unknown | docs.newrelic.com | 2026-10-11 |
| New Relic distributed software | 12 months | Declared | unknown | docs.newrelic.com | 2026-10-11 |
Vulnerability reporting: hackerone.com (security.txt, no Expires field; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| lifecycle-2 | Public | full | 200 | 2026-10-11 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.