Telegram
Messaging · telegram.org · last read 2026-11-09
At a glance
- Is Telegram GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Telegram itself publishes, each answer linked to its source and the date we read it.
- Does Telegram offer EU data residency?
- The EU is the default region for this vendor. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Telegram Messenger Inc. |
|---|---|
| HQ | VG |
| Parent company | Telegram Group Inc. |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | telegram.org · 2026-11-09 |
Telegram data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | telegram.org | 2026-11-09 |
EU: Users who sign up for Telegram from the EEA have their data stored in data centers in the Netherlands automatically; the document names no plan, opt-in or extra cost.
The same question for every vendor: where SaaS vendors store EU data.
Subprocessor chain
Processing terms
No data processing agreement read yet.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
No certification claims transcribed yet.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Telegram; Telegram Messenger Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Telegram; Telegram Messenger Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Telegram; Telegram Messenger Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Telegram; Telegram Messenger Inc.
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under Telegram; Telegram Messenger Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Telegram; Telegram Messenger Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: the well-known path returns an HTML page, not a security.txt (read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| residency | Public | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.