Snapshot 22017
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust Center Security, privacy, and compliance at Elium Request documentsContact our security team Certifications Audited and certified ISO/IEC 27001:2022 SecNumCloud GDPR EU AI Act EcoVadis Silver Resources Documents on request View all documents (8) Elium AI: technical details ISO 27001 certificate Statement of Applicability (ISO 27002:2022) Penetration test report (2025) Penetration test report (2024) Cyber insurance certificate (2026) Data Processing Agreement List of third-party providers Controls Security controls & practices View all controls (62) Physical Security 1 topic European Data-centres View all controls (1) Network Security 4 topics Internet connections External access Network Isolation View all controls (4) Data Security 13 topics Protection against viruses & malware End-user authentication Connection to enterprise directory (SSO) View all controls (13) General Data Protection Regulation 5 topics Disclaimer Privacy Policy Data Processing Agreement View all controls (5) Quality & Service 7 topics Governance Incident management Post-incident review View all controls (7) Reversibility 4 topics Restitution of data Export format Data encryption View all controls (4) Backup & Recovery 5 topics Recovery Time Objective Infrastructure as Code Back-ups View all controls (5) Organisation Security 10 topics Certification Governance of security Information system security View all controls (10) Development Security 5 topics Protection against OWASP Top 10 Secure development lifecycle Protection of the source code View all controls (5) Operational Security 8 topics Infrastructure as Code Technical Documentation Service containers View all controls (8) Sub-processors Every provider that touches customer data, and what they do View all sub-processors (22) Google Cloud Platform Default cloud hosting for the Elium application: compute and storage running in Google Cloud’s Belgium region, with redundancy across European data centres. EU Aiven Managed database hosting for the default deployment, running on Google Cloud’s Belgium region. EU 3DS Outscale Sovereign French cloud (SecNumCloud-qualified) hosting application, database, and storage for customers on the Vault plan. EU SparkPost Inbound and outbound email for the platform. Messages are processed in the Belgium region before delivery to the recipient. EU Mixpanel Product analytics on platform usage to improve UX. Events stored in Mixpanel’s Netherlands region. EU Datadog Centralised application logs for incident investigation. Hosted in Datadog’s Germany region. EU Updates Security advisories and Trust Center changes All updates 18 May 2026 Update CyberVadis assessment renewed: 858/1000 7 May 2026 Update Trust Center launched 1 Mar 2025 Update EcoVadis Silver: top 15% of rated companies FAQ Common questions about security and data By default, in the European Union. SecNumCloud customers run on sovereign French infrastructure. On-premise customers host inside their own environment. Hosting region is set per tenant, never mixed. No. Customer content is never used to train or fine-tune models (ours or our providers’). Generative-AI calls run with zero data retention contractually enforced with every LLM provider. Only a small, named group of engineers, on a strict need-to-have basis. Production access requires SSO + MFA + just-in-time approval and is fully audit-logged. Customers can request the access log on demand. Request the DPA in the Resources section above. We aim to counter-sign within five working days. Custom redlines are reviewed by our DPO. Through the Updates feed on this page. Subscribe via email and we’ll notify you when a new advisory or sub-processor change is published. Have a security or compliance question? See it on your own knowledge. Our security team handles vendor reviews, RFPs, audits, and architecture questions every week. Reach out. We answer fast. Email security teamRequest demo