Third Party Index

Elasticsearch

elastic.co

Transparency

Exemplary

Breakdown
Subprocessor list30 / 30
Processing locations8 / 8
Purposes7 / 7
Data processing addendum12 / 12
Trust center8 / 8
Privacy policy6 / 6
security.txtnot found0 / 6
Security page5 / 5
Status page5 / 5
Vulnerability disclosurenot found0 / 5
Pages still reachable8 / 8
Total89 / 100

Only documents we can retrieve count: a page behind a login or a broken link scores nothing.

Badge

Elasticsearch transparency rating

For Elasticsearch's own site; it updates with the rating.

<a href="https://thirdpartyindex.com/vendors/elasticsearch"><img src="https://thirdpartyindex.com/badge/elasticsearch.svg" alt="Elasticsearch transparency rating on Third Party Index" height="20"></a>
[![Elasticsearch transparency rating on Third Party Index](https://thirdpartyindex.com/badge/elasticsearch.svg)](https://thirdpartyindex.com/vendors/elasticsearch)

Compliance

FedRAMP
  • Elastic Cloud Authorized Moderate · 8 agency authorizations · since Jul 22, 2020

FedRAMP status from the FedRAMP Marketplace (evidence)

Documents

DocumentVerifiedChangedEvidence
Trust center snapshot
Subprocessor list snapshot
Data processing addendum snapshot
Privacy policy snapshot
Terms snapshot
Security page snapshot
Status page statuspage snapshot

Subprocessors

17 third parties. CSV · Atom

NamePurposeLocationListed since
Amazon Web Services, Inc. Backup; Hosting (other than in Europe, the Middle East, and Africa); Hosting for https://support.elastic.co and the Elastic Uploader ServiceUnited States; selected by customer based on available regions supported by Elastic Cloud
Amazon Web Services EMEA SARL Hosting (in Europe, the Middle East, and Africa)selected by customer based on available regions supported by Elastic Cloud
Atlassian Statuspage Public status-page monitoring: https://status.jina.ai/To be confirmed
Cloudflare, Inc. CDN / edge proxy for Jina AI APIs and dashboardGlobal
Google LLC (GCP) Hosting and inference for embeddings, rerank, and related public API services(api.jina.ai); Hosting for EIS(Elastic Inference Service) executors on Jina GCP; Hosting for Jina AI Reader and Search (r.jina.ai, s.jina.ai)United States; United States and Belgium; United States, Belgium, and Singapore
Google Ireland Limited (GCP) Email correspondence with support via Gmail; HostingIreland; selected by customer based on available regions supported by Elastic Cloud
International Business Machines Corporation (IBM Cloud (Softlayer)) HostingUnited States
Microsoft Corporation (Azure) Hostingselected by customer based on available regions supported by Elastic Cloud
MongoDB, Inc. Caching layer and database for Jina ReaderUnited States and Belgium
Okta, Inc. Access authenticationUnited States
Salesforce.com, Inc. Customer support ticketing via Service CloudUnited States
Serper SERP API (Google Search) for Jina SearchUnited States and Singapore
Stripe, Inc. Payment processing for prepaid tokensUnited States
Supabase, Inc. Account, API key, and prepaid-wallet databaseUnited States
ThorData Residential proxy when Reader cannot fetch a URL directlyTo be confirmed
Tines Automation, Inc. Enterprise workflow automation based on alerts from the customer's Elastic Products (servicing customers in the US, Canada, and Mexico)United States
Tines Security Services Limited Enterprise workflow automation based on alerts from the customer's Elastic Products (servicing customers in all locations except the US, Canada, and Mexico)Ireland

Listed as a subprocessor by (49)

Purposes as each company states them.

Security record

What public security catalogs list for Elasticsearch, in their words.

Known exploited vulnerabilities

3 vulnerabilities in Elasticsearch's software that CISA lists as exploited in the wild.

CVEProductVulnerabilityListed
CVE-2014-3120ElasticsearchElasticsearch Remote Code Execution Vulnerability
CVE-2015-1427ElasticsearchElasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability
CVE-2019-7609KibanaKibana Arbitrary Code Execution

Source: CISA Known Exploited Vulnerabilities catalog (evidence)

Service status

major Ongoing since : Replication bug causing slow recoveries

BeganIncidentImpactLasted
Degraded Performance: Cloud Provisioning Delaysmajor1 h 58 min
AutoOps node metrics temporarily unavailable in some regionsmajor41 min
Elastic Support Portal unavailablemajor2 h 21 min
Delayed Metrics in Cloud Console - GCP us-east4major8 h 24 min
Kibana access restored for UI-assigned Organization Owners on Hosted deploymentsmajor21 h
Elastic Agent enrollment/check-in failures on 9.5.3 (and 9.4.6) with Fleet remote Elasticsearch outputmajor7 days
Elevated Error Rates for Specific Models Impacting Elastic Inference Service in EU Regionsmajor1 min
Issue impacting services running in GCP us-central1major4 h 47 min

As Elasticsearch's status page reports its own incidents (scheduled maintenance left out), read every few hours since (evidence)

Changes

  1. Changed subprocessor: Google LLC (GCP) locations: United States and Singapore → United States, United States and Belgium, United States, Belgium, and Singapore; purpose: Hosting for Jina AI Reader and other API services → Hosting and inference for embeddings, rerank, and related public API services(api.jina.ai), Hosting for EIS(Elast… evidence
  2. Changed subprocessor: MongoDB, Inc. purpose: Underlying caching layer and database for backend services for Jina Reader AI → Caching layer and database for Jina Reader evidence
  3. Changed subprocessor: Serper purpose: SERP API provider (Google Search) for Jina Reader AI → SERP API (Google Search) for Jina Search evidence
  4. Added subprocessor: Atlassian Statuspage evidence
  5. Added subprocessor: Cloudflare, Inc. evidence
  6. Added subprocessor: Stripe, Inc. evidence
  7. Added subprocessor: Supabase, Inc. evidence
  8. Added subprocessor: ThorData evidence