The shortener your DPO won't push back on.
You measure DSAR turnaround, SOC 2 evidence freshness, and how many vendor questions a sales cycle costs. Elido is the shortener your DPO won't push back on.
- EU-default region for every workspace
- Audit log append-only and hash-chained in the application
- 13 sub-processors, all listed publicly with location + purpose
- DSAR API with 30-day SLA (5-day expedited on Business)
- EU regioneu · primary originEU residency · default
Primary database, analytics store and backups are hosted here (Hetzner, Germany and Finland).
- US Eastus-east · redirect edgeEdge node
Redirect node in Ashburn. Processes visitor requests and IP addresses; no per-workspace region selection.
- Asia-Pacificapac · redirect edgeEdge node
Redirect node in Singapore. Processes visitor requests and IP addresses; no per-workspace region selection.
Append-only audit log
Every state change. Actor, IP, before/after diff, source.
The application only ever appends to the audit table and each entry is hash-chained to the previous one, so tampering is detectable. This is application-level, not a database permission restriction. Retention is 730 days by default and configurable per workspace.
- Actor identityUser ID or service principal, plus source IP and request ID
- Before/after diffStructured JSON diff of the changed row - not just a text log line
- SIEM firehoseHMAC-signed webhook to Splunk / Datadog / ELK in real time
- Tamper-evidentHash-chained entries with a chain-verification endpoint
{ "domain": "go.acme.eu",- "status": "pending_dns",+ "status": "verified",- "tls_mode": "none",+ "tls_mode": "on_demand",+ "verified_at": "2026-05-08T11:42:18Z", "workspace_id": "ws_8a2f" }Data subject access requests
DSAR, not support ticket. API call, signed bundle, SLA clock.
You receive a subject request from your end user. You forward it via the dashboard or API as a controller-on-behalf-of-subject request - Elido authenticates the controller (you), not the subject. The bundle is a signed zip: identity record, links, audit-log entries where the subject is the actor, billing receipts if the subject is a workspace owner. Standard SLA is 30 days; Business expedited returns inside 5 business days.
- Step 1
Subject request
End user → controller (you)Subject contacts you. You authenticate them in your own product, not in Elido.
- Step 2
DSAR API call
POST /v1/dsarForward as a controller-on-behalf request with subject email + request type (export / erase).
- Step 3
Workspace bundle
signed zip · JSON + CSVIdentity, links, audit-log entries where subject is actor, billing if owner, anonymised click metadata.
- Step 4
SLA
30 days · 5 days expeditedStandard SLA on every plan; Business expedited tier returns inside 5 business days.
Thirteen sub-processors, listed publicly
Hosting, edge, backups, email, payments, chat, AI, SSO, CAPTCHA, URL checks. Thirteen vendors. That's the list.
The full list with vendor location, processing purpose, data categories, and DPA reference URL lives at /legal/subprocessors. Adding or replacing a sub-processor triggers a 30-day notice to every workspace admin via in-app banner and email before processing begins, so customers can object.
- Compute & hostingISO 27001Primary app + edge infrastructureEU · Germany + Finland
- Edge computeISO 27001 · SOC 2Redirect edge nodesUS + APAC
- Email deliverySOC 2 Type IITransactional emailEU (opt-out for EU-only)
- PaymentsPCI DSS L1Card acquiringEU
- CDN + WAFISO 27001 · SOC 2Marketing proxy (not redirect path)Global · EU routing
What you can put on the procurement deck
- EU-default region for every workspace
- Audit log append-only and hash-chained in the application
- 13 sub-processors, all listed publicly with location + purpose
- DSAR API with 30-day SLA (5-day expedited on Business)
- SOC 2 in preparation, ISO 27001 not certified
- HIPAA-ready BAA on Business+ with safeguards already wired
What 'compliance' looks like in product
Most shorteners answer compliance questions with a one-pager and a vendor questionnaire. The features below are what's actually wired in code, not promises in a procurement deck.
EU-hosted primary data
The primary database, analytics store, link metadata and backups are hosted in the EU (Hetzner, Germany and Finland). Our redirect network also runs in Hetzner Ashburn (US) and OVH Singapore, so visitor requests, IP addresses, user agents and referrers are processed there, and those nodes may hold cached or replicated copies of link data. Per-workspace region selection is not available yet: every workspace is served from the same infrastructure. Backups are encrypted before upload.
Append-only log of every state change
Workspace settings, API key issuance and rotation, member invites and role changes, custom-domain claims, branding edits, billing-plan changes, and link create / update / delete - every state-changing mutation lands in the audit log with actor, UTC timestamp, before/after JSON diff, source IP, and request ID. Retention is 730 days by default and configurable per workspace. Events can be streamed to a SIEM (Splunk, Datadog, ELK) via signed webhook. The application only appends to the audit table and each entry is hash-chained to the previous one, so tampering is detectable with a verification endpoint. This is application-level, not a database permission restriction.
Thirteen vendors, all listed publicly
We use thirteen sub-processors and the list is published in full: hosting and database (EU - Germany + Finland, plus a US edge node), redirect edge (US and Singapore), encrypted backups, transactional email, payments (Paddle outside Ukraine, monobank in Ukraine), live chat, AI features, enterprise SSO, CAPTCHA and DNS/proxy, URL reputation checks and an offline geolocation dataset. The full named list with vendor location and processing purpose lives at /legal/subprocessors. Adding or replacing a sub-processor triggers a 30-day notice to every workspace admin via in-app banner and email before processing begins, so customers can object.
Export and erase via API, not a support ticket
The DSAR API returns a per-subject bundle as JSON plus CSV in a signed zip: identity record, the subject's links, audit-log entries where the subject is the actor, and billing receipts and plan history for workspace owners. An erasure request anonymises the account record (email and name), ends sessions and removes the login identity; billing records are kept where the law requires. Click events recorded about short-link visitors (including IP addresses) are not yet included automatically; send us the short link and we handle it case by case. Standard response time is 30 days.
SOC 2 in preparation, HIPAA-ready
SOC 2 is in preparation: no audit report has been issued and we do not claim certification. ISO 27001 is not certified. The control set we are preparing includes access reviews, change-management tickets, vulnerability-scan cadence, incident drills and vendor-risk reviews. HIPAA-ready on Business+ means we sign a BAA covering Elido as a business associate, with the safeguards wired: encryption at rest and in transit, the append-only audit trail, RBAC, scoped API keys, and a documented 72-hour breach-notification procedure. HIPAA itself is industry self-attestation - the BAA plus safeguards are what auditors ask for. Posture changes show in /changelog the day they ship.
Stack you'll evidence
- EU residency
- GDPR DPA
- SOC 2 (in preparation)
- ISO 27001 (planned)
- Audit log + SIEM firehose
- DSAR API
What your DPO measures
- Sub-processor count
- 13, listed publicly
- DSAR response
- Under 30 days
- Audit log retention
- 730 days default
What changes when compliance is the buyer
If your DPO is reviewing the vendor, these are the questions they'll ask. Honest answers across three options.
Common questions from procurement
Where exactly is our data stored?
The EU for the primary database, analytics store, link metadata and backups. Redirect nodes also run in the US (Ashburn) and Singapore and process visitor requests there. Per-workspace region selection is not available yet.
Are you in scope for SOC 2 / ISO 27001?
SOC 2 is in preparation and no report has been issued. ISO 27001 is not certified. We do not claim either. The Trust Center at /trust tracks the current state.
Do you sign a DPA?
Available on request from [email protected]; EU SCCs are included. The DPA references our sub-processor list at /legal/subprocessors as a living document; sub-processor changes give 30 days customer notice. If you need redlines, contact us.
How many sub-processors are involved?
Thirteen, not all of them in the EU: hosting and database (Hetzner, DE/FI, plus a US edge node in Ashburn), redirect edge (OVH, Singapore), encrypted backups (Backblaze), transactional email, payments (Paddle outside Ukraine, monobank in Ukraine, Coinbase Commerce only if enabled), live chat, AI features, enterprise SSO, CAPTCHA and DNS/proxy, URL reputation checks and an offline geolocation dataset. The full named list with location and purpose for each is at /legal/subprocessors. Adding a sub-processor triggers a 30-day customer notice.
Can we BYO HSM / KMS for encryption keys?
Not on the multi-tenant SaaS: customer-managed keys are not available yet. Database backups are encrypted before they leave our servers. Self-hosting is available by contract (Enterprise); contact [email protected].
What's the breach notification SLA?
Confirmed personal-data breaches: 24 hours customer notification, 72 hours regulator notification (GDPR Art. 33). Notification covers what we know at that point; we don't wait for full forensics. Process is in our Trust Center at /trust/incident-response.
Do you fulfill DSARs from end users (data subjects), not just from us as the customer?
We act on instructions from the controller (you, the customer). End users contact you; you forward the request via the dashboard or API and we fulfil. We don't directly accept DSARs from end users because we'd have no way to authenticate them as a subject of your workspace - that auth is yours.
Can the audit log be tampered with by an Elido admin?
Not through the product. The application only appends to the audit table and each entry is hash-chained to the previous one, so tampering is detectable with the verification endpoint. This is application-level, not a database permission restriction: someone with direct database access could still alter rows, but the chain would no longer verify. Deletion past the retention window (730 days by default) is automated and logs a 'retention purge' meta-event.
Do you have a public security.txt / coordinated-disclosure policy?
Yes - security.txt at /.well-known/security.txt; coordinated disclosure policy at /trust/disclosure. Report vulnerabilities to [email protected]. A paid HackerOne bug bounty is being set up and is not live yet.
What happens at contract end? How do we get our data out?
Full data export at any time via the API or a one-off support request. JSON + CSV bundle covering links, click events (raw or aggregated, your choice), audit log, members, settings, branding. After contract end we hold for 30 days for accidental-cancellation recovery, then hard-purge from primary, replicas, and backups. We can issue a written purge confirmation if your DPA requires one.
DPO's reading list
Sub-processors, DPA, security.txt - the public version of every claim on this page.
GDPR DPA available on request. Standard EU SCCs included.
Thirteen vendors, public list with location and purpose per row.
Encryption, access control, vulnerability disclosure, incident response timelines.
WorkOS-managed SAML / OIDC + SCIM directory sync; deprovisioning within minutes.
DSAR endpoints, audit log streaming, scoped API keys - typed across TS / Py / Go.
Not sure which angle fits?
Most teams start as one and grow into all four. Our sales team can walk through your specific stack in 20 minutes.