Yes. Our standard DPA includes the EU SCCs. It is not yet downloadable or accepted at checkout: request a signed copy from dpa@elido.app. Custom redlines are available on Business and Enterprise.

Trust Center

Trust, written down.

Elido is EU-hosted by default, GDPR-friendly, and built with audit trails baked in. Below we separate what is in place today from what is planned or in progress, and label each.

Read the DPA [email protected]

SOC 2 Type II (in audit)

ISO 27001 (planned)

GDPR

HIPAA-aware (Business)

EU residency

Workspace region · planned

not available yet

EU regionEU
EU residency · default
Where the primary database, analytics store and backups live today, for every workspace.
US EastUS
Planned
Planned. Not implemented: workspaces cannot be pinned here today.
Asia-PacificAPAC
Planned
Planned. Not implemented: workspaces cannot be pinned here today.

Primary data in the EU; edge nodes in the US and Singapore cache and process requestsaudit · clicks · backups

Sub-processors, public list

730d

Default audit-log retention (configurable per workspace)

30d

Target response time for data-subject requests

Primary database, analytics and backups

What "trust" means in product terms

What we mean by trust

Each pillar maps to something concrete in the product, the DPA or the audit log.

EU residency, by default

Database, analytics and backups are hosted in the EU. Redirect nodes in the US (Ashburn) and Singapore process visitor requests. Per-workspace pinning to US East or Asia-Pacific is not available yet.

Audit trail on everything

Workspace settings, role changes, key rotations, link creates, deletions, exports. Every event has a who, when, and what - exportable.

Read-only by default for AI

AI integrations get scoped, rotatable keys. Write/delete access is an explicit, audited workspace setting - not a default.

Customer-managed keys (planned)

Bring-your-own-key encryption is not available yet. Database backups are encrypted before they leave our servers.

Anti-abuse pipeline

Every link runs through a composite scanner (URLhaus + Google Safe Browsing + heuristics) on create and again on a rolling re-scan worker.

Sub-processor transparency

Full list, location, and purpose. We commit to 30 days' notice of additions.

Append-only audit log

Every state change is recorded.

The application only ever appends to the audit table (there is no update path) and each entry is hash-chained to the previous one, so tampering is detectable with an admin verification endpoint. This is application-level, not a database permission restriction. Entries older than the retention window are purged daily: 730 days by default, configurable per workspace from 30 days (for example 6 years for HIPAA workspaces).

Actor identity
User ID or service principal, plus source IP and request ID
Before/after diff
Structured JSON diff of the changed row - not just a text log line
SIEM firehose
HMAC-signed webhook to Splunk / Datadog / ELK in real time
Tamper-evident
Hash-chained entries with a chain-verification endpoint

Security overview →

Audit entry · evt_8c41a7

domain.claim · ws_8a2f

Actor

[email protected]

Timestamp (UTC)

2026-05-08T11:42:18Z

Source IP

203.0.113.42 · DE

Source

dashboard · req_a4f9c1

  {    "domain": "go.acme.eu",-   "status": "pending_dns",+   "status": "verified",-   "tls_mode": "none",+   "tls_mode": "on_demand",+   "verified_at": "2026-05-08T11:42:18Z",    "workspace_id": "ws_8a2f"  }

Event type

domain.claim

Diff lines

+3 / -2

Retention

730 days default

Append-only in the application · hash-chainedStreamed to SIEM

Data subject access requests

Subject rights via API.

Send access and erasure requests to [email protected]; our team logs each one and tracks the 30-day deadline. There is no self-service or public API for data-subject requests yet. An access bundle is a zip of CSV files: account record, workspace memberships, owned workspaces, links, audit-log entries where the subject is the actor, and sessions. Erasure currently anonymises the account's email and name and ends sessions; click events (which include visitor IP addresses) are not yet exported or erased automatically. There is no expedited tier.

Step 1
Subject request
End user → controller (you)
Subject contacts you. You authenticate them in your own product, not in Elido.
Step 2
Request logged
[email protected]
Email the request with the account email and request type (export / erase); our team logs it and verifies identity.
Step 3
Workspace bundle
zip · CSV
Account, memberships, owned workspaces, links, audit-log entries where subject is actor, sessions. Click events are not included yet.
Step 4
SLA
30 days
GDPR one-month deadline, tracked for every request on every plan.

Read the DPA →Contact [email protected] →

Thirteen sub-processors, listed publicly

Thirteen vendors. Listed publicly.

The full list with vendor location, processing purpose, data categories, and DPA reference URL lives at /legal/subprocessors. Adding or replacing a sub-processor triggers a 30-day notice to every workspace admin via in-app banner and email before processing begins, so customers can object.

Sub-processor categories · workspace data flow

13 vendors · public list

Your workspace

ws_xxxx

Primary: EU

Compute & hostingISO 27001
Primary app + edge infrastructure
EU · Germany + Finland
Edge computeISO 27001 · SOC 2
Redirect nodes (receive visitor IP addresses)
US (Ashburn) + Singapore
Email delivery
Transactional email
EU + US
Payments
Card payments (Paddle outside Ukraine, monobank in Ukraine)
UK / EU / UA
CDN + WAFISO 27001 · SOC 2
DNS, proxy and CAPTCHA; live chat, AI, SSO and URL-reputation vendors are on the full list
Global · EU routing

Adding a vendor triggers a 30-day customer notice/legal/subprocessors

See the full sub-processor list →Security overview → architecture

Compliance posture

Where we stand on the frameworks customers ask about.

Each row says what is in place today and what is still in progress.

In progress

ISO 27001

Not certified. We are working towards ISO 27001; no certificate has been issued and no audit date is public.

In progress

SOC 2 Type II

Audit preparation in progress; the observation period is planned for late 2026 to 2027. No SOC 2 report has been issued yet.

Default

GDPR

DPA with standard SCCs available on request, public sub-processor list. Not every data flow is EU-only: see the privacy policy.

Available

HIPAA-ready

BAA available on Business+; audit logging and access controls are implemented. Legal terms are set in the BAA itself.

In progress

EU residency

Primary database, analytics and backups are in the EU. Redirect nodes in the US and Singapore process visitor requests, so transfers outside the EU do occur.

Default

Encryption

TLS in transit; encrypted off-site backups. BYOK is not available yet.

Compliance FAQ

The questions procurement keeps emailing us.

Do you sign a DPA?

Yes. Our standard DPA includes the EU SCCs. It is not yet downloadable or accepted at checkout: request a signed copy from [email protected]. Custom redlines are available on Business and Enterprise.

How many sub-processors do you use?

Thirteen, not all EU-based: hosting (EU and US), redirect edge (US, Singapore), backups, transactional email, payments (Paddle, monobank, optional Coinbase), live chat, AI, SSO, CAPTCHA/DNS, URL reputation and an offline geolocation dataset. The full named list with location and purpose is at /legal/subprocessors.

Is region pinning available on every plan?

Not yet. Every workspace is served from the same infrastructure (primary in the EU, redirect nodes also in the US and Singapore). Per-workspace pinning to US East or Asia-Pacific is planned, not implemented, and is not offered on any plan today.

What's the DSAR turnaround?

30 days on every plan (GDPR one month). Requests are sent to [email protected] and handled by our team; there is no expedited tier and no public API for requests yet. Access bundles are a zip of CSV files; click events are not yet included.

How do BAAs work for HIPAA?

BAA on Business+ only. Audit logging and access controls are the same as the default tier. Email [email protected] to start.

Is there a self-host option?

A Helm chart for Kubernetes exists in the repository. Licence terms and the supported self-hosting model are set per contract; contact [email protected] before relying on self-hosting.

How do you notify customers about sub-processor changes?

Adding or replacing a sub-processor triggers a 30-day notice via in-app banner and email to every workspace admin. Customers can object before processing begins. Changes are reflected on /legal/subprocessors.

Where do you publish incidents and uptime?

Live status, recent incidents, and full post-mortems at /status. Personal-data breaches are notified to affected customers as required by GDPR and the DPA.