Trust Center

Security, privacy, and compliance at Elium

Request documentsContact our security team

Controls

Security controls & practices

View all controls (62)

Sub-processors

Every provider that touches customer data, and what they do

View all sub-processors (22)

  • Google Cloud Platform

    Default cloud hosting for the Elium application – compute and storage running in Google Cloud's Belgium region, with redundancy across European data centres.

    EU

  • Aiven

    Managed database hosting for the default deployment, running on Google Cloud's Belgium region.

    EU

  • 3DS Outscale

    Sovereign French cloud (SecNumCloud-qualified) hosting application, database, and storage for customers on the GOLD plan.

    EU

  • SparkPost

    Inbound and outbound email for the platform. Messages are processed in the Belgium region before delivery to the recipient.

    EU

  • Mixpanel

    Product analytics on platform usage to improve UX. Events stored in Mixpanel's Netherlands region.

    EU

  • Datadog

    Centralised application logs for incident investigation. Hosted in Datadog's Germany region.

    EU

Updates

Security advisories and Trust Center changes

All updates
  • Update

    CyberVadis assessment renewed – 858/1000

  • Update

    Trust Center launched

  • Update

    EcoVadis Silver – top 15% of rated companies

FAQ

Common questions about security and data

By default, in the European Union. SecNumCloud customers run on sovereign French infrastructure. On-premise customers host inside their own environment. Hosting region is set per tenant – never mixed.
No. Customer content is never used to train or fine-tune models – ours or our providers'. Generative-AI calls run with zero data retention contractually enforced with every LLM provider.
Only a small, named group of engineers, on a strict need-to-have basis. Production access requires SSO + MFA + just-in-time approval and is fully audit-logged. Customers can request the access log on demand.
Request the DPA in the Resources section above. We aim to counter-sign within five working days. Custom redlines are reviewed by our DPO.
Through the Updates feed on this page. Subscribe via email and we'll notify you when a new advisory or sub-processor change is published.

Have a security or compliance question?

See it on your own knowledge.

Our security team handles vendor reviews, RFPs, audits, and architecture questions every week. Reach out – we answer fast.

Email security teamRequest demo