Your telemetry says a lot about your business. Here you can find out how Elven protects that data, which controls we adopt, with whom we share information and how to reach our security team.
In transit and at rest, with credentials kept in a password vault.
Each client with its own logical environment, or the entire platform in your cloud.
Appointed data protection officer and specialized legal advisory in privacy.
Public status page and an always up-to-date list of subprocessors.
The commitments we make to clients, in writing and accessible to anyone.
Objectives, controls, training, backup and incident response.
Read policy →Which personal data we process, for what purpose and on what legal basis.
Read policy →Companies that process data on our behalf, their purpose and country.
View list →The conditions for using the Elven Platform.
Read terms →Security handled in a structured way: people, technology and processes.
For teams with stricter regulatory requirements, Elven also runs inside your perimeter.
Each client has an isolated logical environment, with independent quotas, storage and access. Elven operates the infrastructure, the updates and the availability.
Deploy Elven 100% inside your own cloud account or on-premises, managed by our team. This is the recommended model for those who need to meet LGPD, PCI, SOC 2, HIPAA or ISO 27001 requirements with full control over their data.
Elven protects the platform. Some practices, however, only work on the user's side.
We only engage suppliers with security standards compatible with the LGPD, and we share only the minimum necessary to provide the service.
| Company | Purpose | Country |
|---|---|---|
| Amazon Web Services (AWS) | Elven Platform cloud infrastructure | United States |
| Microsoft Azure | Elven Platform cloud infrastructure | United States |
| Google Cloud Platform (GCP) | Elven Platform cloud infrastructure | United States |
| Oracle Cloud Infrastructure (OCI) | Elven Platform cloud infrastructure | United States |
| Magalu Cloud | Elven Platform cloud infrastructure | Brazil |
| Atlassian | Ticket management and ITSM for client support | United States |
| Microsoft 365 | Corporate email and collaboration | Brazil |
| Twilio | Notifications via SMS, WhatsApp and phone calls | United States |
| SendGrid | Elven Platform transactional emails | United States |
| Unleash | Elven Platform feature flags | United States |
Official version and update history in the List of Subprocessors.
Yes. Data is encrypted in transit and at rest, and credentials are kept in a password vault with restricted access. Details in the Information Security Policy.
On cloud providers that comply with the LGPD and the GDPR, such as AWS, Azure, Google Cloud, Oracle Cloud and Magalu Cloud, a Brazilian cloud. The complete, up-to-date list is in Subprocessors. To keep data within your own perimeter, there is the self-hosted model.
Yes. In the self-hosted (BYOC) model, the platform is deployed 100% in your cloud account or on-premises and managed by our team. Telemetry data does not leave your environment.
The Elven Platform offers role-based access control (RBAC) with granular permissions, Single Sign-On (SSO) and audit logs.
No. When our team works in your environment, data is processed only within your infrastructure and is not transferred, saved or stored by Elven. We also follow your company's confidentiality terms and information security policies.
Data is stored while the account is active and is deleted after closure, except when the law requires retention, for example for legal obligations or the regular exercise of rights.
If there is a security incident that may cause relevant risk or harm, the affected clients are notified in accordance with the law and the contract. Platform availability is tracked in real time on the status page.
Yes. If your vendor approval process requires a questionnaire, risk assessment or additional documentation, write to contato@elven.works and our team will follow up.
Incidents, vulnerabilities and questions about personal data go straight to our Data Protection Officer (DPO).
fabricio.lopes@elven.worksTalk to our team to clear up security and compliance questions during your evaluation or vendor approval.
contato@elven.worksDate of last update: October 1, 2026.
