Security & compliance

Built to pass your vendor due diligence

Banks and brokers across Europe already run Elbstream in production. Hosted in Germany, DORA-compliant, GDPR-compliant and without any personal data. And where your policies need something specific, we adapt to them.

Germany
hosting & data processing
DORA
compliant
GDPR
compliant, no personal data
99.99%
uptime

Hosted in Germany

Elbstream Data GmbH is a German company based in Hamburg. Our services run on infrastructure in Germany.

Data processing in Frankfurt
Service delivery and data processing take place in Frankfurt am Main, Germany.
Fast everywhere
Logos are additionally cached on a global CDN, with latency below 100 ms worldwide.

DORA-compliant

We meet the requirements of the Digital Operational Resilience Act (DORA) for ICT third-party service providers to financial institutions.

Transparent supply chain
Subcontractors and hosting regions are disclosed, and changes are announced in advance.
Incident support
A dedicated security contact and prompt notification of ICT incidents that affect the service.
Supervisory cooperation
We support your reporting duties and cooperate with supervisory authorities such as BaFin.
DORA addendum
Your DORA or outsourcing addendum can become part of our agreement.

GDPR-compliant

Our APIs deliver market data. They never need data about your customers.

No personal data
The APIs neither process nor store personal data. You never send us end-customer, account, payment or KYC data.
Encrypted access
All requests are encrypted with TLS.

Reliability & support

Service levels that fit customer-facing banking products, tailored to your requirements.

99.99% uptime
Availability that fits online banking and trading apps.
Responsive support
Direct access to the team that builds the data, in English and German.

Information security

Documented for your third-party risk assessment.

Vendor questionnaires
We complete your security questionnaire and provide evidence from our infrastructure providers.
Read-only APIs
Our APIs only deliver data. An outage never touches account, payment or compliance processes.

Licensing & data sources

Licences for customer-facing use and data you can trust.

Customer-facing licences
Display in online banking, apps and websites, including logos served from your own domain without attribution.
Curated data
Data from primary and public sources such as company announcements, exchanges and regulatory filings, curated by our team.

Your requirements, your templates

Every bank has its own outsourcing policy and risk assessment. We adapt to yours, from your DORA addendum and vendor questionnaire to your SLA levels and licence model.

  • DORA addendum
  • Data processing agreement
  • Tailored SLAs
  • NDA before evaluation
  • Vendor questionnaires
  • Direct or reseller licence
  • English or German

Send us your vendor questionnaire

Tell us what your procurement, security and compliance teams need. We answer questionnaires, sign your addenda and walk your team through our setup.

Frequently asked questions

In Germany. Service delivery and data processing take place in Frankfurt am Main. Logos are additionally cached on a global CDN.