Cloud Platform
Acquia Search powered by SearchStax Product Privacy Notice
Last revision of this Product Notice: [v1.1 – 20 May 2026 - Added AI-related details to Processing Operation(s)]
Prior version(s) of this Product Notice: [v1.0 – 21 January 2025]
This Product Notices describes the privacy relevant aspects of the above-mentioned Acquia product/services.
Acquia Search powered by SearchStax is a search service delivered as Software as a Service (SaaS) for Cloud Platform and Site Factory. This service empowers Drupal marketers to improve site search experiences with agile tools so that Drupal website visitors can find and discover relevant content faster. For details about this Product, please refer to the Product Description available online at https://docs.acquia.com/guide.
The objective of Processing of Personal Data by data importer is the performance of the Services pursuant to the Agreement.
* (n/a = not applicable) ** (optional; depends on the Customer’s application (glossary term, activate to view definition))
| Categories of Personal Data | Categories of Data Subjects | Purpose of Processing | Categories of Data | Recipients Needed for Core Features | Processing Location | Acquia Inc. acts as Processor |
|---|---|---|---|---|---|---|
| Regarding the use of the Service by the Customer: Through the configuration, design, and administration of their own application, Customer in its sole discretion determines and controls the categories of personal data indexed by Search. These may be individual identifiers, contact details, online identifiers, network activity, location data, and any sensitive data categories. | Through the configuration, design, and administration of their own Search application, Customer in its sole discretion determines and controls the categories of data subjects indexed by Search. Primarily, these would be Customer’s end-users, including visitors to Customer’s website. | Provision of the Services by Acquia to Customer | Customer administrators; visitors of Customer’s Drupal application | Yes | Depends on the data center location chosen by Customer. Disaster recovery backups stay in the selected region | No |
| Regarding the administration of the Service by Customer: Individual identifiers and contact details of Customer’s admins | Customer admins | Access to the Service’s configuration and management console | Customer admins | Yes | U.S. | Yes |
| Data log files by Customer Applications | Any data captured by Customer Applications of their website visitors | Provision and Administration of the Services | Customer admins | No | U.S. | Yes |
| Objective | Technology / Measure | Data at Rest | Data in Transit |
|---|---|---|---|
| Anonymization and Pseudonymization | Data anonymization at Customer level optional for Customer | ☒ | ☒ |
| Data confidentiality | Access control measures Encryption at customer level Encryption at Acquia level (see Security Annex and Product Description) | ☒ ☒ ☒ | ☒ ☒ ☒ |
| Data integrity | Anti-tampering technology (see Security Annex) | ☒ | ☒ |
| Data availability including restoring availability, restoring access to personal data, and data resilience | Business continuity and disaster recovery measures (see Security Annex) | ☒ | N/A |
| Regular testing, assessing and evaluating of TOMs | Regular security and process reviews (see also Security Annex) | ☒ | N/A |
For data processed by SearchStax, please refer to SearchStax’s data processing agreement for a description of its privacy enhancements, https://www.searchstax.com/legal/data-processing-addendum/.
SearchStax
Acquia
Through the Product’s administration console and through the Customer’s own Drupal application, the Customer may manage, update, retrieve, and erase individual Personal Data.
The retention of data in the Product is managed by the Customer and may be stored during the entire term of the Services. Latest 90 days after the end of the contractual term of the Services, Acquia will purge any customer data in the Services including personal data from its systems. Data retention for data processed via SearchStax is subject to SearchStax’s data retention policies.
The specific list of sub-processors is available from: www.acquia.com/about-us/legal/subprocessors Any current Acquia customer with a data processing agreement in place with Acquia may subscribe to receive notifications of new or changed sub-processors through the above website.
Data importer has implemented and will maintain appropriate administrative, physical, and technical safeguards for the protection of the security, confidentiality and integrity of Personal Data uploaded to the Services, as described in the Acquia Security Annex (available from https://www.acquia.com/about-us/legal/gdpr) applicable to the specific Services purchased by data exporter, as updated from time to time, and made available by data importer upon request. The data exporter is wholly responsible for implementing and maintaining security and data administration within any data exporter applications, configuration settings, or log settings used by data exporter in conjunction with the Services.
* (n/a = not applicable) ** (optional; depends on the Customer’s application (glossary term, activate to view definition))
| Categories of Personal Data | Categories of Data Subjects | Purpose of Processing | Categories of Data | Recipients Needed for Core Features | Processing Location | Acquia Inc. acts as Processor |
|---|---|---|---|---|---|---|
| Regarding the use of the Service by the Customer: Through the configuration, design, and administration of their own application, Customer in its sole discretion determines and controls the categories of personal data indexed by Search. These may be individual identifiers, contact details, online identifiers, network activity, location data, and any sensitive data categories. | Through the configuration, design, and administration of their own Search application, Customer in its sole discretion determines and controls the categories of data subjects indexed by Search. Primarily, these would be Customer’s end-users, including visitors to Customer’s website. | Provision of the Services by Acquia to Customer | Customer administrators; visitors of Customer’s Drupal application | Yes | Depends on the data center location chosen by Customer. Disaster recovery backups stay in the selected region | No |
| Regarding the administration of the Service by Customer: Individual identifiers and contact details of Customer’s admins | Customer admins | Access to the Service’s configuration and management console | Customer admins | Yes | U.S. | Yes |
| Data log files by Customer Applications | Any data captured by Customer Applications of their website visitors | Provision and Administration of the Services | Customer admins | No | U.S. | Yes |
| Objective | Technology / Measure | Data at Rest | Data in Transit |
|---|---|---|---|
| Anonymization and Pseudonymization | Data anonymization at Customer level optional for Customer | ☒ | ☒ |
| Data confidentiality | Access control measures Encryption at customer level Encryption at Acquia level (see Security Annex and Product Description) | ☒ ☒ ☒ | ☒ ☒ ☒ |
| Data integrity | Anti-tampering technology (see Security Annex) | ☒ | ☒ |
| Data availability including restoring availability, restoring access to personal data, and data resilience | Business continuity and disaster recovery measures (see Security Annex) | ☒ | N/A |
| Regular testing, assessing and evaluating of TOMs | Regular security and process reviews (see also Security Annex) | ☒ | N/A |
For data processed by SearchStax, please refer to SearchStax’s data processing agreement for a description of its privacy enhancements, https://www.searchstax.com/legal/data-processing-addendum/.
SearchStax
Acquia
Through the Product’s administration console and through the Customer’s own Drupal application, the Customer may manage, update, retrieve, and erase individual Personal Data.
The retention of data in the Product is managed by the Customer and may be stored during the entire term of the Services. Latest 90 days after the end of the contractual term of the Services, Acquia will purge any customer data in the Services including personal data from its systems. Data retention for data processed via SearchStax is subject to SearchStax’s data retention policies.
The specific list of sub-processors is available from: www.acquia.com/about-us/legal/subprocessors Any current Acquia customer with a data processing agreement in place with Acquia may subscribe to receive notifications of new or changed sub-processors through the above website.
Data importer has implemented and will maintain appropriate administrative, physical, and technical safeguards for the protection of the security, confidentiality and integrity of Personal Data uploaded to the Services, as described in the Acquia Security Annex (available from https://www.acquia.com/about-us/legal/gdpr) applicable to the specific Services purchased by data exporter, as updated from time to time, and made available by data importer upon request. The data exporter is wholly responsible for implementing and maintaining security and data administration within any data exporter applications, configuration settings, or log settings used by data exporter in conjunction with the Services.
If this content did not answer your questions, try searching or contacting our support team for further assistance.
If this content did not answer your questions, try searching or contacting our support team for further assistance.
Cloud Platform