# Typesense

> Holds a search index in memory and answers queries on your own site or in your own application with typo tolerance, filters and facets, either run in-house or as a rented cluster.

- Vendor: Typesense, Inc., Delaware, with an office in Sugar Land, Texas (USA)
- Canonical URL: https://www.convios.com/en/toolbox/typesense
- Language version: https://www.convios.com/de/werkzeugkasten/typesense
- Area: Content & web · Cluster: search on your own site
- Role: Building block · Origin: Established, AI retrofitted
- As of: 2026-09-30 · Reviewed: 2026-09-30 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: On sites with many entries, visitors expect search that forgives typos and filters in a fraction of a second. A competitor can rent the same cluster at the same hourly price or run the same open-source software in-house, so search gives nobody an edge. Billing is by memory per hour, and queries don't appear on the invoice as a separate item.

## Suitability by company size

- Solo: suitable with caveats — For a static site with a few hundred entries, a search index produced at build time is enough, with no server at all. The smallest cluster costs 0.03 dollars an hour in Frankfurt, about 21.60 dollars a month, and pays off once filters, facets or continuous updates are needed.
- Mid-market: suitable — A highly available cluster with three nodes costs 0.12 dollars an hour in Frankfurt, about 86 dollars a month, with no charge per query. Sign-in via SAML costs nothing extra according to the vendor, and regions in the EU and Switzerland can be picked at setup.
- Enterprise: suitable with caveats — Procurement finds a public data processing agreement (Auftragsverarbeitungsvertrag) with standard contractual clauses and SAML sign-in at no extra charge. After evaluation, the SOC 2 report comes only with Business support at 400 dollars per 28 days for at least a year, security questionnaires from Enterprise at 700 dollars, and custom contract terms only from Enterprise Signature at 1,900 dollars. Delaware law applies with venue in Texas, and ISO 27001 certification is named nowhere.

## Vendor staying power

Established: The open-source search engine has been on the market since its first release in 2018, the hosted service since 2020, and the company is registered in Delaware. The sources checked show no funding round; by its own account the team is funded from customer revenue, and no audited figures are public. The latest release checked is 30.2 of 19.04.2026, 31.0 is available as a release candidate, and the incident history is public and dated. The source code is licensed under GPL-3.0 and can be run without the vendor.

- Company register entry in Delaware: TYPESENSE, INC., Delaware, file number 7577457, domestic corporation, registered agent Rocket Lawyer Corporate Services LLC. Plus an active branch registration in Texas at 14090 Southwest Freeway, Sugar Land, and one listed as inactive in California. (source: https://opencorporates.com/companies/us_de/7577457, as of 2026-09-30)
- Timeline and usage per the vendor: The company page gives 2015 as the start of the idea, 2018 for the first open-source release, 2020 for the launch of the hosted service, and one billion searches a month in 2023 and ten billion in 2024 on the hosted service. The team describes itself as lean and customer-funded. All figures come from the vendor, and no method of counting is stated. (source: https://typesense.org/about/, as of 2026-09-30)
- Release cadence and licence: The repository has existed since 18.01.2017 and is licensed under GPL-3.0. Major versions: 28.0 on 18.02.2025, 29.0 on 30.06.2025, 30.0 on 27.01.2026; latest release 30.2 on 19.04.2026; the price calculator offers 31.0 as a release candidate. As of 30.09.2026: 26,611 stars, 905 open issues. (source: https://github.com/typesense/typesense/releases, as of 2026-09-30)
- Distribution of code contributions: The contribution statistics show strong concentration: the most frequent contributor accounts for 2,657 commits, the second most frequent for 710. (source: https://github.com/typesense/typesense/graphs/contributors, as of 2026-09-30)
- Public incident history and retired regions: The status page lists 26 dated incidents from 17.05.2021 to 31.05.2026. On 1 and 2 March 2026, data centres in the UAE and Bahrain regions went down, by the vendor's account through drone strikes; on 04.08.2026 both regions were retired. The security page and the price calculator still list both regions as selectable on 30.09.2026. (source: https://cloud-status.typesense.org/history.rss, as of 2026-09-30)

## Cost of leaving

Low: The index is a copy: the data sits in your own database anyway and is merely pushed in. The same server runs in-house under GPL-3.0, so moving out of the cloud essentially changes the address. What is missing when switching to another search service are the schema, synonyms, curation rules, analytics rules and the filter syntax in your own code. Anyone who built the interface on the InstantSearch adapter mainly swaps the adapter.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | public, part of the terms of service without a signature — The data processing agreement is freely available as its own page and, per its opening paragraph, supplements the terms of service without any action by the customer. Roles, instructions, sub-processors with a ten-day objection period, and help with data subject rights and impact assessments are all covered. Two points fall short: security incidents are reported without undue delay but with no deadline in hours, and assistance the vendor considers onerous may be billed on time and materials. | evidenced | 2026-09-30 |
| Storage location | region selectable at setup, including Frankfurt, Zurich, Paris, Ireland, Milan, Spain and Stockholm; free choice when run in-house — The security page commits that data will not leave the chosen region and keeps operational snapshots in that same region. The price calculator suggests Frankfurt when accessed from Germany. The contract is drawn wider: section 9.1 of the data processing agreement permits processing in the United States or anywhere the vendor or its sub-processors maintain facilities. Anyone who connects an external embedding or language model sends the relevant text to that model's provider. | evidenced | 2026-09-30 |
| Subprocessors | public list with purpose, place of processing for 11 of 13 entries, undated, mostly services of the website and business operations — The data processing agreement points to a dedicated list, and it exists. It has 13 entries, of which only AWS, plus Rollbar and Uptime Robot for monitoring, directly concern running the clusters; Help Scout may also touch customer data through support requests. The other ten are Google Analytics, Google Fonts, reCAPTCHA, Tag Manager, the contact form, Stripe, Google Workspace, Help Scout, GitHub for sign-in and the project tool Clubhouse. The list is undated and still names Google Analytics as Universal Analytics and the project tool under its old name. For AWS it lists eleven countries with no mapping to the chosen region. How to subscribe to the change notices the contract mentions is stated on none of the pages checked. | partially evidenced | 2026-09-30 |
| Third-country transfer | standard contractual clauses 2021/914 modules two and three, UK addendum and Swiss adjustments, automatically part of the contract — Section 9.2 and appendix 3 of the data processing agreement incorporate the standard contractual clauses under implementing decision 2021/914, with Irish law and Irish courts; the Irish supervisory authority applies where competence is otherwise unclear. The UK addendum and the adjustments for Switzerland are covered. The EU-US Data Privacy Framework is not mentioned, so the basis rests on the clauses alone. The vendor itself is based in the United States even when the data sits in an EU region. | evidenced | 2026-09-30 |
| Training on customer data | no explicit statement; licence to customer data limited to providing the service — No sentence on model training appears in any of the documents checked. The terms of service grant the vendor a right to customer data only to provide the service and to exercise its rights and perform its obligations under the agreement; the vendor claims ownership of 'Aggregated Data' without defining the term; usage data, to which it retains all rights, expressly excludes customer data, and staff see indexed data only on a support request. Appendix 1 of the data processing agreement does, however, also list improving and enhancing the service as a purpose for processing personal data. According to the security page, built-in embedding models run on the nodes of your own cluster; with an external model, that model's provider decides on training. | partially evidenced | 2026-09-30 |
| Retention and deletion | deletion when the cluster is terminated, snapshots after three days; in the contract deletion or return with no deadline — The security page is more precise than the contract: operational snapshots are deleted after three days, terminating a cluster removes all associated data irrecoverably, and access and server logs are kept for 90 days. Section 10 of the data processing agreement only commits to deletion or return at the customer's option, with no deadline and subject to legal obligations. The audit trail of account and cluster actions is kept long-term according to the vendor, with no figure given. | partially evidenced | 2026-09-30 |
| Certifications | SOC 2 Type 2 and a HIPAA assessment per the vendor; report only from Business support with a term of at least one year — The vendor names a SOC 2 Type 2 audit by an unnamed auditor licensed by the AICPA, and a HIPAA assessment. Customers who buy Business support or above for at least a year receive the report; anyone still evaluating gets it against a verbal commitment to book such a tier. Section 8 of the data processing agreement likewise ties access to that tier, at most once a year. ISO 27001 certification is named nowhere. | partially evidenced | 2026-09-30 |
| EU AI Act, Article 50 | no statement on the AI Act; conversational search and embeddings available, labelling sits entirely in your own interface — Typesense ships built-in embedding models, natural language search and conversational search wired to a language model of your choice. The AI Act is named on none of the pages checked, neither the security page, the data processing agreement, the terms of service nor the privacy policy. Because Typesense works only through its API and the interface sits entirely with the operator, the operator can set the notices under Article 50 itself. | partially evidenced | 2026-09-30 |
| Audit logging | per-request access log always on, 90 days; audit trail of account and cluster actions; customer access and export not described — The security page describes precisely what is logged: per request the time, address, method and path, from version 31 the first four characters of the key, without search terms or content, for 90 days; plus a trail of who creates, changes or terminates clusters. Search terms reach the server log only when a search takes longer than 30 seconds, runs unusually long or uses unusual memory, the server crashes, or support turns on search logging while troubleshooting. What stays open is whether and how customers can view these logs themselves and export them into their own systems; they are described as logs the vendor keeps for operations, security and support. | partially evidenced | 2026-09-30 |

## Cost

- Entry: Licence-free under GPL-3.0 when run in-house. In the cloud, billed by the hour for a dedicated cluster: in Frankfurt 0.03 dollars an hour for 0.5 GB of memory with two vCPUs and one hour of burst a day, about 21.60 dollars a month; the calculator shows the first 720 hours as free. Highly available with three nodes, 0.12 dollars an hour, about 86.40 dollars a month. Outbound traffic costs 0.09 dollars per GB after 10 free GB. (as of 2026-09-30)
- Where it gets expensive: Memory is what gets expensive, because the whole index sits in memory and the bill grows with data volume and vector fields. 4 GB highly available costs 0.36 dollars an hour in Frankfurt, about 259 dollars a month. The second item is support: the SOC 2 report, payment by bank transfer and custom vendor forms come from Business at 400 dollars per 28 days, security questionnaires from Enterprise at 700 dollars, custom contract terms from Enterprise Signature at 1,900 dollars. Support is billed in 28-day cycles, so thirteen times a year.

## Three routes compared

### Algolia

Algolia bills by queries and records: on Grow, 10,000 queries and 100,000 records a month are free, after that 1,000 queries cost 0.50 dollars and 1,000 records 0.40 dollars, on Grow Plus 1,000 queries cost 1.75 dollars. Algolia offers personalisation, merchandising tools and ready-made interfaces; SSO sign-in and an enhanced service level are negotiated as a bundle on the Elevate plan. Typesense courts these customers openly and offers a year of Business support with migration consulting at no charge once monthly Algolia spend exceeds 2,000 dollars; the SOC 2 report, security questionnaires and custom contracts are excluded.

### Vectara

Vectara sells search as a platform for grounded answers with its own retrieval model and its own generative model, from 100,000 dollars a year as a hosted service and from 250,000 dollars in your own cloud environment. That is the price of a platform contract and, for a search box on a website, many times a highly available Typesense cluster. With Typesense you fill the index yourself and know every entry. Typesense covers the entry into the same direction itself, with embeddings on your own nodes and conversational search that calls a language model of your choice.

### An index at build time with Astro, or full-text search in Postgres on Neon

For static sites, Astro produces a search index at build time with a library such as Pagefind, stored as a file next to the pages on Cloudflare Pages, with no server and no contract, an estimated one to two person-days. For applications, Postgres on Neon brings full-text search and, with pgvector, vector search too, built with Claude Code and embeddings through LiteLLM; at a day rate of 1,200 euros and ten to fifteen person-days that is 12,000 to 18,000 euros. The third route is Typesense itself, run in-house. With millions of entries, relevance becomes the effort: typo tolerance, synonyms, weighting and facets take months of fine-tuning by our estimate. Add keeping the index in step with the source on every change, and on-call duty for a service that sits in front of every query.

Recommendation by size:

- Solo: On a static site an index at build time with no service at all is enough, otherwise the smallest cluster in Frankfurt.
- Mid-market: Buy: a highly available cluster with three nodes in an EU region, with memory worked out beforehand from data volume and vector fields.
- Enterprise: Buy or run it in-house. The SOC 2 report means planning for a year of Business support, and custom contract terms come only from Enterprise Signature or by running it yourself under GPL-3.0.

## Context

- Implements method: [Value Metric Pricing](https://www.convios.com/en/methods/value-metric-pricing) — Algolia bills per query, Typesense per hour of memory; the same search shows how the chosen value metric decides who carries the bill as usage grows.
- Implements method: [Four Forces of Progress (Jobs to be Done)](https://www.convios.com/en/methods/four-forces-of-progress) — The InstantSearch adapter lets you keep the existing interface when switching, and once monthly Algolia spend exceeds 2,000 dollars Typesense offers a year of Business support with migration consulting at no charge; both address switching anxiety.
- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — The data processing agreement is public, and SAML sign-in costs nothing extra. The SOC 2 report comes from Business support with a one-year term, and the test makes exactly this cost of evidence obligations visible.
- Alternative: [Astro](https://www.convios.com/en/toolbox/astro)
- Alternative: [Neon](https://www.convios.com/en/toolbox/neon)
- Displaces: Search through LIKE queries in the application database, An Algolia contract billed per query, A self-run Elasticsearch cluster for site search

## Evidence

- Prices per cluster hour, high availability, traffic, free hours, regions — https://cloud.typesense.org/pricing/calculator (as of 2026-09-30)
- Support tiers, prices per 28 days, SOC 2 report, security questionnaires, custom contracts — https://cloud.typesense.org/support-plans (as of 2026-09-30)
- Data processing agreement, standard contractual clauses, deletion, audit rights, places of processing — https://cloud.typesense.org/legal/dpa (as of 2026-09-30)
- Sub-processors with purpose and place of processing — https://cloud.typesense.org/legal/sub_processors (as of 2026-09-30)
- Data residency, logs and retention, snapshots, SAML at no extra cost, SOC 2 and HIPAA, embedding models — https://cloud.typesense.org/security (as of 2026-09-30)
- Licence to customer data, usage data, liability, governing law and venue — https://cloud.typesense.org/legal/terms (as of 2026-09-30)
- Controller and address, processing of website and account data — https://cloud.typesense.org/legal/privacy (as of 2026-09-30)
- Timeline, usage figures and funding per the vendor — https://typesense.org/about/ (as of 2026-09-30)
- Company register entry in Delaware and branch registrations — https://opencorporates.com/companies/us_de/7577457 (as of 2026-09-30)
- Versions, licence and contribution statistics — https://github.com/typesense/typesense/releases (as of 2026-09-30)
- Incident history and retired regions — https://cloud-status.typesense.org/history.rss (as of 2026-09-30)
- Prices and plans of the standard product Algolia — https://www.algolia.com/pricing (as of 2026-09-30)
- Prices of the AI-native counterpart Vectara — https://www.vectara.com/pricing (as of 2026-09-30)