Layer 2 · Compare
The Public Grid
One row per assessed offering, one column per observation, across the whole population. A buyer looks up a supplier and reads what that supplier has published, in the same columns as everybody else. It is free, and it stays free.
Document Class: Segment Report
- Assessed
- 111 organisations, 147 offerings
- Evidence Cutoff
- 2026-07-29 to 2026-08-15 — per row, never one date for the register
- Method Generations
- v1.6 × 130 · v1.4 × 12 · v1.1 × 5
- Standards Commits
- 38 distinct, one recorded on every row
- Standard
- GLOBAL-Entity-Grid-Standard-v1.1.md
- Built
- 2026-08-15
Segment Scope
In: every offering whose fact record passed validation and carries the row class Observed — 147 rows across 111 organisations.
Out: 51 Variant rows, which are named in their own band below but carry no cells; and every Counterfactual row, which is internal and is never emitted at all.
On what basis: the row-class publication gate. A grid builder that simply iterated the source records would emit rows nobody measured — on the thirteen-entity pilot it produced nineteen rows for thirteen organisations, four of them fabricated, two of which made an organisation look better than its evidence supported. The gate is applied by the builder itself rather than inherited from the validator, because a consumer that trusts an upstream check is a consumer with no check.
What This Grid May Not Be Used For
It Is Not A Rating, A Score, A Grade Or A Ranking
Every cell is a publication state. There is no total, no average and no league position, and none may be computed from it. The rows are alphabetical for that reason, and no other ordering is offered.
It Is Not A Compliance Determination
Nothing here alleges that any organisation has breached any law. An Absent cell records that a document was not found on the public record at a stated date, by a stated method.
It Is Not A Substitute For The Deep Dive
The grid carries no limitations table, no right of reply and no evidence. A decision about a named supplier is taken on that supplier's own assessment. The grid's job is to tell a buyer which assessment to read.
No Cell May Be Quoted Without Its Date And Its Generation
A cell without its evidence cutoff and its method generation is not a fact, it is a claim. Both travel on every row here, and both are carried into the row's full reading.
How To Read A Cell
AdverseA finding on the public record.
PartialDisclosed, but incompletely.
StrongDisclosed and closed.
NeutralMeasured; the field does not apply.
Not MeasuredNever assessed. An unchecked field is not a clean one.
An Empty-Looking Answer Has Three Meanings, And They Never Render Alike
- Absent — measured; the organisation does not publish it. This is a finding.
- Never Asked — the method generation that produced the row never put the question. The cell names the generation, so a reader knows which rows compare with which. This is a fact about our coverage.
- Not Researched — the reference set does not cover the organisation on that question at all. This is a fact about the reference set.
A fourth answer is not an absence: Does Not Arise means the question was put and does not apply to the offering — there was never anything that could have been published. It bands Neutral and is a completed reading, not a gap.
Transfers147
Transfer Mechanisms
Mechanism Copy Obtainable
Third-Country Naming
Onward Destination Risk
Destination Set Conflict
| Organisation | Offering | Transfer Mechanisms | Mechanism Copy Obtainable | Third-Country Naming | Onward Destination Risk | Destination Set Conflict | As At | Reading |
|---|---|---|---|---|---|---|---|---|
| ADP | ADP | BCRSCCs | Yes | Countries Named | Open List — Cannot Exclude | Not Applicable | 2026-07-31v1.4 | |
| Airwallex | Airwallex Platform (Business Accounts, Payments, Spend, Billing, Platform APIs and Embedded Finance) | SCCsIDTA | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-10v1.6 | |
| Amazon Web Services | Amazon Web Services — global commercial cloud platform, including Bedrock, Q and SageMaker | DPFSCCs | Yes | Countries Named | Elevated State-Access Jurisdiction Named | No | 2026-08-13v1.6 | |
| Anthropic PBC | Claude Developer Platform / Claude for Work / Enterprise (API, Commercial Terms + DPA) | SCCs | Yes | Generic Transfer Language | Non-Adequate Destination Named | Not Measured Under Method v1.4Never Asked | 2026-08-06v1.4 | |
| Anthropic PBC | Claude.ai / Claude Free, Pro, and Max (Consumer) | AdequacySCCsDerogation | Yes | Countries Named | Non-Adequate Destination Named | Not Measured Under Method v1.4Never Asked | 2026-08-06v1.4 | |
| Asana | Asana work management platform (asana.com), default configuration with Asana AI enabled | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-11v1.6 | |
| Atlassian | Atlassian Cloud (Jira, Jira Service Management, Confluence, Bitbucket, Trello, Loom, Opsgenie, Statuspage, Compass, Jira Align, Jira Product Discovery, Atlassian Intelligence and Rovo) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-10v1.6 | |
| Auth0 | Auth0 Customer Identity Cloud (contracted, Master Subscription Agreement plus executed Data Processing Addendum) | DPFSCCs | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-07v1.6 | |
| beehiiv | beehiiv (newsletter and publishing platform, including beehiiv AI features) | SCCs | Yes | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-13v1.6 | |
| Black Kite | Black Kite Platform (hosted third-party cyber risk intelligence, blackkite.com) | DPFSCCsIDTAAdequacy | No | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-08v1.6 | |
| Box | Box (core content and collaboration platform, including Box AI) | DPFSCCsBCR | No | Generic Transfer Language | Non-Adequate Destination Named | Not Measured Under Method v1.6Never Asked | 2026-08-13v1.6 | |
| Calendly | Calendly (scheduling platform, Notetaker and hosted MCP server) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-11v1.6 | |
| Canva | Canva Platform — Free / Pro individual account | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-13v1.6 | |
| Cerebras | Cerebras Inference and Training-as-a-Service (cloud.cerebras.ai / inference.cerebras.ai / api.cerebras.ai) — Cerebras CS-3 on-premises hardware and software-for-hardware are a separate offering and are out of scope of this assessment | SCCs | Yes | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-13v1.6 | |
| CISO Adapt | CISO Adapt (Cyberensic Pty Ltd) | None Named | No | Generic Transfer Language | Open List — Cannot Exclude | Not Applicable | 2026-07-29v1.1 | |
| ClariDuty 365 | ClariDuty 365 | None Named | Not Applicable | Generic Transfer Language | Open List — Cannot Exclude | Not Applicable | 2026-08-13v1.6 | |
| Clay | Clay Platform (hosted, clay.com) — data enrichment, AI research agents and outbound workflow automation | SCCsAdequacyBCR | No | Countries Named | Elevated State-Access Jurisdiction Named | Yes | 2026-08-11v1.6 | |
| ClickUp | ClickUp hosted platform, including ClickUp Brain, Super Agents, Ambient Agents, AI Notetaker, Enterprise Search and the first-party MCP server | SCCsIDTA | Yes | Countries Named | Elevated State-Access Jurisdiction Named | Yes | 2026-08-10v1.6 | |
| Cloudflare | Cloudflare Platform (self-serve and Enterprise, cloudflare.com) | DPFSCCs | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-07v1.6 | |
| Comp AI | Comp AI Platform (compliance automation for SOC 2, ISO 27001, HIPAA and GDPR; includes a first-party MCP server) | DPFSCCsIDTA | No | Countries Named | Non-Adequate Destination Named | No | 2026-08-13v1.6 | |
| Confluent | Confluent Cloud | DPFSCCsIDTA | Yes | Countries Named | Elevated State-Access Jurisdiction Named | Yes | 2026-08-15v1.6 | |
| CoreWeave | CoreWeave Cloud Platform (GPU/AI infrastructure-as-a-service, inclusive of CoreWeave Inference and CoreWeave AI Object Storage; Weights & Biases MLOps operates under CoreWeave's own Privacy Policy following the completed acquisition) | SCCs | Yes | Countries Named | Non-Adequate Destination Named | Not Applicable | 2026-08-13v1.6 | |
| Databricks | Databricks Data Intelligence Platform (hosted Platform Services and Support Services, all supported clouds) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Datadog | Datadog (observability, security and Bits AI agent platform, datadoghq.com) | DPFSCCsAdequacy | Yes | Countries Named | Open List — Cannot Exclude | No | 2026-08-15v1.6 | |
| DataGrail | DataGrail Platform (hosted, app.datagrail.io) | SCCsDPF | No | Countries Named | Non-Adequate Destination Named | No | 2026-08-08v1.6 | |
| DeepSeek | DeepSeek chat app, web app, and Open Platform API (single global service, no regional or hosting variant published) | None Named | No | Generic Transfer Language | Elevated State-Access Jurisdiction Named | No | 2026-08-15v1.6 | |
| Deputy | Deputy Workforce Management Platform | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-07v1.6 | |
| Docusign | Docusign eSignature and the Intelligent Agreement Management platform (hosted, docusign.com), including the in-product AI features | BCRSCCsAdequacy | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Docusign | The Docusign MCP server (Open Beta, mcp.docusign.com) — 22 production tools served to an AI assistant the customer brings | BCRSCCsAdequacy | Yes | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-11v1.6 | |
| Dropbox | Dropbox Dash | DPFSCCsAdequacy | No | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Dropbox | Dropbox For Teams | DPFSCCsAdequacy | No | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| ElevenLabs | ElevenLabs Enterprise (Business/Processor Relationship, Custom Data Residency) | AdequacySCCsDPF | No | Countries Named | Non-Adequate Destination Named | Not Measured Under Method v1.6Never Asked | 2026-08-15v1.6 | |
| ElevenLabs | ElevenLabs Self-Serve (Free, Starter, Creator, Pro, Scale, Business — Individual/Non-Enterprise) | AdequacySCCsDPF | Yes | Countries Named | Non-Adequate Destination Named | Not Measured Under Method v1.6Never Asked | 2026-08-15v1.6 | |
| Employment Hero | Employment Hero Platform (Employment OS — HR, payroll, workforce management, AI Recruitment Agent, ATS, EH Work app, EH Jobs) | SCCsIDTAAdequacy | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Fathom | Fathom AI meeting assistant (web application, desktop and mobile applications, meeting recording bot, Fathom REST API, MCP server, webhooks and customer-configured CRM integrations) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-14v1.6 | |
| Ferrox Labs | Ferrox Labs Corporate Site | None Named | No | No Transfer Disclosure Found | Open List — Cannot Exclude | Not Applicable | 2026-08-03v1.4 | |
| Ferrox Labs | Flux Router (Ferrox Labs) | SCCs | No | No Transfer Disclosure Found | Open List — Cannot Exclude | Not Applicable | 2026-08-03v1.4 | |
| Ferrox Labs | Wayland (Ferrox Labs) | None Named | No | No Transfer Disclosure Found | Open List — Cannot Exclude | Not Applicable | 2026-08-03v1.4 | |
| Fillout | Fillout (forms, scheduling, workflows, AI form builder, Form Agent) and Zite app building — one platform operated by Restly, Inc. | SCCs | No | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-14v1.6 | |
| Fireflies.ai | Fireflies.ai Platform (meeting transcription and notes, Voice Agents, AI Skills, AI Assistant, Slack Assistant and public API) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-15v1.6 | |
| Fireworks AI | Fireworks AI Platform | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Fivetran | Fivetran SaaS data movement platform, including Fivetran Activations (formerly Census), Context Layer and Agent Context MCP (both Public Preview) | DPFSCCs | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Formstack | Formstack Forms, Documents, Sign and Workflows (including Forms for Salesforce and Documents for Salesforce), operated under a single Software Services Agreement, DPA and Privacy Policy by Intellistack, LLC (formerly Formstack, LLC); the same instruments and the same published sub-processor list also cover the Intellistack Streamline and Formsite product lines, confirmed on the same sub-processor table | DPFSCCs | Yes | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-15v1.6 | |
| GitHub | GitHub platform and GitHub Copilot, volume-licensed (Enterprise, Business, GitHub Customer Agreement) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-07v1.6 | |
| Google Cloud | Google Workspace and Google Cloud Platform (single Cloud DPA; also covers Cloud Identity, SecOps, Looker) — consumer products out of scope | DPFSCCs | Yes | Countries Named | Elevated State-Access Jurisdiction Named | Not Measured Under Method v1.6Never Asked | 2026-08-13v1.6 | |
| Groq | GroqCloud AI Inference Platform (console.groq.com / api.groq.com / GroqChat), including the Compound agentic system — Groq LPU hardware sales and on-premises/offline-terms deployments are a separate offering and out of scope of this assessment | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-15v1.6 | |
| Haast | Haast Compliance Platform (AI-powered marketing and communications compliance review, pre-publication content scanning, live digital-footprint monitoring, and regulatory horizon scanning) | None Named | No | No Transfer Disclosure Found | Open List — Cannot Exclude | Not Applicable | 2026-08-13v1.6 | |
| HighLevel | HighLevel Inc. | DPFSCCs | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-07-31v1.4 | |
| HubSpot | HubSpot CRM / Marketing / Sales / Service / Content / Operations Hubs (hosted, hubspot.com), including Clearbit-brand enrichment products and HubSpot AI features | DPFSCCs | Yes | Countries Named | Open List — Cannot Exclude | No | 2026-08-13v1.6 | |
| Intercom | Intercom customer service platform — default (United States) hosting, including Fin AI Agent, Fin Voice AI Agent, Copilot, the Intercom MCP server and Data Connectors | DPFSCCsIDTA | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| iubenda | iubenda Privacy & Cookie Policy Generator and surrounding legal/consent product suite (Privacy Controls and Cookie Solution, Consent Database, Data Subject Rights Management Tool, Whistleblowing Management Tool, Accessibility Widget) | DPFSCCsAdequacy | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-13v1.6 | |
| Jotform | Jotform (hosted form-builder platform, jotform.com) | SCCsDPFAdequacy | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-13v1.6 | |
| LinkedIn Platform — Individual Member (linkedin.com, core service) | SCCsDPFIDTA | Yes | Countries Named | Open List — Cannot Exclude | No | 2026-08-13v1.6 | ||
| Loom | Loom on the Atlassian platform (Loom AI available) | SCCsIDTADPF | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Lunary | Lunary Cloud (app.lunary.ai) | SCCs | No | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| Mailgun | Mailgun Platform (Sinch Email) — hosted API and dashboard, EU region selected | SCCsDPFIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Make | Make Cloud Platform (hosted, make.com) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-10v1.6 | |
| Microsoft | Microsoft Enterprise Cloud Services (Microsoft 365 incl. Copilot, Entra, Azure incl. Azure AI Foundry, Dynamics 365, Power Platform) — default configuration | DPFSCCs | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-15v1.6 | |
| MiniMax | MiniMax Open Platform (API) and consumer AI products, no plugin connector | DPFSCCs | No | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-15v1.6 | |
| Miro | Miro cloud platform (Free, Starter, Business and Enterprise plans, including Miro AI and the Miro MCP Server) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-14v1.6 | |
| Mistral AI | Mistral AI Studio / La Plateforme API (Commercial, Governed By Commercial Terms + DPA) | AdequacySCCs | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-15v1.6 | |
| Mistral AI | Mistral Vibe (Consumer/Prosumer Chat And Agent — Formerly Le Chat) | AdequacySCCs | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-15v1.6 | |
| monday.com | monday.com Work OS — Platform Services (work management, CRM, dev, service, WorkCanvas, WorkForms, monday code) | DPFSCCsIDTAAdequacy | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-10v1.6 | |
| MongoDB | MongoDB Atlas (hosted Cloud Services) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-11v1.6 | |
| Moonshot AI | Kimi consumer assistant (kimi.com and Kimi apps, operated by Beijing Moonshot Technology Co., Ltd.) | None Named | Not Applicable | Countries Named | Elevated State-Access Jurisdiction Named | No | 2026-08-15v1.6 | |
| Moonshot AI | Kimi Open Platform / API and Kimi Business enterprise cooperation, including the Kimi Code CLI agent tool (platform.kimi.ai, operated by Moonshot AI PTE. LTD., Singapore) | None Named | Not Applicable | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-15v1.6 | |
| Morph | Morph (AutoInfra, Inc.) | SCCsIDTABCR | No | Countries Named | Open List — Cannot Exclude | Not Applicable | 2026-07-31v1.4 | |
| MYOB | MYOB Acumatica (enterprise ERP) | None Named | No | No Transfer Disclosure Found | Open List — Cannot Exclude | Not Applicable | 2026-08-10v1.6 | |
| MYOB | MYOB Business (Lite, Pro, AccountRight, Payroll Only) | None Named | No | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-10v1.6 | |
| MYOB | MYOB Business API and Developer Program (third-party acting surface) | None Named | No | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-10v1.6 | |
| MYOB | MYOB Payment Services | None Named | No | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-10v1.6 | |
| n8n | n8n Cloud (hosted, app.n8n.cloud) | SCCsIDTADPFAdequacy | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-07v1.6 | |
| Notion | External Agents in Notion — Claude agents and Cursor agents | None Named | Not Applicable | No Transfer Disclosure Found | Open List — Cannot Exclude | Yes | 2026-08-10v1.6 | |
| Notion | Notion Calendar and Notion Mail | DPFSCCsIDTA | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-10v1.6 | |
| Notion | Notion workspace and Notion AI (hosted, notion.com / notion.so) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-10v1.6 | |
| Nous Research | Nous Research (Nous Research, Inc.) | None Named | No | No Transfer Disclosure Found | Open List — Cannot Exclude | Not Applicable | 2026-07-31v1.4 | |
| NVIDIA | NVIDIA AI Enterprise / DGX Cloud / Omniverse on DGX Cloud / NVIDIA Brev (enterprise AI infrastructure, governed by the NVIDIA Cloud Services Data Processing Addendum) | SCCsIDTADPF | Yes | Countries Named | Open List — Cannot Exclude | No | 2026-08-15v1.6 | |
| NVIDIA | NVIDIA Consumer Products And Services (nvidia.com account, GeForce Experience, GeForce NOW, NVIDIA App, SHIELD, on-site/in-app chatbots, event and marketing data) | DPFSCCs | No | Countries Named | Open List — Cannot Exclude | No | 2026-08-15v1.6 | |
| NVIDIA | NVIDIA Developer Program / NGC / API Catalog (build.nvidia.com trial and hosted NIM inference APIs, governed by the NVIDIA Technology Access Terms of Use and the NVIDIA API Trial Terms of Service) | DPFSCCs | No | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-15v1.6 | |
| Obsidian | Obsidian App — Local Vault Only | None Named | Not Applicable | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | Not Applicable | 2026-08-11v1.6 | |
| Obsidian | Obsidian Publish | None Named | No | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Obsidian | Obsidian Sync | None Named | No | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| Odoo | Odoo Cloud Platform — Odoo Online and Odoo.sh hosting of the Odoo Enterprise ERP/CRM/business-application suite (odoo.com), including the built-in Odoo AI application (Gemini/OpenAI-backed, Odoo 19). The separately-priced, credit-billed In-App Purchase (IAP) feature set (SMS, document digitization, partner autocomplete, legacy AI text tools) carries its own distinct privacy policy and subprocessor list and is flagged, not analysed, at §3.13 | SCCs | No | Countries Named | Non-Adequate Destination Named | No | 2026-08-15v1.6 | |
| Okta | Okta Customer Identity Cloud (Auth0), including the Fine-Grained Authorization, Breached Password Detection and Guide add-ons, on the public-cloud regions and the private-cloud region set | DPFSCCsIDTA | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-14v1.6 | |
| Okta | Okta Workforce Identity Cloud (including Identity Governance, Privileged Access, Advanced Server Access and Identity Security Posture Management) | DPFSCCsIDTA | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-14v1.6 | |
| Ollama | Ollama (Ollama Inc.) | None Named | No | Countries Named | Open List — Cannot Exclude | Yes | 2026-07-31v1.4 | |
| OneTrust | OneTrust LLC | DPFSCCs | Yes | Countries Named | Open List — Cannot Exclude | No | 2026-07-29v1.1 | |
| OpenAI | ChatGPT Free, Plus and Pro consumer tiers, governed by the European and global consumer privacy policies | SCCsIDTAAdequacy | Yes | Countries Named | Non-Adequate Destination Named | Not Measured Under Method v1.6Never Asked | 2026-08-13v1.6 | |
| OpenAI | OpenAI API, Business and Enterprise tiers, governed by the Customer Data Processing Addendum effective 1 January 2026 | SCCsIDTAAdequacy | Yes | Countries Named | Non-Adequate Destination Named | Not Measured Under Method v1.6Never Asked | 2026-08-13v1.6 | |
| OpenRouter | OpenRouter | SCCsAdequacyIDTA | Yes | Countries Named | Elevated State-Access Jurisdiction Named | Not Measured Under Method v1.4Never Asked | 2026-08-06v1.4 | |
| Oracle | Oracle Cloud Services (DPA estate) | BCRSCCsIDTADPF | Yes | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| Oracle | Oracle MCP and agentic surface | BCRSCCsIDTADPF | Yes | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| Oracle | oracle.com corporate and account surface | SCCsDPF | Not Applicable | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| PayPal | PayPal-branded wallet and checkout services, Braintree ("Unbranded Payment Services"), Fastlane, Hyperwallet, Xoom, and PayPal Point of Sale / Zettle, together with the PayPal MCP agent surface at mcp.paypal.com, all governed by PayPal's global Privacy Statement and by the parallel Payment/Card Processing Data Protection Addenda. Venmo is an Excluded Service under PayPal's own Privacy Statement and is out of scope for this report. | SCCsIDTABCR | Yes | Countries Named | Elevated State-Access Jurisdiction Named | No | 2026-08-13v1.6 | |
| Perplexity | Perplexity Enterprise and API offerings, governed by the Data Processing Addendum (DPA) last updated August 13, 2026 | SCCsIDTADPF | Yes | Countries Named | Closed List — Adequate Only | Not Measured Under Method v1.6Never Asked | 2026-08-15v1.6 | |
| Perplexity | Perplexity Free, Pro and Max consumer tiers, governed by the consumer Privacy Notice last updated July 8, 2026 | SCCsDPF | Yes | Countries Named | Open List — Cannot Exclude | Not Measured Under Method v1.6Never Asked | 2026-08-15v1.6 | |
| ProcessUnity | ProcessUnity Global Risk Exchange | SCCsIDTADerogation | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-08v1.6 | |
| ProcessUnity | ProcessUnity TPRM Platform | SCCsIDTADerogation | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-08v1.6 | |
| QuickBooks | QuickBooks Online (EN-ROW and European route) | SCCsDPF | Yes | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-10v1.6 | |
| QuickBooks | QuickBooks Online (United Kingdom route) | None Named | No | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-10v1.6 | |
| QuickBooks | QuickBooks Online (United States and Canada route) | SCCsDPFIDTA | Yes | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-10v1.6 | |
| QuickBooks | QuickBooks Online Payroll and QuickBooks Time (processor route) | DPFSCCs | Yes | Countries Named | Closed List — Adequate Only | Yes | 2026-08-10v1.6 | |
| Qwen | Qwen Chat / Qwen Studio — consumer and self-service AI chat and generation product | AdequacySCCs | Yes | Countries Named | Elevated State-Access Jurisdiction Named | Yes | 2026-08-15v1.6 | |
| Recall.ai | Recall.ai Platform (Meeting Bot API, Desktop and Mobile Recording SDKs, Calendar API, Output Media, MCP server) | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Reddit Advertising (Ads Manager, Business Tools, Custom Audiences) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-08-15v1.6 | ||
| Reddit consumer platform (reddit.com and Reddit apps, including Reddit Answers) | AdequacySCCsIDTADPF | No | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-15v1.6 | ||
| Reddit Developer Platform and Data API (Devvit, third-party apps, Data API licensees) | SCCsIDTA | Yes | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-15v1.6 | ||
| Relyance | Relyance Platform (relyance.ai) | DPF | No | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-08v1.6 | |
| Sakana AI | Sakana AI (Fugu) | None Named | No | Countries Named | Open List — Cannot Exclude | Not Applicable | 2026-07-29v1.1 | |
| Salesforce | Agentforce and the Einstein Generative AI Services | DPFSCCsIDTABCR | Yes | Countries Named | Open List — Cannot Exclude | No | 2026-08-11v1.6 | |
| Salesforce | Salesforce Services on Hyperforce | DPFSCCsIDTABCR | Yes | Countries Named | Open List — Cannot Exclude | No | 2026-08-11v1.6 | |
| SAP | SAP Cloud Services (global default configuration, including SAP Business AI and Joule) | SCCs | Yes | Generic Transfer Language | Elevated State-Access Jurisdiction Named | Yes | 2026-08-08v1.6 | |
| SecurityScorecard | SecurityScorecard (TITAN) | SCCs | No | Countries Named | Open List — Cannot Exclude | Yes | 2026-07-30v1.1 | |
| Sentry | Codecov (software test coverage reporting, about.codecov.io) | SCCsIDTA | Yes | Generic Transfer Language | Open List — Cannot Exclude | Not Applicable | 2026-08-11v1.6 | |
| Sentry | Sentry (application monitoring and error tracking, sentry.io) | DPFSCCsIDTAAdequacy | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| ServiceNow | ServiceNow AI Platform — general Subscription Service | SCCsIDTADPF | No | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-14v1.6 | |
| Slack | Slack (commercial cloud, slack.com, including Slack AI and Slackbot) | SCCsIDTABCRDPF | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-07v1.6 | |
| SmartSuite | SmartSuite Platform (hosted at smartsuite.com) — direct customer channel | SCCsIDTA | No | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-07v1.6 | |
| Snowflake | Snowflake AI Data Cloud, including Cortex AI Features | DPFSCCsIDTA | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| Softr Platforms GmbH | Softr No-Code Application Platform (hosted, softr.io) | AdequacySCCsDerogation | No | Countries Named | Elevated State-Access Jurisdiction Named | No | 2026-08-07v1.6 | |
| Stripe | Stripe hosted platform (payments, Connect, Identity, Terminal, Issuing, Atlas, Treasury) including the hosted MCP server at mcp.stripe.com | DPFSCCsIDTA | Yes | Countries Named | Elevated State-Access Jurisdiction Named | No | 2026-08-07v1.6 | |
| Supabase | Supabase Platform (hosted, supabase.com) | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-07v1.6 | |
| Tailscale | Tailscale Aperture (AI gateway, beta) | SCCsIDTA | Yes | Generic Transfer Language | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| Tailscale | Tailscale Solution (hosted coordination service and tailnet) | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| TaskUs | TaskUs BPO / AI Data Services (client-contracted) and the taskus.com corporate website | SCCsAdequacy | No | Generic Transfer Language | Open List — Cannot Exclude | No | 2026-08-13v1.6 | |
| Teamwork.com | Teamwork Desk — AI-powered features | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Teamwork.com | Teamwork.com Platform (projects, resource, Chat, Spaces, TeamworkAI, MCP server) | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| TikTok | TikTok Platform — EEA / UK / Switzerland User (TikTok Technology Limited and TikTok Information Technologies UK Limited, joint controllers) | SCCs | No | Countries Named | Elevated State-Access Jurisdiction Named | No | 2026-08-15v1.6 | |
| Trello | Trello Cloud, Standard and Premium Workspaces (AI activated by default) | SCCsIDTADPF | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-10v1.6 | |
| TrueFoundry | TrueFoundry (Ensemble Labs, Inc.) | None Named | No | No Transfer Disclosure Found | Open List — Cannot Exclude | Not Applicable | 2026-07-31v1.4 | |
| TrustArc | TrustArc Inc | DPFSCCs | Yes | Countries Named | Non-Adequate Destination Named | No | 2026-07-29v1.1 | |
| Twilio | Twilio platform (Programmable Messaging, Programmable Voice, Verify, Flex, Segment, Stytch and the AI/ML Features), contracted with Twilio Ireland Limited | DPFBCRSCCsIDTA | Yes | Countries Named | Elevated State-Access Jurisdiction Named | Yes | 2026-08-11v1.6 | |
| Whimsical | Whimsical (visual workspace: boards, docs, flowcharts, wireframes, mind maps, including Whimsical AI) | SCCsIDTA | Yes | Generic Transfer Language | Non-Adequate Destination Named | No | 2026-08-15v1.6 | |
| Whispir | Whispir Platform (hosted, whispir.com) | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-07v1.6 | |
| Whistic | Whistic TPRM AI Platform (hosted, whistic.com) including Whistic AI and the Whistic MCP Server (BETA) | None Named | Not Applicable | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-10v1.6 | |
| Wrike | Klaxoon, The Separately Activated Wrike Affiliate Brand | SCCs | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-14v1.6 | |
| Wrike | Wrike Work Management Platform, With Wrike AI And AI Agents | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-14v1.6 | |
| Xano | Xano Agents, MCP Builder, MCP Server and Developer MCP (customer-supplied credentials) | DPF | Yes | Countries Named | Open List — Cannot Exclude | Yes | 2026-08-11v1.6 | |
| Xano | Xano Platform (hosted backend), including the vendor-selected Xano AI features | DPF | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-11v1.6 | |
| Xero | Xero (hosted accounting platform, xero.com), including JAX | SCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-10v1.6 | |
| Zapier | Zapier Automation Platform (hosted, zapier.com — Zap workflows, Tables, Forms, Canvas, Agents, Chatbots, MCP, SDK, Functions) | DPFSCCsIDTA | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-10v1.6 | |
| Zendesk | Zendesk — customer service and CRM platform (Support, Guide, Talk, Chat, Sell), including Zendesk AI Agents and the first-party MCP server/client | DPFSCCsBCR | Yes | Countries Named | Open List — Cannot Exclude | No | 2026-08-15v1.6 | |
| Zhipu AI | Z.ai API / Enterprise (GLM API) | None Named | No | Countries Named | Non-Adequate Destination Named | No | 2026-08-15v1.6 | |
| Zhipu AI | Z.ai Consumer Chatbot (chat.z.ai) | None Named | No | Countries Named | Non-Adequate Destination Named | No | 2026-08-15v1.6 | |
| Zhipu AI | Zhipu Domestic Platform (bigmodel.cn) | None Named | Not Applicable | Generic Transfer Language | Closed List — Adequate Only | No | 2026-08-15v1.6 | |
| Zoho | Zoho Cloud Suite with Zia AI | SCCs | Yes | Countries Named | Non-Adequate Destination Named | Yes | 2026-08-10v1.6 | |
| Zoom | Zoom Workplace (hosted, zoom.com) — Federated AI deployment | DPFSCCsBCR | Yes | Countries Named | Elevated State-Access Jurisdiction Named | No | 2026-08-07v1.6 |
State Access — A Separate Band
Origin is not destination. An elevated origin yields Cannot Assess, never No Lawful Route. Nationality, ownership or founder origin may never ground an elevated finding.
Classification rests on documented ownership and statutory obligation only — never founder nationality, ethnicity or personal origin.
State-Access (Stakeholder) — Not Researched on all 147 rows
Basis, recorded identically on every row: “not researched under the method — no documented ownership or statutory-obligation finding on the record”.
The band holds one value because the 9,363-row reference set that could have filled it says on 9,336 of its own rows that the value is a mechanical default rather than a verified absence. A lookup against it could not tell “checked and clean” from “never checked”, so it would have published a clean result nobody measured. And the file sits outside the repository, so the same records built on two machines produced two different published wordings — a cell whose basis depends on the build host is not a fact about anyone. The builder no longer opens it. When stakeholder control is genuinely researched it enters through a fact record like every other observation, cited, dated and carrying its claim tier.
Conditional Rows, Named But Not Celled51
Hosting Locality23
United States Government CloudAtlassian Government CloudInfrastructure and support operated exclusively within the EU by EU-resident personnel under Amazon Data Services European Sovereign Cloud GmbH (Germany); support limited to Amazon Development Centre Ireland Limited and Amazon Web Services EMEA SARL; third-party service providers limited to the EU/EEA-region entities of the same messaging vendors named on the main platform's list.AWS European Sovereign Cloud — distinct legal entity, EU-resident governance and personnel, separate and shorter sub-processor listEuropean Union — AWS Dublin, IrelandClickUp Enterprise Plan with the European hosting region selectedEU Regional Services + Customer Metadata Boundary (Enterprise paid add-on)Cloudflare Platform — Enterprise with Data Localization SuiteUnited Kingdom regionEmployment Hero Platform — United Kingdom region (Employment Hero (UK) Ltd, HR data in Australia and Ireland, payroll primarily Ireland)EU or Australia regionGitHub Enterprise Cloud with data residency (GHE.com)Existing workspace (residency unreachable)Loom — an existing workspace, which cannot be migrated to a pinned data regionTenant provisioned in the EU/EFTA Macro Region Geography with an EU/EFTA billing address, bringing Microsoft 365, Entra, Azure regional services, Dynamics 365 and Power Platform in-scope for the EU Data BoundaryMicrosoft Enterprise Cloud Services — EU Data Boundary provisioningEuropean Union data residency (Ireland primary, Germany backup)Miro cloud platform — European Union data residency hosting localityNew ZealandMYOB Business — New Zealand hosting localityEurope (Frankfurt)Obsidian Sync — Europe (Frankfurt) hosting_localityEuropean Cell — Germany and Ireland for hosting and the data warehouse, Belgium and the Netherlands additionally for Identity Governance and Privileged Access. A configuration a customer can select today, taken without the Customer Identity Cloud and without the Service Log Investigator or any other generative-AI feature enabled.Okta Workforce Identity Cloud — European Cell hosting locality, without the Customer Identity Cloud and with no generative-AI feature enabledCustomer Content in Ireland or Australia; all other account and usage data in the United StatesRegional Twilio — supported products with Customer Content stored in the selected region (Ireland or Australia)Hyperforce EU Operating Zone selected by the customerSalesforce Services in a Hyperforce EU Operating ZoneEU Access — optional, per-service, chargeable, EEA and SwitzerlandSAP Cloud Services — EU Access optionSAP NS2 — processing confined to US locations and US personnelSAP Cloud Services — SAP National Security Services (US locations and US personnel)European Union (Frankfurt, Germany) selected as the organisation's Data Storage Location at creationSentry with the European Union data storage location selected (de.sentry.io, Frankfurt)Australia — protected platform offeringServiceNow Protected Platform AustraliaRest Of World / Australia — TikTok Pte. Ltd. (Singapore)TikTok Platform — Rest Of World / Australia User (TikTok Pte. Ltd., Singapore, controller)United States — TikTok USDS Joint Venture LLCTikTok Platform — United States User (TikTok USDS Joint Venture LLC, operator since 22 January 2026)Account pinned to a customer-selected region or territory, as described on the Singapore security pageWhispir Platform — region-pinned account (residency option as described on the Singapore security page)European Data Centre (Amsterdam primary, Dublin secondary)Zoho Cloud Suite — European data centre tenancyEU-HostedZoom Workplace — EU-hosted account (Zoom-Hosted Models Plus)
Deployment Mode23
AI agent operating on the production account through the AgentOS MCP connectorsAirwallex Platform (Business Accounts, Payments, Spend, Billing, Platform APIs and Embedded Finance) — AgentOS production-account connectors deployment modeAsana AI preferences switched off for the domain in the admin consoleAsana work management platform with Asana AI disabled at the domain level by an adminSelf-Managed (Data Center)Atlassian Data Center (customer-operated, self-managed)Early Access AI Agent add-onAuth0 for AI Agents and Okta for AI Agents (Early Access add-on)Self-managed. The customer installs and operates the software on its own infrastructure under the Confluent Platform Agreement (Last Updated April 24, 2024) rather than under the Cloud Services Agreement, and Confluent hosts no customer topic data. Confluent nonetheless collects Usage Data and, unless disabled, Telemetry Metrics from the customer's own installation.Confluent Platform — the self-managed distribution installed on the customer's own infrastructureSelf-HostedFireworks AI — Bring Your Own Cloud (BYOC) deploymentHybrid DeploymentFivetran Hybrid Deployment - pipeline processing inside the customer's own network, orchestrated from Fivetran's cloudDedicatedLunary Dedicated (managed by Lunary in a customer-chosen region)Self-HostedLunary Self-Hosted (Enterprise Edition, customer infrastructure)MCP Server ConnectedMailgun Platform with the published MCP server connected (customer-hosted, model in the loop)On-Premises AgentMake (on-premises agent) — Variant of Make Cloud PlatformPlugin Marketplace connector enabledMiniMax Agent (agent.minimax.io) with a Plugin Marketplace connector enabledAI features enabledmonday AI Work Platform (AI features and agents, enabled per account)Self-HostedMongoDB self-managed (Enterprise Advanced and Community Edition)AccountRight subscriptionMYOB Business — AccountRight subscription deployment modeSelf-Hosted on customer infrastructure. The n8n-operated AI Assistant is not available, and product telemetry is enabled by default.n8n (self-hosted)Asia PacificOneTrust LLC — Asia Pacific deployment modeZero data retention enabled as an API configuration — an option the customer must switch on, not the default state of the offeringOpenAI API with zero data retention enabled (Variant of the API, Business and Enterprise baseline)SendGrid Services and Private Beta Offerings — same platform, same instruments, except that the BCR route is expressly unavailableSendGrid Services and Private Beta Offerings — the Services expressly carved out of the Binding Corporate RulesSold and administered through a business partner or reseller under the 13 March 2025 partner instruments rather than the 1 January 2026 Customer DPASmartSuite Platform — partner and reseller channel (Business Partner DPA / Reseller DPA)Self-HostedSupabase (self-hosted)Self-HostedTeamwork.com MCP server (self-hosted from the published repository)Agent Execution Surface (Model Context Protocol)Zoho MCP — agent execution surface
Commercial Tier5
Individual (non-volume-licensed)GitHub individual accounts and GitHub Copilot Free, Pro and Pro+Enterprise B2B SubscriberLinkedIn Platform — Individual Member — Enterprise B2B Subscriber commercial_tier (Sales Navigator, Recruiter/Talent Solutions, Learning Solutions, Marketing Solutions, Glint)FreeTrello Cloud, Free planReseller channel — the published Data Processing Addendum is disapplied by its own termsWrike Purchased Through A Wrike PartnerCompany or Enterprise planZapier Automation Platform on the Company or Enterprise plan
Correction, Right Of Reply, And Free-And-First
The finding goes to the organisation free and first. An organisation that disputes a cell gets the same route as one disputing a report: the correction is published with a version note, and where a document is produced the reading is re-run. Every organisation’s own record carries the route.
Nothing on this page is behind a sign-in, a price or an account, and nothing on it ever will be. Comparison at this depth is the free layer; what is sold is the reading that goes deeper, never a better answer on this one.