International data transfers use SCCs, adequacy decisions, or other lawful mechanisms

GDPR Chapter V (Arts. 44–46) prohibits transferring EU personal data outside the EU/EEA unless a lawful transfer mechanism is in place — adequacy decision, Standard Contractual Clauses, or Binding Corporate Rules. Most AI-built applications transfer EU data to the US routinely: a US-hosted database, US-based analytics, a US email provider. Each transfer without a documented mechanism is an independent violation. Post-Schrems II, relying on 'the vendor is reputable' is not a legal basis. Standard Contractual Clauses are included in most major vendor DPAs — but only if those DPAs are accepted. Undocumented transfers are also a disclosure failure under Art. 13(1)(f).

Map every international data transfer and confirm the transfer mechanism for each. Document the findings in your privacy policy.

## International Transfers — Transfer Mechanism Audit

| Service       | Data Location | Mechanism                        | Status    |
|---------------|---------------|----------------------------------|-----------|
| Supabase DB   | EU (eu-west-1)| No transfer — EU hosted          | Confirmed |
| Stripe        | US            | SCCs (included in Stripe DPA)    | DPA accepted 2026-01-15 |
| SendGrid      | US            | SCCs (included in SendGrid DPA)  | DPA accepted 2026-01-15 |
| Google GA4    | US            | SCCs + EU-US DPF participation   | Accepted via GA Admin |
| Vercel CDN    | Global        | SCCs (Vercel DPA)                | DPA accepted 2026-01-15 |

Add to your privacy policy: "We transfer personal data to the United States. Transfers are governed by Standard Contractual Clauses approved by the European Commission, or the EU-US Data Privacy Framework where applicable." Consider EU-region database hosting (Supabase eu-central-1, AWS eu-west-1) to reduce transfer scope.