Govern · item 16
Jurisdiction and residency overlay
Work does not happen in a country called the cloud. Every unit in the estate carries the jurisdiction that governs it, every class of record carries a map of where it is stored and where it is processed, and every crossing between two jurisdictions is registered with the lawful basis that permits it. Where a basis is missing, the route is shown as not cleared rather than assumed.
Health
Where the data physically sits
Placements against the sanctioned list, transfer routes by clearance and the assessments behind them.
The jurisdictions this estate operates in
Privacy regime, artificial intelligence regime, supervisory authority and the default transfer mechanism for each.
| Jurisdiction | Privacy regime | AI regime | Supervisor | Adequacy | Default mechanism | Units | Placements | In / out |
|---|---|---|---|---|---|---|---|---|
| United StatesUS Americas | CCPA/CPRA (California), plus twelve further state statutes in scope Breach notice 720 hr | Sectoral and state Partly in force | California Privacy Protection Agency; FTC for unfair practice | Framework participation | EU-US Data Privacy Framework certification | 553 | 15 · 10 classes | 4 in · 1 out |
| United KingdomUK Europe | UK GDPR and Data Protection Act 2018 Breach notice 72 hr | Principles-based, regulator-led Regulator guidance | Information Commissioner's Office | Adequacy decision | UK adequacy for inbound EU data; IDTA or UK Addendum outbound | 483 | 10 · 10 classes | 0 in · 3 out |
| GermanyDE Europe | GDPR and BDSG, with Section 26 BDSG on employee data Breach notice 72 hr | EU AI Act In force | Landesbeauftragte fuer Datenschutz (state-level DPAs) | Inside the union | Intra-EEA - no transfer mechanism required | 476 | 13 · 10 classes | 0 in · 10 out |
| FranceFR Europe | GDPR and Loi Informatique et Libertes Breach notice 72 hr | EU AI Act In force | CNIL | Inside the union | Intra-EEA - no transfer mechanism required | 0 | 0 · 0 classes | 0 in · 0 out |
| SingaporeSG Asia Pacific | Personal Data Protection Act 2012 (as amended 2020) Breach notice 72 hr | Model AI Governance Framework Voluntary framework | Personal Data Protection Commission | No adequacy decision | Standard contractual clauses, EU module two | 512 | 12 · 9 classes | 12 in · 0 out |
| AustraliaAU Asia Pacific | Privacy Act 1988 and the Australian Privacy Principles Breach notice 72 hr | Voluntary AI Safety Standard Voluntary framework | Office of the Australian Information Commissioner | No adequacy decision | Standard contractual clauses, EU module two | 496 | 9 · 9 classes | 0 in · 2 out |
| BrazilBR Americas | Lei Geral de Protecao de Dados 13.709/2018 Breach notice 48 hr | PL 2338 pending Enacted, not yet applied | Autoridade Nacional de Protecao de Dados | No adequacy decision | ANPD standard clauses, published 2024 | 0 | 0 · 0 classes | 0 in · 0 out |
Residency map — where each class of record is stored and processed
Storage and processing are separate facts. A record stored in one jurisdiction and processed in another crosses a border even when nothing is copied.
| Class of record | Category | Volume | US | UK | DE | FR | SG | AU | BR | Residency rule |
|---|---|---|---|---|---|---|---|---|---|---|
Employee master data Placement satisfies the rule | Personal data employee | 61,840 | SP 38,340 | P 10,513 | SP 23,500 | · | PB 87,813 | P 6,802 | · | German records stay in Frankfurt by works agreement. All others may be processed at the Singapore hub. |
Candidate applications Exception recorded | Personal data candidate | 214,300 | PS 102,864 | P 19,287 | P 15,001 | · | SP 270,018 | P 12,858 | · | Processed at the Singapore hub for all regions. EEA candidate data leaves the EEA under clauses. |
Performance and calibration records Exception recorded | Personal data employee | 58,920 | SP 40,066 | P 7,070 | SP 22,390 | · | P 16,498 | P 4,124 | · | German records processed in Frankfurt only, pending the works agreement covering agent assistance. |
Compensation and pay data Placement satisfies the rule | Personal data employee | 61,840 | SP 38,340 | S 10,513 | PS 23,500 | · | S 13,605 | S 6,802 | · | Payroll data stays in the country of employment. No cross-border processing of individual pay. |
Health, safety and accommodation records Placement satisfies the rule | Special category employee | 4,180 | S 1,254 | S 752 | S 920 | · | S 794 | S 460 | · | Stored and processed in country of employment. No cross-border movement of any kind. |
Customer contact records Exception recorded | Personal data customer contact | 892,400 | S 339,112 | S 124,936 | S 187,404 | · | P 312,340 | P 80,316 | · | Regional instances. EEA contacts held in Frankfurt, replicated to Singapore for follow-the-sun service. |
Support conversations and transcripts Exception recorded | Personal data customer contact | 1,284,000 | P 372,360 | P 115,560 | P 154,080 | · | SP 1,129,920 | P 77,040 | · | Processed at the serving hub, which is Singapore outside business hours in every region. |
Supplier bank and payment instructions Placement satisfies the rule | Commercially sensitive supplier | 38,420 | S 13,063 | S 6,147 | S 9,989 | · | S 5,763 | S 3,458 | · | Held in the paying entity region. No consolidation into a single global store. |
Research payloads and experiment data Unresolved | Non-personal none | 12,760 | S 5,997 | S 2,807 | S 3,956 | · | · | · | · | Held in the originating research site. Export-controlled subsets never leave the originating country. |
Agent telemetry and evidence records Placement satisfies the rule | Personal data employee | 8,054 | SP 9,826 | S 1,530 | S 1,530 | · | S 1,611 | S 1,530 | · | Written once in the jurisdiction of the unit, replicated read-only to the platform region. |
Cross-border transfer register
Every route out of a jurisdiction, with the mechanism relied on and the state of its impact assessment.
| Route | Record class | Crossing | Lawful basis | Mechanism | Impact assessment | Monthly | Status |
|---|---|---|---|---|---|---|---|
| XFER-001 | Employee master data Shared-service HR administration for the non-German population routed through the Singapore hub. | DE→SG | Standard contractual clauses | EU SCC Module 2, executed 2024-11-04, Annex III updated 2026-03-12 | Assessment current TIA-2024-011 | 0 | Blocked Route is contractually papered but operationally suspended. German employee records do not leave Frankfurt while the works agreement is unsigned. Volume is zero by design, not by accident. |
| XFER-002 | Candidate applications Candidate screening, assessment scoring and interview scheduling performed at the Singapore hub. | DE→SG | Standard contractual clauses | EU SCC Module 2, executed 2024-11-04 | Assessment in progress TIA-2026-004 | 1,840 | Cleared with conditions The transfer impact assessment has been in progress for 94 days. Volume continues while it is open. This is the single largest unresolved item on the register. |
| XFER-003 | Candidate applications Candidate screening and assessment for UK requisitions at the Singapore hub. | UK→SG | Standard contractual clauses | UK Addendum to EU SCCs, executed 2024-11-18 | Assessment current TIA-2024-013 | 2,310 | Cleared |
| XFER-004 | Customer contact records Follow-the-sun customer service outside European business hours. | DE→SG | Standard contractual clauses | EU SCC Module 2, executed 2023-06-30, Annex III last updated 2024-09-02 | Assessment out of date TIA-2023-007 | 46,200 | Cleared with conditions Annex III has not been refreshed since two sub-processors were added to the service chain in 2025. The assessment describes a supply chain that no longer matches the register. |
| XFER-005 | Support conversations and transcripts Out-of-hours contact center handling and transcript storage. | DE→SG onward transfer | Standard contractual clauses | EU SCC Module 2, executed 2023-06-30 | Assessment out of date TIA-2023-008 | 88,400 | Cleared with conditions Free-text transcripts occasionally carry Article 9 data. A transfer assessed for ordinary personal data is carrying special-category data some of the time. |
| XFER-006 | Support conversations and transcripts Out-of-hours contact center handling for UK customers. | UK→SG | Standard contractual clauses | UK Addendum to EU SCCs, executed 2023-07-14 | Assessment current TIA-2023-009 | 51,300 | Cleared |
| XFER-007 | Customer contact records Marketing automation and campaign attribution on the global instance. | DE→US | Adequacy decision | EU-US Data Privacy Framework, recipient self-certified, verified 2026-02-19 | Assessment current TIA-2026-002 | 128,000 | Cleared |
| XFER-008 | Agent telemetry and evidence records Platform control plane reads evidence records from every region to serve the cockpit. | DE→US | Standard contractual clauses | Intra-group agreement, EU SCC Module 1, executed 2025-04-08 | Assessment current TIA-2025-006 | 1,520 | Cleared |
| XFER-009 | Agent telemetry and evidence records Model inference. Prompt and completion content leaves the region for the model provider. | DE→US | Standard contractual clauses | Model provider DPA with EU SCC Module 2, executed 2025-09-22 | Assessment current TIA-2025-014 | 412,000 | Cleared with conditions Zero-retention is contracted, and the platform cannot independently verify it. Verification depends on the provider attestation, which is the same weakness the evidence chain has without external anchoring. |
| XFER-010 | Employee master data Shared-service HR administration for the Australian population. | AU→SG | Standard contractual clauses | APP 8 contractual arrangement, executed 2024-08-15 | Assessment current TIA-2024-009 | 6,800 | Cleared Cleared, but APP 8 leaves the Australian entity accountable for anything the Singapore processor does. The accountability does not transfer with the data. |
| XFER-011 | Supplier bank and payment instructions Supplier master maintenance performed by the Source-to-Pay tower. | DE→SG | Standard contractual clauses | EU SCC Module 2, executed 2024-11-04 | Assessment current TIA-2024-012 | 940 | Cleared |
| XFER-012 | Performance and calibration records Calibration preparation and review quality checks at the Singapore hub. | UK→SG | Standard contractual clauses | UK Addendum to EU SCCs, executed 2024-11-18 | Assessment current TIA-2024-014 | 2,140 | Cleared |
| XFER-013 | Research payloads and experiment data Joint research program between the Ludwigshafen and Cambridge sites. | DE→US | No personal data | Not personal data. Export control screening under EAR and EU dual-use. | Not required no reference | 0 | Unresolved The laboratory notebook has no feed, so the platform cannot see whether this transfer happens or at what volume. It is on the register because the site register says the program exists, not because the platform observed it. |
| XFER-014 | Candidate applications Candidate screening for US requisitions at the Singapore hub. | US→SG | Explicit consent | Candidate notice and consent captured at application, US flow only | Not required no reference | 4,260 | Cleared |
| XFER-015 | Support conversations and transcripts Out-of-hours contact center handling for Australian customers. | AU→SG | Standard contractual clauses | APP 8 contractual arrangement, executed 2023-07-14 | Assessment current TIA-2023-010 | 33,700 | Cleared |
| XFER-016 | Health, safety and accommodation records No transfer. Recorded as an explicit prohibition so the absence is auditable. | DE→SG | None recorded | Prohibited by policy POL-DP-004. No mechanism sought. | Not required no reference | 0 | Prohibited The prohibition is enforced by a field-level deny list in the agent context builder, not by a network control. A direct database query from Singapore would not be stopped by it. |
Routes that are not cleared
Listed by name. None of these is inferred to be acceptable.
Busiest crossings
Aggregated by pair, worst status on the pair carried forward.
Which jurisdictions each function and each shared-services tower touches
Rolled up from the jurisdiction stamped on individual units, not declared separately.
Actions
What is waiting on a person
Where data physically sits is a legal position, not a configuration setting. Each item below needs a named person to take that position.
Refresh a transfer impact assessment
Stale or still in progress while the route carries traffic.
Resolve a blocked or prohibited route
Work that needs to cross a border and currently cannot.
Assess a sub-processor
In the chain, never assessed.
Sanction or move an unapproved placement
Data is sitting somewhere no approval covers.
Operations
What this desk is allowed to start
A surface that only reports is not operable. This is the work this page can set in motion, and the bound it runs into.
Trigger and bound
This desk can start a placement scan — inventory what is stored where, against the sanctioned list — and it can flag a route. It cannot move data across a border, sign a transfer assessment, or approve a sub-processor. All three are legal acts that require counsel.
Live observability
What the record shows right now
Transfer route status. Conditional means the route runs only while its stated conditions hold.
Current distribution
16 routes
Is policy and strategy coming to fruition
Whether the written intent is holding here
10 of 16 transfer routes are cleared outright. 1 placement sits outside the sanctioned list.
Not holding on the record
The written position is that no personal data leaves its declared jurisdiction without an assessed route. Across 59 placements, 1 is unsanctioned, and of 16 routes 10 are cleared, 4 run conditionally and 2 are stopped. 3 assessments are stale or unfinished. Everything on this page reflects what the record states about placement; none of it has been confirmed against the physical infrastructure by an independent reviewer.
The overlay is real: every one of the 2,520 units in the estate carries a jurisdiction, and the rollups by function and by tower are computed from those stamps rather than declared. What sits underneath is the modeled estate described on the connector registry. Connect a customer instance and the same overlay reads real work.
7 of 16 transfer routes are not cleared and 2 impact assessments are stale. One route has no lawful basis recorded at all. These are shown as named routes with the gap written out, because a register that reports only the cleared routes is not a register.
1 placement sits outside the residency rule declared for its own class of record, and 11 placements name a system that does not appear in the connector registry at all. A residency map that quietly omits the systems nobody has registered is worse than no map.