Cross-Border Data Transfer

Moving personal data out of Europe or the United Kingdom takes more than a signature. A transfer mechanism has to be in place, and the receiving practice has to be assessed. An AI request that leaves your region is exactly such a transfer, even when it lasts two seconds.

Transfer paperwork and transfer behavior drift apart. Clauses are signed, an assessment is filed, and then a default model endpoint quietly carries personal data somewhere nobody described. This starter is for the privacy lead who wants the runtime to match the file.

Two provider entries ship with the starter, and only one of them can take traffic. The eligible target declares zero data retention and an opt out from training on your prompts. The second entry declares that it keeps request data, so the routing rule refuses it. When no declared target meets both requirements, the request is blocked rather than sent to a weaker destination. Each selection is written to the log.

Be clear about what those declarations are. They are statements that an operator records about a provider, and the gateway acts on them as written. Nothing here inspects a vendor, reads a contract or confirms an adequacy decision.

Redaction covers two pattern groups before anything leaves. National identifier formats are masked, and so are health, member and patient numbers. Returned text must clear a combined 0.82, with relevance at 0.78 and accuracy at 0.80. That sits below the bar the high risk decision starters set.

The transfer assessment itself is still yours to write. Choose the mechanism, document the risk, and decide which jurisdictions you will serve from which region. The review point is an empty block until you assign an approver. Audit marking flags an evaluated request and keeps nothing on its own.