For the person who has to complete the transfer assessment
The transfer analysis, already done
Routing data does not leave the EEA. Two things do, both named below with the exact data in them, the safeguard they travel under, and the change on your side that stops each one happening at all.
- 9 of 11 data classes never leave the EEA
- No task content, routing state or decision trace is transferred
- Both transfers can be removed by a choice you control
Schrems II, in the only terms that matter
The question after Schrems II is not whether a vendor says "GDPR compliant" — it is which specific personal data reaches which specific company in which country, and on what basis. 2 transfers, 4 facts each. Set it to how you would run it and the transfers your setup removes are ruled off.
How you would run it
The hosted platform with every feature turned on. This is the state the rest of this page describes.
Transactional email → SendGrid (Twilio)
Happens under this setup.
Why it happens
A hosted account has to send mail the recipient can act on, and delivering mail means handing an address and a message body to a provider that delivers it. No part of the routing decision is involved.
What actually goes
Recipient email address and the contents of the message — email verification, password reset, and worker-portal invitations. No task content.
Where it lands
United States
Safeguard: Standard Contractual Clauses in the provider’s data processing addendum. The same entry is on the subprocessor list.
How you stop it
Self-host the engine: there is no Fivexer account, so there is no email to send.
Worker-Portal Studio prompts → DigitalOcean Inference
Happens under this setup.
Why it happens
The Worker-Portal Studio builds a portal from a description you type. Producing it means sending that description, and the portal source files it is editing, to a model. That model runs on DigitalOcean’s own inference infrastructure — the same company that already hosts the platform — so no third-party AI provider is in the chain. It is served outside the EEA because DigitalOcean offers no EU inference region. It is opt-in per workspace — one that never turns it on never triggers this transfer.
What actually goes
Only the prompts and portal source files exchanged while building a worker portal in the Studio. The model runs on DigitalOcean’s own infrastructure, so no third-party AI provider receives them. Reached only by workspaces that use the Studio.
Where it lands
United States
Safeguard: Standard Contractual Clauses in the provider’s data processing addendum. The same entry is on the subprocessor list.
How you stop it
Leave the Studio switched off. A workspace that never opens it never reaches the inference endpoint.
What never crosses the EEA
9 of the 11 data classes never leave the EEA — in any configuration.
- Task content and attachmentsEverything you send us to route, and every file uploaded against it, stays in Frankfurt. No subprocessor outside the EEA receives any of it — the email provider sees a recipient address and a message body, and nothing else.
- Routing state and decision tracesWho holds what, who was eligible, who was ruled out and why. This is the record you would reach for in a dispute, and it never leaves the region.
- Backups of eitherCopies live with their originals in Frankfurt — no backup copy leaves the region.
Questions about transfers
The short answers, for the transfer assessment you are completing.
Which data leaves the EEA?
Two things, and only two. Transactional email — the recipient address and the message body — goes to SendGrid in the United States. Prompts and portal files from the optional Worker-Portal Studio go to DigitalOcean’s inference platform, which serves from a single global endpoint with no EU region. No task content, no routing state and no decision trace is in either.
What is the transfer mechanism?
Standard Contractual Clauses, in each provider’s own data processing addendum. Both flows are named with their safeguard on /security, because a subprocessor list that omits one is worse than none at all.
How do we stop the transfers happening at all?
Leave the Worker-Portal Studio switched off and no prompt ever leaves the platform — it is opt-in per workspace. Self-host the MIT engine and there is no Fivexer account either, so there is no transactional email and no processor relationship to assess.
Do you need our transfer impact assessment?
No, but this page is written so you can complete yours. Each transfer is listed with its purpose, the exact data in it, the safeguard, and the change that removes it. The Article 28 agreement those clauses sit under is published at /dpa.