Data on platforms outside the EU, governed by Standard Contractual Clauses.
SOV-EXTRA covers the cases in which part of the system, or the entire workload, resides on platforms outside the European Union. Typically these are managed services of US hyperscalers (AWS us-east, GCP us-central, Azure US) or proprietary AI models (OpenAI, Anthropic, Google) whose endpoint resides outside the EU.
When we resort to SOV-EXTRA, the international transfer of personal data is governed by Standard Contractual Clauses approved by the EU Commission, supplemented by a Transfer Impact Assessment that evaluates the specific risks of the destination country. For transfers to the US, post-Schrems II the SCC alone are often not sufficient because of the CLOUD Act and FISA 702: for this reason we add concrete technical supplementary measures — typically at-rest and in-transit encryption with keys managed by the client (BYOK/HYOK), tokenization of sensitive fields, pseudonymization and minimization of the transferred payload.
The client receives explicit documentation on what is transferred, where, why, and which supplementary technical measures have been applied. It is a conscious choice: we use it when a feature is not replicable in the EU (e.g. frontier AI models) or when the client accepts the trade-off in exchange for specific technical capabilities. It is never the default choice.
Where the data physically resides
Regulatory references and standards applicable to the SOV-EXTRA sovereignty level.
Want to understand which sovereignty level is right for your project? Let's talk.
$ Let's talk →