International data transfers
Where data goes outside the UK and the mechanisms that would cover it — to be confirmed by counsel.
Draft — not in force. Draft 0.1 · Not in force — no effective date has been set · Awaiting review by a qualified lawyer (UK data-protection and commercial law).
Where data is processed today
- Database: Supabase, Paris (EU/EEA). The UK's adequacy regulations cover the EEA.
- Application and documents: a computer operated by INVICTT AI (the pilot); its country must be confirmed and documented.
- Web delivery and proxying: Netlify (US company); edge connectivity: Cloudflare (US company); e-mail: Resend (US company). Data or metadata may be processed in the United States.
Mechanisms available under UK law
- UK adequacy regulations (including the EEA, and the UK Extension to the EU-US Data Privacy Framework for US organisations that are actively certified).
- The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment.
- Since the Data (Use and Access) Act 2025 the test is that protection is 'not materially lower' than in the UK.
Status
No transfer assessment has been completed and no mechanism has been confirmed for any provider. This page records the facts needed for that work; it is not a statement that transfers are compliant.
Decisions required before this can take effect
Matters for professional legal approval or for INVICTT AI to determine. They are deliberately not answered here.
- For each provider: confirm DPF certification or execute the IDTA/Addendum through its DPA.
- Document the country of the pilot computer.
- Complete transfer risk assessments where needed.