Control Evidence — International Data Transfers

GDPR Chapter V transfer register and safeguards · Qureos

Controls: GDPR Art. 44–49 (Ch. V), Art. 28, Art. 30 · ISO/IEC 27001:2022 A.5.14, A.5.19–A.5.22
Status: EVIDENCED OPEN ITEMS §6
Comp AI task: Review International Data Transfers (tsk_6a2e519f286b951ea31f1619)
Owner: Jomer Avengoza (jomer@qureos.com)
Applicability: Applicable — EU personal data is processed
Last reviewed: 2026-08-17
Review cycle: Annually, and on any sub-processor addition or change
Companion records: RoPA (Art. 30), Data Processing Agreement, retention schedule

1. Applicability determination

The Comp AI task allows de-scoping only "if no data sent into or out of the EU." That condition is not met. Qureos processes EU personal data as a matter of architecture, not incident:

  1. Primary hosting is inside the EU. Production workloads and data stores run in GCP europe-west1 (Belgium), with MongoDB Atlas in the same region. Data leaving this environment to any third-country recipient is an international transfer under GDPR Ch. V.
  2. Data subjects include EU/UK residents. The platform serves candidates and employer customers with data located in Europe and the United Kingdom (recorded in the auditor-facing system description in Comp AI).
  3. Third-country recipients exist. US-based sub-processors receive personal data in the course of service delivery (§3), and the Qureos workforce operates from UAE, US, and KSA entities.

Conclusion: the task is applicable and must not be marked "not relevant". This document is the transfer review it requires.

2. Transfer map

EU / EEA — data at rest GCP europe-west1 (Belgium) Production platform (GKE, Cloud Run) Candidate profiles · interviews · scores · billing MongoDB Atlas (EU) · Cloud Storage · BigQuery Databases, recordings (30-day), warehouse, audit logs Adequacy: United Kingdom EU↔UK flows under the UK adequacy decision (Art. 45) KSA staging (GCP me-central2) No production personal data in staging (environment-separation evidence); not a Ch. V transfer channel for candidate data United States — sub-processors Safeguard: vendor DPAs incorporating SCCs (Art. 46(2)(c)) AI & interviews OpenAI · LiveKit · Deepgram · Twilio · Retell Platform services Stripe · Intercom · Postmark · Nylas · Okta/Auth0 Analytics & internal ops Mixpanel · Segment · New Relic · Google Workspace · Comp AI Intra-group access — UAE / US / KSA entities Remote workforce administers EU-hosted systems from third countries. Intra-group transfer agreement (SCC-based) tracked as open remediation R3 (§6). SCCs via DPA SCCs via DPA admin access
Figure 1 — Personal data at rest stays in the EU; exports flow to US sub-processors under SCC-backed DPAs. Intra-group third-country access is the tracked gap.

3. Transfer register

Every third-country recipient of personal data, mapped to its RoPA processing activity. The operative safeguard relied on is the vendor's Data Processing Agreement incorporating the 2021 EU Standard Contractual Clauses (Art. 46(2)(c)); vendor EU–US Data Privacy Framework certifications, where held, are treated as supplementary and are not relied on as the primary mechanism.

#RecipientCountryPurpose (RoPA activity) Personal data transferredTransfer mechanismStatus
T1Google Cloud Platform (Google LLC)US (data at rest in EU)Hosting, storage, logging (RoPA 1, 2, 8, 10)All platform data; at rest in europe-west1; support/remote access may occur from outside EEAGoogle Cloud Data Processing Addendum incorporating SCCsSCC
T2MongoDB Atlas (MongoDB Inc.)US (cluster in EU)Primary database (RoPA 1, 5)Candidate and customer records; cluster hosted in EUMongoDB DPA incorporating SCCsSCC
T3Elastic (Elasticsearch)US/NLSearch index (RoPA 1)Candidate profile search fieldsDPA incorporating SCCsSCC
T4OpenAIUSLLM scoring & report generation (RoPA 3)Interview transcripts, profile data (API traffic; zero-retention terms, no training on customer data)OpenAI DPA incorporating SCCsSCC
T5Google (Gemini API)USProfile analysis (RoPA 3)Profile data (API traffic)Google Cloud DPA incorporating SCCs (as T1)SCC
T6LiveKitUSReal-time interview infra & recording (RoPA 2)Voice/video streams, call metadataDPA incorporating SCCsSCC
T7DeepgramUSSpeech-to-text (RoPA 2)Interview audio, transcriptsDPA incorporating SCCsSCC
T8TwilioUSSMS, calls, phone interviews (RoPA 2, 6)Phone numbers, call audio/metadataTwilio DPA incorporating SCCsSCC
T9RetellUSPhone interviews (RoPA 2)Phone numbers, call audio, transcriptsDPA incorporating SCCsSCC
T10StripeUSPayments (RoPA 5)Billing contact, tokenized payment data (PCI-DSS)Stripe DPA incorporating SCCsSCC
T11IntercomUSCustomer support (RoPA 7)Name, email, support conversation contentIntercom DPA incorporating SCCsSCC
T12Postmark (ActiveCampaign)USTransactional email (RoPA 6)Email addresses, message content/metadataDPA incorporating SCCsSCC
T13Bird / WhatsApp Business APINL / US (Meta)WhatsApp reminders (RoPA 6)Phone numbers, template message metadataBird (EU entity) DPA; Meta transfers under SCCs in the WhatsApp Business termsSCC
T14NylasUSGmail reply detection (RoPA 6)Reply status metadata only (no message content)DPA incorporating SCCsSCC
T15Okta / Auth0USAuthentication (platform & workforce)Login identifiers, authentication eventsOkta DPA incorporating SCCsSCC
T16MixpanelUSProduct analytics (RoPA 8)Usage events, identifiersDPA incorporating SCCsSCC
T17Segment (Twilio)USEvent pipeline (RoPA 8)Usage events, identifiersTwilio DPA incorporating SCCs (as T8)SCC
T18New RelicUSPerformance monitoring (RoPA 8)Service telemetry; may incidentally include identifiersDPA incorporating SCCsSCC
T19Google WorkspaceUSWorkforce identity, email, docs (RoPA 9)Employee data; business documentsGoogle Workspace DPA incorporating SCCsSCC
T20Comp AI (trycomp.ai)USCompliance personnel register (RoPA 9)Employee names, roles, onboarding dataDPA incorporating SCCsSCC
T21ContactOutUSContact enrichment (RoPA 4)Sourced-candidate contact detailsVendor terms only — SCC-backed DPA not yet confirmed on fileVERIFY
T22ClayUSContact enrichment (RoPA 4)Sourced-candidate contact detailsVendor terms only — SCC-backed DPA not yet confirmed on fileVERIFY
T23Qureos group entities (intra-group)UAE / US / KSAPlatform administration, support, engineering access to EU-hosted systemsAny platform data reachable by least-privilege admin accessAccess controls (SSO + MFA, least-privilege IAM, no standing prod credentials); intra-group SCC agreement pending (R3)OPEN

Register derived from the Art. 30 RoPA (reviewed 2026-08-17) and the Qureos Data Processing Agreement sub-processor schedule (updated 2025-08-15, published at app.qureos.com/policies).

4. Safeguards relied on

MechanismGDPR basisWhere used
Adequacy decision — United KingdomArt. 45EU↔UK data flows (UK is within the served market; no additional safeguard required while the UK adequacy decision stands)
Standard Contractual Clauses (2021, module 2/3) via vendor DPAsArt. 46(2)(c)All US sub-processors in §3; the operative mechanism for every routine transfer
Supplementary measuresSchrems IIEncryption in transit (TLS 1.2+) and at rest; EU data residency for storage; zero-retention API terms for LLM traffic (OpenAI); tokenization (Stripe); metadata-only scope (Nylas)
Contractual flow-downArt. 28(4)Qureos DPA obliges sub-processor equivalence: ISO 27001 and/or SOC 2 baseline, DPAs with SCCs for transfers outside the EEA/UK, customer objection rights on sub-processor changes

Derogations under Art. 49 are not relied on for any routine transfer.

5. What is not a transfer channel

  1. KSA staging region (me-central2). Staging holds no production personal data (see environment-separation evidence: separate VPCs, clusters, and database clusters; staging identities cannot reach production). EU personal data therefore does not flow to KSA infrastructure.
  2. Security & audit logging (RoPA 10). Logs remain in GCP EU; no third-country recipient.

6. Known limitations & remediation

#FindingCompensating positionRemediation
R1 ContactOut and Clay (contact enrichment) are engaged on standard vendor terms; an SCC-backed DPA is not confirmed on file (T21, T22) Data involved is public-professional-source contact data, lowest-sensitivity category in the register; erasure honored within 30 days Obtain/confirm DPAs incorporating SCCs with both vendors, or replace them; target next quarterly vendor review
R2 Transfer Impact Assessments (Schrems II) are not yet documented per US sub-processor Supplementary measures already operate (§4); all vendors meet the ISO 27001 / SOC 2 baseline Produce lightweight TIAs for the highest-volume recipients first (OpenAI, LiveKit, Deepgram, Twilio, Stripe)
R3 Intra-group third-country access (UAE/US/KSA workforce administering EU-hosted systems) is not yet covered by a signed intra-group transfer agreement (T23) Access is least-privilege with no standing production credentials, SSO + enforced MFA, and full audit logging of admin activity Execute an intra-group data transfer agreement incorporating SCCs between the UAE, US, and KSA entities
R4 DPIA for automated candidate scoring / profiling (GDPR Art. 22, EU AI Act high-risk) remains open; it will also cover the transfer dimension of LLM scoring Art. 22 safeguards operate: human review of every shortlist, right to explanation and objection; zero-retention LLM API terms Complete the DPIA (already tracked as an open action on the RoPA)

7. Review & change management

This register is reviewed annually and on any sub-processor addition, removal, or change of processing location, in step with the Art. 30 RoPA and the DPA sub-processor schedule. The Comp AI task tsk_6a2e519f286b951ea31f1619 ("Review International Data Transfers", GDPR framework) is the recurring trigger; this document is its evidence. Customers are notified of sub-processor changes under the DPA's objection mechanism.

Sources: Records of Processing Activities (Art. 30 register, reviewed 2026-08-17) · Qureos Data Processing Agreement (updated 2025-08-15, app.qureos.com/policies) · hosting & compliance response (GCP europe-west1, vendor certifications) · environment-separation control evidence (staging isolation) · Comp AI system description and vendor records. Prepared 2026-08-17 for the Qureos GDPR compliance program; internal document, disclosed to auditors and supervisory authorities on request.