How are international data transfers handled?
Processing takes place in the United States; the Standard Contractual Clauses and the UK addendum are incorporated where GDPR, UK, or Swiss law applies.
Where customer personal data is subject to GDPR, UK, or Swiss data protection law, the DPA incorporates the EU Standard Contractual Clauses (Modules 2 and 3) and the UK addendum for transfers to the United States. The DPA also covers assistance with data subject requests and an audit right once per twelve months on thirty days' notice. See international transfers.
Written for it and security, finance and procurement. Last reviewed 2026-09-15.
Related questions
Still need an answer?
Tell us what you were looking for and we reply within one business day.
Contact the team →Running a security review?
Documents, controls, and the request form live in the Trust Center.
Open the Trust Center →