Transfer Impact Assessment — AutoRFP.ai's Onward Data Transfers

A transfer impact assessment (TIA) is a comprehensive evaluation that identifies and analyzes the risks associated with transferring personal data from the European Union to third countries that do not have an adequacy decision from the European Commission.

Under the General Data Protection Regulation (GDPR) and guidance from European data protection authorities, organizations must conduct TIAs when relying on Standard Contractual Clauses (SCCs) or other transfer mechanisms to ensure that personal data transferred outside the EU receives an essentially equivalent level of protection.

Our TIA evaluates:

• The laws and practices in the destination country that may impinge on the effectiveness of safeguards
• The nature and purpose of the data transfer
• The categories of personal data being transferred
• Any additional technical, organizational, and contractual measures needed to ensure adequate protection

This assessment helps us demonstrate compliance with GDPR Article 44-49 (Chapter V) requirements for international data transfers and ensures we maintain the high standards of data protection our customers expect.

Yes, AutoRFP.ai implements comprehensive supplementary measures across three key areas to ensure personal data receives adequate protection during international transfers:

Technical security measures:

• End-to-end encryption of data in transit and at rest using industry-standard AES-256 encryption
• Advanced access controls and authentication mechanisms including multi-factor authentication
• Network segmentation and monitoring to prevent unauthorized access
• Regular vulnerability assessments and penetration testing
• Data pseudonymization and tokenization where technically feasible

Organizational measures:

• Strict data minimization principles — we only transfer data that is necessary for the specified purpose
• Comprehensive staff training on data protection requirements and cross-border transfer obligations
• Regular audits and compliance monitoring of our transfer practices
• Incident response procedures specifically addressing international data transfers
• Clear data retention and deletion policies aligned with our Data Retention Policy

Contractual measures:

• Implementation of Standard Contractual Clauses with all sub-processors handling EU personal data
• Additional contractual obligations beyond SCCs requiring enhanced security measures
• Binding Corporate Rules for internal transfers within the AutoRFP.ai organization
• Regular review and updates of contractual arrangements to address evolving regulatory requirements

These measures are regularly reviewed and updated to address changes in legislation, technology, and risk assessments in destination countries.

Yes, AutoRFP.ai offers EU-regional data residency options to customers who require their data to remain within European Union boundaries.

EU data residency features:

• Customer Content can be stored exclusively in EU-based cloud infrastructure
• Data processing operations are conducted within EU regions when this option is selected
• No transfer of Customer Content outside the EU unless explicitly directed by you as the data controller

How to enable EU data residency:

• EU data residency can be configured during account setup or migrated for existing accounts
• Contact our support team to discuss your specific data residency requirements
• Enterprise customers can work with our solutions team to implement custom data residency configurations

Important considerations:

• Some limited operational data (such as account metadata and billing information) may still be processed outside the EU for essential service functions
• EU data residency may affect certain integrations or features that rely on global infrastructure
• Support and security monitoring may involve limited access by AutoRFP.ai personnel in other regions under strict access controls and audit logging

For customers with strict regulatory requirements or those who prefer to keep all data within EU borders, we recommend discussing your specific needs with our compliance team who can provide detailed guidance on our EU data residency options and any associated considerations.