komploop
Get early access
All field notes
How-toAug 11, 2026 · 8 min read

The transfer nobody wrote down: reading where data actually lands

A storage bucket in us-east-1 is an international transfer, whether or not the policy has a section about it.

The Komploop team
We read the internet for a living

International transfer sounds like a legal category. In practice it is an infrastructure fact: a region in a console, a CDN edge, a support tool with a US-hosted inbox. The paperwork is downstream of a decision an engineer made in a dropdown.

Where transfers hide

They are rarely in the database. They are in the analytics pipeline, the error tracker, the transactional e-mail provider, the AI API and the support desk, tools chosen for speed, each with its own default region.

Map it from the outside

You can reconstruct most of your own transfer map in an afternoon without touching a single system:

List every third-party host the site loads and where each one terminates.
Check the region setting of each SaaS admin console you own.
Read the sub-processor page of each vendor, their transfers become yours.
Note which tools your support and sales teams paste customer data into.

Then write it down once, properly

For each transfer, the record needs the destination country, the mechanism you rely on, the categories of data and the purpose. A record that exists is worth more than a perfect record that does not.

Keep it beside the vendor list rather than inside a document, so that adding a vendor is what updates the map.

Try it on your own site

See the vendors and regions your site reveals.

The free assessment lists every third-party host your pages contact and where each one resolves, a first draft of your transfer map, from the outside.

Run the free assessmentSee the platform
Takeaways
Transfers are a configuration fact before they are a legal one.
Vendor sub-processors inherit into your transfer map.
Record destination, mechanism, data categories and purpose.
Attach the map to the vendor registry so it updates itself.
Read next
How-to
What an enterprise security review actually asks for
Aug 3, 2026 · 9 min read
Privacy
Cookie management is not a banner. It is an inventory.
Aug 19, 2026 · 8 min read
Compliance
Terms you never update are a promise you are no longer keeping
Aug 17, 2026 · 7 min read