Pursuant to Article 46 GDPR, UK GDPR, and EDPB Recommendations 01/2020
Data Transfers to US-based and US-owned Sub-Processors
BMX Holdings Ltd
Trading as Orcha
Version 3.0
12.04.2026
Classification: Confidential
This Transfer Impact Assessment (TIA) documents the lawfulness and safeguards applicable to personal data transfers from the European Union and United Kingdom to recipients in the United States. It serves as supplementary documentation to Orcha's Data Processing Agreements and Sub-Processor List (O3).
This TIA is prepared in accordance with:
This TIA covers personal data transfers to the following US-based and US-owned recipients:
Data transfers occur exclusively in connection with the services Orcha provides to its customers and are facilitated through Orcha's processing platform (hosted on AWS Frankfurt, EU).
| Recipient | Country | Purpose | Data Categories | Transfer Mechanism | Volume |
|---|---|---|---|---|---|
| Anthropic, Inc. | USA | AI data extraction and classification via Claude API | Document contents (text, including financial data) | EU SCCs (Module 2: C-to-P) + UK Addendum | Varies by customer |
| Google LLC | USA (Gemini); EU (Document AI, Vertex AI) | OCR, AI extraction, classification, email triage, embeddings | Document contents (text and images), email metadata, supplier data | EU SCCs (Module 2) + UK Addendum + EU-US DPF | Varies by customer |
| Microsoft Corporation | USA / EU (varies by service) | SSO authentication; email acquisition from customer Outlook mailboxes; Teams notification delivery | User identity, email contents and attachments, notification messages | EU SCCs (Module 2) + UK Addendum + EU-US DPF | Varies by customer |
| Slack Technologies, LLC | USA | Notification delivery to customer-configured channels | Notification messages (document status, supplier names) | EU SCCs + DPA | Varies by customer |
| Amazon Web Services EMEA SARL | EU (Frankfurt) -- US-owned | Cloud hosting, compute, storage, database, authentication, email, backups | All customer data (stored and processed in EU only) | No third-country transfer (EU data residency); precautionary: SCCs + DPF | All customer data |
Data flows occur as follows:
No customer platform credentials are transmitted to AI sub-processors. AI sub-processors are contractually prohibited from retaining input data beyond the processing call or using it for model training.
For authentication and mailbox integrations (Microsoft, Google), Orcha accesses data directly from the identity provider using customer-granted OAuth tokens. For notification channels (Slack, Teams), Orcha transmits notification messages to customer-configured endpoints.
Orcha relies on the following tools:
The United States legal framework governing data access and surveillance is relevant to this assessment:
Section 702 of the Foreign Intelligence Surveillance Act permits the US government to conduct surveillance targeting non-US persons reasonably believed to be outside the US. Under this authority, technology providers may be issued directives requiring disclosure of communications data.
Mitigation: Contractual zero-retention commitments at AI sub-processors limit the data available to produce in response to such directives. Transport-level encryption reduces interception risk during transmission.
Executive Order 12333 permits US intelligence agencies to conduct signals intelligence collection, including bulk interception of international communications.
Mitigation: All data transfers occur over encrypted TLS connections. Primary data storage is located in the EU, limiting the exposure of data outside of specific processing calls.
The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) requires US-based companies to produce data to US law enforcement, regardless of where the data is stored.
Mitigation: Orcha's customer data is stored at rest in AWS Frankfurt, EU. Contractual commitments with AI sub-processors prohibit persistent storage of transmitted data. For AWS, contractual commitments limit storage to the selected EU region.
This Executive Order introduced proportionality and necessity requirements for US intelligence collection and established a Data Protection Review Court to hear challenges from foreign nationals claiming US intelligence infringement. This order was a critical step toward the EU-US Data Privacy Framework adequacy decision and represents an improvement in US legal safeguards for data subjects.
Risk Level: MEDIUM
Justification: US law permits broad government access to data held by US-based companies. Primary data storage in the EU, transport encryption, and contractual commitments limiting persistence at US-based AI sub-processors reduce -- but do not eliminate -- the practical risk.
Orcha implements the following supplementary measures to address US law risks:
Anthropic, Inc. is a private AI safety company headquartered in San Francisco, California. Anthropic develops the Claude family of large language models and provides API access to these models through a commercial service.
Claude API for automated document data extraction, classification, and tax compliance review (invoice line item extraction, vendor identification, field-level data structuring).
Customer documents stored in AWS Frankfurt are transmitted over TLS to Anthropic's API endpoint for processing. The API returns structured extraction results, which are stored back in AWS Frankfurt. Under the applicable DPA, Anthropic does not retain input or output data beyond the API transaction and does not use customer data for model training.
Anthropic is a private AI company, not a telecommunications provider. This lowers baseline FISA Section 702 exposure compared to major tech conglomerates or telecoms. However, as a US-based company, Anthropic remains subject to FISA, Executive Order 12333, and CLOUD Act obligations.
Risk of receiving a government data access request: Low-to-Medium.
Status: ACCEPTABLE WITH CONDITIONS
Conditions: (1) Maintained contractual no-retention commitment; (2) No use of customer data for model training; (3) Annual verification of Anthropic's contractual commitments; (4) Continued encryption of all API traffic.
Google LLC is a wholly owned subsidiary of Alphabet Inc., headquartered in Mountain View, California. Google is one of the world's largest technology companies and a known recipient of US government data access requests across multiple business lines.
Customer documents and derived text are transmitted over TLS to Google's processing endpoints. Document AI and Vertex AI process data within EU regions. Gemini API calls are served via Google's global endpoint. Under the applicable DPA, Google does not retain customer data beyond the API transaction and does not use it for model training.
Google is a large technology company with a significant US government and law enforcement client base. Public disclosures indicate that Google receives a substantial volume of government data access requests annually.
Risk of receiving a government data access request: Medium-to-High.
Google's DPF certification demonstrates compliance with enhanced US safeguards (Executive Order 14086) and creates contractual obligations to limit surveillance to what is necessary and proportionate. The DPF also establishes a Data Protection Review Court mechanism allowing foreign nationals to challenge US government surveillance orders.
Status: ACCEPTABLE WITH CONDITIONS
Conditions: (1) Maintained DPF certification and continued participation in the EU-US DPF; (2) Contractual no-retention commitment for all used Google AI services; (3) No use of customer data for model training or secondary purposes; (4) Annual verification of DPF certification status and contractual commitments; (5) Continued encryption of all API traffic.
Microsoft Corporation is a US technology company headquartered in Redmond, Washington. Microsoft provides identity, productivity, and cloud services used by Orcha and its customers.
For SSO authentication, user identity data (email, name, tenant ID) flows between Microsoft and Orcha as part of the OAuth/OIDC protocol. For Outlook email acquisition, Orcha accesses email data held at Microsoft using customer-granted OAuth tokens; subscription mechanisms are maintained to receive push notifications of new messages. For Teams notifications, Orcha transmits notification messages containing document processing status.
Microsoft is a large US technology company subject to FISA, Executive Order 12333, and CLOUD Act obligations. Microsoft regularly receives and responds to government data access requests, and publishes regular transparency reports.
Risk of receiving a government data access request: Medium-to-High.
Microsoft's DPF certification creates contractual obligations for proportionality and redress. Microsoft has publicly committed to challenging overbroad government requests and has litigated such cases.
Status: ACCEPTABLE WITH CONDITIONS
Conditions: (1) Maintained DPF certification; (2) Encrypted transit (TLS); (3) Customer-granted OAuth scope for mailbox access; (4) Annual verification of DPF certification status.
Slack Technologies, LLC is a US-based communications platform headquartered in San Francisco, California, operated as a subsidiary of Salesforce, Inc.
Slack API (chat.postMessage) for delivering notifications to customer-configured Slack workspaces.
When a customer configures a Slack channel as a notification target, Orcha transmits notification messages over TLS to Slack's API. Messages contain document processing status and may include supplier names and document references.
As a US-based communications provider, Slack is subject to FISA, Executive Order 12333, and CLOUD Act obligations.
Risk of receiving a government data access request: Medium.
The data transmitted to Slack is limited to notification messages; customer documents themselves are not transferred to Slack.
Status: ACCEPTABLE WITH CONDITIONS
Conditions: (1) DPA in place with Salesforce covering Slack services; (2) Encrypted transit (TLS); (3) Limited data scope as described.
Amazon Web Services EMEA SARL (Luxembourg) provides cloud infrastructure services. AWS is a subsidiary of Amazon.com, Inc. (USA). While Orcha's data is hosted in the EU (AWS Frankfurt, eu-central-1), AWS as a US-owned company is subject to US jurisdiction, which warrants a transfer risk assessment even though data does not leave the EU.
Cloud hosting, compute (EC2), relational database (RDS), object storage (S3), message queuing (SQS), authentication (Cognito), key management (KMS), email receiving and sending (SES), secrets management, and backup services. AWS is the primary infrastructure provider for the Orcha platform.
All customer data at rest is stored exclusively within the AWS Frankfurt data centre (eu-central-1, Germany). No customer data is transferred to or stored in any AWS region outside the EU. AWS provides contractual commitments to process data only in the selected region.
Primary position: No third-country transfer occurs. Data is processed and stored exclusively in the EU (Frankfurt). However, as AWS is a US-owned entity, the following safeguards apply as a precautionary measure:
Amazon is a large US technology company with significant government contracts. FISA Section 702 and CLOUD Act exposure is elevated. However, the critical mitigating factor is that all customer data resides in the EU -- any US government request would face jurisdictional challenges under EU blocking regulations and GDPR Article 48.
Risk of a government data access request affecting EU-stored data: Low.
The EU data residency commitment, combined with GDPR Article 48 protections, creates a strong legal barrier against extraterritorial US access requests.
Status: ACCEPTABLE
Rationale: No actual third-country transfer occurs. Data remains in the EU at all times. AWS's US ownership creates a theoretical jurisdictional risk, but this is effectively mitigated by EU data residency, encryption, and GDPR Article 48 protections. No additional conditions required beyond maintaining the current EU-only hosting configuration.
Orcha has assessed data transfers to Anthropic, Google, Microsoft, Slack, and AWS in accordance with EDPB Recommendations 01/2020 and the six-step assessment framework. Based on the combination of contractual commitments, transport encryption, EU primary storage, and DPF certification where applicable, transfers are permissible under Article 46 GDPR and UK GDPR Chapter V.
Data Protection Contact / Data Protection Officer
Signature: ________________________ Date: ________________
Technical Lead
Signature: ________________________ Date: ________________
Managing Director
Signature: ________________________ Date: ________________
| Version | Date | Changes | Author |
|---|---|---|---|
| 1.0 | 25.03.2026 | Initial version | [Name] |
| 2.0 | April 2026 | Extended assessment with proactive OpenAI pre-approval; detailed supplementary measures | [Name] |
| 3.0 | 12.04.2026 | Aligned with current sub-processor list: removed OpenAI, added Microsoft and Slack; corrected AWS services list and encryption description; revised data flow and supplementary measures to reflect actual implementation | [Name] |