How are data transfers to third countries secured?
amaise provides dedicated data zones for the EU, CH, and US. Customer data remains strictly within the assigned region:
EU data zone: Core data processing (documents, database, AI) takes place in the EU/Switzerland.
CH data zone: Swiss customer data is stored and processed exclusively in Switzerland (AWS Zurich, Azure OpenAI Switzerland North).
US data zone: Core data processing takes place in the USA. Data never leaves the USA.
Supporting services with a US connection do not process customer document content:
Auth0/Okta — User login data and authentication events (US customers in the Auth0 US region; EU and CH customers in the Auth0 EU region)
Twilio — Delivery of SMS one-time codes for MFA (phone number only)
Intercom — Support chat and Help Center (name, e-mail address, and organization of the user, support conversations)
Sentry — Error reports (configured to minimize personal data; pseudonymous user ID only)
Mixpanel — Product analytics (name and e-mail address of the signed-in user, text entered into search and filter fields, questions asked of the pilots, session replay with all text masked; no document content, no search results). Data is stored in Mixpanel's EU data region.
Slack — Internal communication (feedback on AI answers, with the user's e-mail address)
Gravatar — Profile pictures (one-way hash of the e-mail address)
Perplexity — Optional web research, only when the research sources or LegalPilot are activated for a workspace (search queries and LegalPilot questions; no documents)
The complete list is in the subprocessor overview.
All transfers to the USA are secured by GDPR Standard Contractual Clauses (SCCs) and the respective vendor DPAs. For every US transfer, a Transfer Impact Assessment (TIA) according to Schrems II has been conducted and documented. The TIA documentation is available to customers upon request.
The USA is not on the Swiss FDPIC adequacy list — therefore, SCCs and supplementary measures (TIA) are required.