solutions / offshore-processing
Offshore processing
Transfer rules apply to the data, not to your intentions for it.
The problem
Support desks, claims processing, and annotation work often sit in a different jurisdiction from the people in the records. The legal apparatus around that transfer — assessments, clauses, supplementary measures — is expensive precisely because the underlying data is identifying. Much of the work does not need it to be.
What Divelai does
Sanitize at the boundary so the team offshore works with pseudonymised records. They can still process a case end to end, because tokens are consistent within the case. Values are rehydrated when results return to the originating region, and the transfer log shows exactly which categories crossed and under which policy.
What this does not solve
Pseudonymised data is still personal data under GDPR — it reduces risk and supports your safeguards argument, it does not remove the transfer from scope. Whether your specific arrangement is lawful is a question for your counsel, not for a vendor page.
# Region-scoped tokens; vault stays in-region. scope: tenant vault_region: eu-central-1 rehydrate_in: [eu-central-1] transfer: to: ap-south-1 tokenise: [pii.person, pii.email, pii.phone] redact: [pii.national_id, pci.pan] log: categories # art. 30 evidence