EXA39
— Keep data inside borders —
Cross-Border Data Transfer
After Schrems II, transfers need supplementary measures.
The problem to solve
Every EU-to-non-EU data transfer under GDPR requires SCC + transfer-impact assessment + data-protection assessment. The legal framework requires controls to mitigate risk; the technical reality is the data crosses + the recipient holds it as plaintext + Schrems II says you have to assume hostile-foreign-surveillance access. The compliance paperwork exists but the underlying risk doesn't actually mitigate.
The solution it enables
Schema-wrap the data flow. The recipient unseals only the fields its schema permits (the actual purpose of the transfer); the other fields stay sealed under keys held in the EU. SCC compliance gains a technical control alongside the paperwork.
What it looks like
An EU-headquartered SaaS provider transfers customer support tickets to a non-EU support hub for 24/7 coverage. Today: tickets land plaintext on non-EU storage; SCC + DPA + Standard Contractual Clauses are in place; compliance signed off; Schrems II residual risk acknowledged in legal but not technically mitigated. After Polymonial: tickets sealed at the EU-hub egress. Non-EU support team's schema unseals issue-resolution fields; PII fields stay sealed in the non-EU storage. The non-EU jurisdiction can subpoena the stored data, but the PII fields stay sealed without the EU-held keys.
“After Schrems II, paperwork needs a technical control. Polymonial keeps the personal data sealed under keys that stay in the EU.”
Who’s this for you?
We have this problem.
Your organisation needs this for its own data, product or programme of work.
We deliver this for clients.
A consultancy, integrator, service provider, industry programme or technology vendor.