Legal

Cross-border transfer schedule

This schedule summarizes cross-border processing for AI Team, operated by Akii Technologies, Ltd. Default deployment uses EU/international providers unless a separate in-country deployment is explicitly contracted and evidenced.

Version and owner

Effective 2026-06-25. Owner: legal-compliance. Transfer records must stay aligned with the subprocessor list, model routing, provider governance, and signed DPA.

DIFC transfer rules and UAE Federal PDPL compatibility are reviewed for relevant client processing.
Cross-border processing must be disclosed with provider, location, purpose, data class, and safeguard basis.
Provider region claims must match current provider documentation and production evidence.

Default posture

AI Team's standard stack is designed for ordinary business workflows and uses EU/international providers.

Supabase and Railway public region docs should be checked before any regional hosting claim is made.
Current public positioning must not imply in-country hosting for the standard deployment.
Clients with strict residency requirements require manual review and a separate architecture decision.

Transfer records

Each client Agent should have a transfer assessment before go-live when personal data or client workflow data crosses jurisdictions.

The assessment records client jurisdiction, data classes, provider locations, subprocessors, model route, transfer basis, and residual risk.
Transfer approval must be linked to subprocessor approvals and the AI system register.
Material provider or region changes require review before production use.

Manual-review triggers

Some workflows require manual review before transfer approval.

Public sector, education/minors, legal privileged data, sensitive data, residency-sensitive work, and high-impact HR are manual-review categories.
Healthcare providers, medical workflows, regulated financial firms, and regulated financial workflows are rejected or escalated outside standard setup.
If a client requires all processing inside the UAE, the standard stack is not enough without a separately evidenced deployment.

Client-owned tools

Client-owned CRMs, mailboxes, ecommerce systems, HR systems, analytics tools, payment tools, and storage providers remain under client control.

Clients are responsible for their own vendor terms, regions, permissions, retention settings, and privacy notices.
AI Team records connected tools, access scopes, revocation paths, and provider restrictions during setup.
Connected-tool data is not automatically deleted by deleting records inside AI Team.

Next step

Need help applying this policy?

Start with setup so AI Team can confirm the work, required access, approval rules, pass-through costs, and go-live requirements.

Start setup Contact AI Team

Version and owner

Effective 2026-06-25. Owner: legal-compliance. Transfer records must stay aligned with the subprocessor list, model routing, provider governance, and signed DPA.

DIFC transfer rules and UAE Federal PDPL compatibility are reviewed for relevant client processing.

Cross-border processing must be disclosed with provider, location, purpose, data class, and safeguard basis.

Provider region claims must match current provider documentation and production evidence.

Default posture

AI Team's standard stack is designed for ordinary business workflows and uses EU/international providers.

Supabase and Railway public region docs should be checked before any regional hosting claim is made.

Current public positioning must not imply in-country hosting for the standard deployment.

Clients with strict residency requirements require manual review and a separate architecture decision.

Transfer records

Each client Agent should have a transfer assessment before go-live when personal data or client workflow data crosses jurisdictions.

The assessment records client jurisdiction, data classes, provider locations, subprocessors, model route, transfer basis, and residual risk.

Transfer approval must be linked to subprocessor approvals and the AI system register.

Material provider or region changes require review before production use.

Manual-review triggers

Some workflows require manual review before transfer approval.

Public sector, education/minors, legal privileged data, sensitive data, residency-sensitive work, and high-impact HR are manual-review categories.

Healthcare providers, medical workflows, regulated financial firms, and regulated financial workflows are rejected or escalated outside standard setup.

If a client requires all processing inside the UAE, the standard stack is not enough without a separately evidenced deployment.

Client-owned tools

Client-owned CRMs, mailboxes, ecommerce systems, HR systems, analytics tools, payment tools, and storage providers remain under client control.

Clients are responsible for their own vendor terms, regions, permissions, retention settings, and privacy notices.

AI Team records connected tools, access scopes, revocation paths, and provider restrictions during setup.

Connected-tool data is not automatically deleted by deleting records inside AI Team.