Data Transfer Impact Assessment

§1. Introduction and Scope

HumanKey (AI Traffic Intelligence) provides website publishers and e-commerce operators with detection and classification of AI crawlers and other automated visitors, and traffic analytics. To deliver the Services, HumanKey engages a limited set of sub-processors, some of which are established outside the EEA. This assessment documents the transfer impact analysis for those transfers and the supplementary measures HumanKey applies to ensure a level of protection essentially equivalent to the GDPR.

This assessment should be read alongside HumanKey's Data Processing Agreement, Data Protection Impact Assessment summary, and Sub-Processors page.

1.1 Legal basis for transfer

HumanKey relies on the following transfer mechanisms under Chapter V of the GDPR:

• Standard Contractual Clauses (SCCs). The European Commission's standard contractual clauses (Decision (EU) 2021/914) are the default mechanism for transfers to sub-processors that are not DPF-certified.
• EU-US Data Privacy Framework (DPF). Where a sub-processor is actively certified under the Data Privacy Framework, HumanKey relies on the DPF adequacy decision of 10 July 2023 alongside (not in place of) the SCCs as a defence in depth.

1.2 Scope of assessment

This assessment covers every sub-processor on HumanKey's published sub-processor list that (a) is established outside the EEA, or (b) is a controlled subsidiary of a parent entity established outside the EEA and may therefore be subject to third-country legal process. Neon (Frankfurt), Railway (Amsterdam) and Sentry (EU region) host HumanKey's production data within the EEA. They are, however, incorporated in the United States; any access to that data from the United States (for example control-plane or support access) is covered by Standard Contractual Clauses, and these sub-processors are therefore within the scope of this assessment.

§2. Destination-country analysis

The only destination country for HumanKey sub-processor transfers is the United States of America. The categories of data, purpose, frequency, and transfer mechanism are documented below following the methodology in Annex 3 of the EDPB Recommendations.

2.1 United States

This assessment is based on publicly available legal authorities. It does not purport to resolve the ongoing debate around the adequacy of United States law following Schrems II and is not legal advice.

§3. Supplementary measures

HumanKey applies technical, contractual, and organisational supplementary measures to ensure that personal data transferred to United States sub-processors benefits from a level of protection essentially equivalent to the GDPR.

3.1 Technical measures

• IP pseudonymisation at the application layer. HumanKey pseudonymises visitor IP addresses before they are stored or passed to any sub-processor for storage or analysis (short-lived security counters excepted), using a keyed HMAC-SHA256 with a secret key and a daily-rotating salt. The key is kept separately from the stored data, and the design is intended to prevent linking stored records across days. Network-edge providers (CDN, DDoS protection, hosting) necessarily see the IP address in transit in order to route and protect the request.
• User-Agent truncation. User-Agent strings are truncated to 200characters before storage, reducing fingerprint surface while preserving the signal needed for bot classification.
• Session recording input masking (suspended feature). The HumanKey recorder pipeline masks password inputs and any element marked data-privacy="mask" client-side before events would be transmitted to storage. Masked content never leaves the visitor's browser. Note: session recording is currently suspended on all plans (replaced by Bot Evidence Reports); the pipeline code is retained, but re-enablement would require a multi-step engineering change, not an on-request toggle.
• EU jurisdiction for session recording storage (suspended). Were the session recording pipeline ever re-enabled, it would store events in a Cloudflare R2 bucket configured with EU-jurisdiction restrictions; playback would be proxied through the HumanKey API so no direct bucket URL is exposed to client browsers. The pipeline is not active on any plan following our 2025 strategic review.
• Minimised flow to the AI sub-processor. Each AI feature sends Anthropic only what it needs. The public AI Assistant sends the text the user types, a system prompt assembled by HumanKey and, for signed-in users, coarse account context (such as plan tier, number of sites, feature usage, a traffic-volume band) — never an e-mail address, name, domain, IP address or session identifier; typed text contains personal data only if the user enters it. Advisory analytics and automated bot research send aggregated statistics, User-Agent strings of visits classified as automated and identifier-free numeric session features — never an IP address, IP hash or session identifier. Customer-facing features (traffic insights, crawler recommendations, the daily-report sentence) send aggregate per-site and per-crawler counts and, depending on the feature, the site's domain, its public robots.txt and its crawler allow/block settings.
• Short-lived authentication tokens. Short-lived access tokens with automatic refresh token rotation.
• Encryption in transit and at rest. TLS 1.2 or higher with HSTS for all transport; AES-256 at rest via the managed database platform.

3.2 Contractual measures

• The transfer basis for each sub-processor is shown in its entry on HumanKey's Sub-Processors page.
• Before a sub-processor of Controller data is added or replaced, the Controller is informed in advance by e-mail and on the register page and may object (DPA, Section 5.4).
• Audit and information rights under Section 5.8 of the DPA.
• Assistance with personal-data-breach obligations under Section 5.6 of the DPA (Art. 33(2) GDPR).
• The AI advisory sub-processor (Anthropic) retains inputs and outputs for up to 30 days for trust and safety, then generally deletes them (subject to limited trust-and-safety exceptions), and does not use them to train its models.

3.3 Organisational measures

• Published sub-processor list maintained as the single source of truth, updated before a sub-processor of Controller data is added or replaced, with advance information to account holders (DPA, Section 5.4).
• Documented request-handling channel for law-enforcement and supervisory authority requests. All such requests are routed through the HumanKey legal contact form.
• A review of the DPIA when the risk represented by the processing changes — including a material change to the sub-processor stack or to destination-country law.
• GDPR data-subject rights tooling (JSON export, cascading deletion, rectification) is available to every Controller regardless of plan tier and does not depend on any US sub-processor being reachable.