International data transfer checker
A public surface scan that flags the countries, vendors and CDNs your homepage talks to — the inputs you need for an Art. 44 GDPR assessment.
Each non-EU signal is shown with the vendor's registered jurisdiction, not just an IP.
A public surface scan that flags the countries, vendors and CDNs your homepage talks to — the inputs you need for an Art. 44 GDPR assessment.
Under GDPR Articles 44–50, transferring personal data outside the EU/EEA requires an adequacy decision, Standard Contractual Clauses, or another Article 46 mechanism. The scanner does not read your contracts — it surfaces the public signals you would use in a Chapter V assessment, so a privacy or compliance lead can start with a real map rather than guesswork.
An observed endpoint in the EU does not end a transfer: vendor jurisdiction may still be outside the EEA, and a US-headquartered vendor with an EU edge is still subject to US FISA 702 / Executive Order 12333 risks. EDPB Recommendations 01/2020 recommend supplementary measures on top of SCCs for these cases.
No scanner can. It lists the public signals you would feed into a Chapter V assessment (vendors, jurisdictions, endpoints). The legal conclusion is yours, with your DPO, and depends on the categories of personal data involved and the safeguards in place.
After the CJEU Schrems II ruling (C-311/18), transfers to US-headquartered vendors rely on the EU–US Data Privacy Framework, SCCs, or derogations. The scanner flags US-jurisdiction vendors; it does not opine on whether your specific safeguards are sufficient.
A US-headquartered vendor serving traffic from an EU edge still creates a Schrems II question. Surfacing the registered jurisdiction next to the IP group is the only way to make that distinction visible on a single screen.