International data transfer
Sending personal data outside the country. Since the relevant LLM providers are foreign, it is intrinsic to using AI — governance's job is to control, reduce and prove what leaves.
Why it matters
International data transfer is the sending of personal data outside the country. In AI usage it isn't an exception to avoid — it's the rule, because the most relevant model providers are foreign. Every time a prompt with personal data goes to one of those models, an international transfer is happening, whether the company wants it or not. It matters because what leaves the country crosses a border where data-protection rules may be different, and the organization's control over that data diminishes.
Ignoring that fact doesn't make the transfer stop happening; it only makes the company not know that it happens. And a transfer no one maps is a transfer impossible to justify, reduce, or prove. The starting point of compliance here is the same as for Shadow AI: making visible what was invisible.
How it works
Because it's intrinsic to AI usage, international transfer isn't eliminated — it's governed. Governing means three concrete things. Control: decide what may leave, masking or blocking the personal data that shouldn't cross the border. Reduce: lower the volume of personal data in prompts, sending out the minimum necessary instead of everything by habit. Prove: keep a record of what was sent, to which provider, and under which rule, so the company can demonstrate — not merely assert — what crossed the border.
The point where these three actions are feasible is the same: the layer the call passes through before reaching the provider. That's where the content can be inspected, the rule applied, and the event recorded. Outside that single point, the control becomes good intentions scattered across code no one audits.
How Horse Labs handles it
Horse Labs treats international transfer through visibility and control at the gateway, not through a legal promise. With pre-call DLP, personal data can be masked or blocked before it leaves; with the audit trail, what was actually sent and to which provider is recorded. The company gains the ability to answer, with evidence, what crosses the border on each call — the foundation on which the legal team builds the compliance justification.
Nuance
It's worth being honest about the limit: the governance layer controls and proves what leaves, but it doesn't replace the legal analysis of a lawful basis nor the contractual guarantees with the provider. Compliance in international transfer is a matter of law, not only of engineering. What the technology delivers is the input the legal team can't produce on its own — visibility into what actually left and control over what leaves. Treating the tool as if it did the whole compliance job is the mistake to avoid; treating it as the evidence that underpins compliance is the correct use.