Glean stores and processes data in the US and other countries, and for EU/UK users, it relies on Standard Contractual Clauses to make those transfers legally compliant.
If you use Glean in the EU or UK, your personal work data is transferred to and stored in the United States, which is subject to US government surveillance laws and requires legal protections (SCCs) that must be actively maintained.
Cross-platform context
See how other platforms handle Cross-Border Data Transfers and similar clauses.
Compare across platforms →Cross-border data transfers to the US remain a live compliance risk post-Schrems II, and reliance on SCCs requires documented supplementary measures — any gap in this process exposes both Glean and its enterprise customers to GDPR enforcement.
REGULATORY FRAMEWORK: GDPR Chapter V (Articles 44–49) governs international transfers; Article 46(2)(c) authorizes transfers under SCCs. The EU-US Data Privacy Framework (DPF, adequacy decision July 2023) provides an alternative mechanism for US companies that self-certify. UK International Data Transfer Agreements (IDTAs) apply post-Brexit. Swiss Federal Act on Data Protection (nFADP, effective September 2023) applies to Swiss transfers. The CJEU Schrems II decision (C-311/18) remains controlling precedent requiring supplementary measures analysis.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.