Cross-border Data Transfers
S1 / S2 / S3 flows, the GDPR–PIPL squeeze, and the five decisions still blocking launch.
COMPLIANCE_C2.md, not a legal opinion. It relies on 2026-11 public regulatory information and Baidu public materials. A licensed lawyer must assess the final entity and data flows before launch.1. Status
This notice explains why the gateway is split into two editions and why a domestic Qianfan key can never serve an international request. It is a design document made public for transparency.
2. Conclusion first
The compliance lifeline is keeping international traffic off mainland-China servers. Once data enters mainland China it is squeezed from both sides: GDPR has no adequacy decision for China (EU→CN), and PIPL export rules apply if tokencoup is a Chinese entity. If the Qianfan International upstream is confirmed to operate an overseas node, an overseas gateway plus that node would narrow the exposure to a single jurisdiction — that condition is not yet verified.
3. The three data flows
| Flow | Path | Jurisdiction | Risk | Decision |
|---|---|---|---|---|
| S1 — intl + Mode B resale | US/EU user → overseas gateway → Qianfan International upstream (intended overseas node, unverified) | Intended: node country outside mainland China; actual residency unconfirmed | Medium only if confirmed; otherwise EU→CN exposure | 🟡 Target path — blocked until written residency confirmation |
| S2 — cn + Mode A domestic key | CN user → domestic site → Qianfan Domestic | Mainland China only, PIPL domestic processing | Low, closed path | ✅ Allowed, CN users only |
| S3 — intl + Mode A but domestic key | US/EU user → overseas gateway → Qianfan Domestic China node | GDPR EU→CN (no adequacy) and PIPL export if tokencoup is a Chinese entity | High | ⛔ Permanently prohibited in code |
4. S3 is blocked in code
gateway/common.py validates that the provider key's edition matches the serving edition. A mismatch returns 403 key_edition_mismatch; any key not explicitly registered in the edition registry fails closed with 403 key_edition_unknown — key prefixes are deliberately NOT used to infer the edition, because domestic and international Qianfan keys share the same bce-v3/ALTAK- prefix. Mode B is additionally disabled on the domestic edition (403 mode_B_not_allowed_on_cn).
5. GDPR side
- No EU adequacy decision for mainland China (confirmed 2026-10; no agenda).
- EU→China transfers require EU SCCs (2021/914) + a Schrems II transfer impact assessment + supplementary measures.
- If the Qianfan International node is in Singapore (adequacy) or Frankfurt (inside the EU), the EU→node leg may need no SCC; the tokencoup↔Baidu contractual leg still needs review.
- Default to not persisting prompts — keep only billing metadata, minimising the personal-data footprint.
- B2B: sign SCCs with customers. B2C: explicit consent plus a downloadable TIA summary.
See the GDPR notice for rights and legal bases.
6. PIPL side
Applies if tokencoup has a Chinese entity or if international traffic passes through mainland China. Three export paths are available (complete as of 2026-01):
| Path | When | Note |
|---|---|---|
| CAC security assessment | CIIO / important data / >1M people cumulative or >10k sensitive records | Mandatory; valid 2–3 years |
| Standard contract (SCC) | Non-CIIO, 100k–1M non-sensitive or <10k sensitive | Provincial CAC filing + PIPIA |
| Certification | Same thresholds | Effective 2026-01-01; suited to continuous intra-group flows |
| Exemption (<100k non-sensitive) | Below thresholds | Still requires separate consent, PIPIA, and disclosure of the overseas recipient |
7. The unverified factual dependency
Public materials (2023–2025) indicate intl.cloud.baidu.com is a separate international entity with overseas nodes including Hong Kong (China), Singapore, Frankfurt and Silicon Valley; Baidu reportedly has no self-operated US data centre. This has not been verified for the Qianfan API endpoint tokencoup will actually call.
8. Five decisions blocking S1 launch
- Entity jurisdiction — recommended: offshore entity for intl, separate Chinese entity for cn (dual-entity isolation).
- B2B vs B2C — B2B favours SCC + contract constraints; B2C needs explicit consent and a TIA summary page.
- Whether to log prompts — default no (recommended); quality-tuning use would need notice + separate consent.
- Qianfan International residency region — verify the live endpoint after account activation.
- Gateway deployment region — overseas edge (Cloudflare / Vercel) or AWS Singapore / Frankfurt.
Until these are decided, S2 (domestic Mode A) and the framework guards may proceed, but S1 resale must not go live.
9. Technical measures already implemented
| Measure | Where | Effect |
|---|---|---|
| Key-edition validation (F2) | gateway/common.py | Blocks S3 with 403 key_edition_mismatch |
| Edition-scoped modes (F6) | gateway/config.py | cn allows only Mode A |
| International-only CF Gateway | gateway/cf_gateway.py | Domestic requests stay direct — no US edge hop |
log_prompt=false (intl) | gateway/config.py | No prompt persistence on the international path |
collect_logs=false | Cloudflare AI Gateway tokencoup | No request/response bodies stored at the edge |
X-Data-Region: overseas | Upstream headers (F3) | Explicit residency mark on international calls |
COMPLIANCE_C2.md proposes log_prompt=false for the domestic edition, but gateway/config.py currently sets cn.log_prompt=true. The code is the shipped truth; the plan and the Privacy Policy both flag this as an open item.10. Notice and consent
B2B customers will receive SCCs and a sub-processor list. B2C users will be shown a clear notice and, where required, asked for separate consent with a downloadable TIA summary. Neither is implemented yet, and no live EU traffic is being processed.
11. Contact
To be designated with the final operating entity. This draft is based on 2026-11 public regulations and Baidu public materials, is not legal advice, and must be replaced by a lawyer-reviewed notice before launch.