1. Introduction
This Transfer Impact Assessment evaluates the risks associated with the specific data transfer path covered by the scoped Standard Contractual Clauses at /legal/sccs. It follows the post-Schrems II approach: describe the transfer, analyse the legal environment of the destination country, assess the practical risk, and set out the supplementary measures that reduce it.
2. Transfer Description
Aletheia by Lonia AI transfers image content and text prompts from the user's browser, through Lonia's Cloudflare Worker infrastructure (United States hosted), to OpenRouter (United States hosted), which forwards the request to an underlying AI model provider. The response returns via the same path. The data subjects are Personal or Family tier consumer users who have explicitly enabled Enhanced AI. Image data is transient; it is not persisted anywhere except in the user's browser IndexedDB after the response returns.
3. Legal Environment Analysis (United States surveillance law)
- The United States is not on the European Commission's list of countries with an adequacy decision as of the publication date.
- Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333 empower United States government access to data held by United States electronic communications service providers.
- The Schrems II decision (CJEU C-311/18) invalidated the Privacy Shield framework in July 2020.
- The EU-US Data Privacy Framework, effective July 2023, provides adequacy for participating United States organisations. Neither Lonia AI nor OpenRouter currently participates in the Data Privacy Framework; this is to be verified at publication and on each review.
4. Aletheia's Assessment of Practical Risk
- The data transferred is transient image content and text prompts. It is not persisted at OpenRouter beyond the synchronous request and response cycle.
- No account-linked identifiers are transmitted to OpenRouter. Aletheia does not send a user identifier, email address, or session token in the API request.
- The volume of transfer is bounded by cap enforcement: 500 descriptions per month per user on Personal, and 1000 per month shared per family group on Family.
- The data subjects are consumer users, not government or law enforcement subjects.
5. Supplementary Measures
- Technical: TLS 1.3 in transit; no image logging in the Lonia Worker; no image persistence server-side; the image is processed synchronously and discarded.
- Contractual: the scoped Standard Contractual Clauses (Module 2) at /legal/sccs, and Aletheia's account-level agreement with OpenRouter as sub-processor.
- Organisational: Personal and Family tier users are informed of Enhanced AI's cloud transit path in the Privacy Policy. Users can opt out at any time by turning Enhanced AI off, and it defaults to off.
6. Residual Risk Assessment
Residual risk is assessed as LOW after the applied supplementary measures. Transient image data with no persistent identifier association at the importer significantly limits the utility of any surveillance access.
7. Ongoing Monitoring
Aletheia commits to reassessing this Transfer Impact Assessment:
- annually at minimum;
- upon a material change in United States surveillance law or CJEU jurisprudence;
- upon a material change in OpenRouter's security or data handling posture; and
- if Aletheia migrates its Supabase primary data store to an EU region in the future, since that could affect the overall data flow architecture.
8. Conclusion
Aletheia's assessment is that the transfer path can proceed with the Standard Contractual Clauses (Module 2) and the supplementary measures documented above. Residual risk is LOW.
9. Contact
Questions about this assessment can be sent to legal@lonia.ai.
Related documents
- Transfer Impact Assessment (tagged PDF)
- Scoped Standard Contractual Clauses (SCCs)
- Data Protection Impact Assessment (DPIA)
- Data Processing Agreement (DPA) template
- Sub-processor list
- Privacy Policy
This assessment records Aletheia's evaluation of the covered transfer. It is not legal advice.