Analysis of extraterritorial laws

Change log

1. Entity and corporate structure

1.1. Xeneural Technologies E.I.R.L. is a sole-owner limited liability company (empresa individual de responsabilidad limitada) incorporated in Peru (RUC 20606521261), with its tax domicile and office in Arequipa. Its owner is a natural person. It has no parent company.

1.2. Xeneural has no subsidiaries, branches or establishments in the United States, in China or in Russia.

1.3. The law governing the processing of personal data by Xeneural is Peruvian law: Personal Data Protection Law 29733 and its Regulations, approved by D.S. 016-2024-JUS. For customers in the European Economic Area, the standard contractual clauses of the Data Processing Agreement also apply.

2. Laws analysed

3. Exposure through the subprocessors

3.1. The subprocessors that host customer content are United States companies and, as such, are subject to the CLOUD Act and to FISA section 702. This is the only route through which those laws can reach the data of a Xeneural customer.

3.2. Each subprocessor contractually assumes the following commitments in the event of a request from an authority:

4. Xeneural's measures

4.1. Encryption. Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256 in the database, in file storage and in backups. The customer's integration secrets are additionally encrypted with AES-256-GCM and dedicated keys.

4.2. Segregation and least access. Each customer's data is logically segregated and every operation is limited on the server to the organisation of the authenticated user.

4.3. Transfers. For customers in the European Economic Area, the United Kingdom or Switzerland, the Data Processing Agreement incorporates the standard contractual clauses of the European Commission (Decision 2021/914), including the assessment of the laws of the country of destination (clause 14) and the obligations in the event of requests from authorities (clause 15). For customers in Peru, the cross-border flow is governed by article 15 of Law 29733 and articles 18 to 21 of its Regulations.

4.4. Xeneural's own commitment in the event of a request. If Xeneural receives a request from an authority, Peruvian or foreign, it verifies the authority's competence and the legal basis of the request, redirects it to the customer where the law permits, notifies the customer before disclosing data unless legally prohibited, discloses only what is strictly required and challenges excessive requests. Each request is logged and published in the Transparency Report.

4.5. Track record. Xeneural has not received any request from an authority, Peruvian or foreign, to access the data of its customers (Transparency Report).

4.6. Review. This analysis is reviewed every year and whenever a subprocessor is added or the legislation analysed changes.

5. Conclusion

Xeneural is a Peruvian company with no parent company and no presence in the United States, China or Russia, and it is not directly subject to foreign data access laws. The indirect exposure, through its United States subprocessors, is mitigated by their contractual commitments, by the encryption and segregation of the data, by the standard contractual clauses for European customers and by Xeneural's own commitment to notify the customer and challenge excessive requests.

6. Sources