<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cross-Border Data Transfers — API Reference

## Scan Infrastructure

```bash
node scripts/agent.js --action scan-infra --provider aws
```

## Map Vendors

```bash
node scripts/agent.js --action map-vendors \
  --vendors '[{"name":"Vendor","country":"US","mechanism":"SCCs"}]'
```

## Validate Transfers

```bash
node scripts/agent.js --action validate --transfers /tmp/transfer_map.json
```

## Classify Country

```bash
node scripts/agent.js --action classify-country --country "Brazil"
```

## Transfer Classification

| Status | Mechanism Required | Risk |
|--------|-------------------|------|
| eea | None | None |
| adequate | Art. 45 adequacy | Low |
| dpf_eligible | EU-US DPF (verify recipient) | Medium |
| non_adequate | Art. 46 SCCs/BCRs + TIA | High |

## AWS Region Mapping

| Region | Country | Status |
|--------|---------|--------|
| eu-west-1 | Ireland | EEA |
| eu-central-1 | Germany | EEA |
| us-east-1 | United States | DPF eligible |
| ap-northeast-1 | Japan | Adequate |
| ap-southeast-1 | Singapore | Non-adequate |
| sa-east-1 | Brazil | Non-adequate |

## Valid Transfer Mechanisms

| Mechanism | GDPR Article | When to Use |
|-----------|-------------|-------------|
| Adequacy decision | Art. 45 | Country on EU adequacy list |
| SCCs | Art. 46(2)(c) | Most vendor transfers |
| BCRs | Art. 47 | Intra-group multinational |
| DPF | Art. 45 (US) | US companies on DPF list |
| Derogation | Art. 49 | Explicit consent, contract |
