“U.S.” must cover the whole route.
Processing, storage, logging, support access, subprocessors and failover locations must be identified; a U.S. API endpoint alone is insufficient.
Start with the data.
Then choose a route.
This conservative matrix describes the public qualification program today. “Review” means the workload may be evaluated; it does not mean the route, provider or compliance obligation is approved.
| Workload / data | Global Value | Global Balanced | U.S. Protected | Current requirement |
|---|---|---|---|---|
| Public or synthetic data | REVIEW | REVIEW | REVIEW | Preferred qualification input; supplier route still required |
| Ordinary non-sensitive business data | LIMITED | REVIEW | REVIEW | Minimize content and document the use case |
| Trade secrets / source code | NO | NO | SEPARATE REVIEW | Requires written security, retention and access controls |
| Medical PHI / HIPAA | NO | NO | NO | No BAA or HIPAA-eligible route is publicly available |
| Financial-core / payment data | NO | NO | NO | No PCI or regulated financial route is publicly available |
| Government / defense / CJIS | NO | NO | NO | Excluded from the general qualification program |
| Biometric, precise location or identity data | NO | NO | NO | Excluded pending specialist privacy review |
| Export-controlled or sanctioned-party data | NO | NO | NO | Do not submit; legal screening required |
No public BAA, DPA or SLA is active.
Any required agreement must be reviewed and signed for the selected supplier route before relevant data is submitted.
Global sales does not mean global eligibility.
Customer country, user location, processing country, sanctions, export controls and local privacy rules are screened case by case.