T

Transcend

The decision layer is rules, not models, and the vendor says so. Transcend's pitch is policy as code: business policy, jurisdictional regulation and consent combined into a deterministic real time decision that systems and agents call before acting. That is deliberately not inference, and the marketing leans on it, promising every use defined and enforced with records ready for audit. AI Features do exist and are defined in the agreement as large language models or other machine learning features of the Services.

The AI use cases mostly concern governing other people's models, such as honoring signals not to train and clearing data for AI projects. Remove the models and what a buyer pays for remains: the permissioning layer, consent propagation, fulfillment of data subject requests, the Sombra gateway and the integrations.

Accuracy is asserted in the marketing, measured nowhere, and disclaimed squarely in the agreement. The claims are quantified but unsourced: 174 billion automated data decisions, 99 percent of the addressable audience per purpose, classification at column level updated in real time, and a customer quote putting data visibility at roughly 100 percent. Against that, section 7.4 of the services agreement disclaims any warranty that the Services, including any Outputs from the AI Features, are accurate, complete or reliable, which is a direct disclaimer of the accuracy of AI output and the more candid of the two positions.

No precision or recall figure, benchmark or error rate for classification or the AI Features is published on any page read. The product returns permissioning decisions rather than legal authority, so retrieval and citation of sources do not arise.

Human involvement is offered as a configuration choice and never described as a control over model output. The home page says policy as code runs with people in the loop only where the customer wants them, and elsewhere that the review queue is encoded automatically and that runtime policy enforcement replaces manual compliance reviews. That describes where a customer may place a checkpoint, and the selling point is explicitly the removal of manual review, so the question is what happens when an automated decision is wrong.

Nothing located answers it. There is no confidence threshold, no deferral path, no review surface described for the AI Features, and no remedy beyond the audit record. Two things favor the customer. Every decision is logged with proof from each system, and section 3.3 of the agreement gives the customer a perpetual license in Outputs while it keeps its rights in Inputs, so the customer controls what it does with what the system produces.

One customer and one named individual are cited, with no figures attached. Robinhood is named on the home page with a quote from Karthik Rangarajan, Head of Security, describing Transcend's role in giving customers control over their data. A second quote is attributed to a named chief executive with no organization given, which reduces its value. The security page has two more quotes attributed only by role and sector: a CISO and data protection officer at a global staffing firm, and a chief information security officer at a global fintech, whose quote carries the only outcome figure located, data visibility improved to roughly 100 percent.

Platform claims of 1.9 billion dollars of revenue unlocked, 174 billion automated decisions and 418 million operations and agents governed are unsourced and carry no method. IDC named Transcend a Leader in its 2025 MarketScape for worldwide data privacy compliance software. A customer stories library exists and was not opened, so it may hold a dated outcome with figures.

Confidentiality is strongly documented, and two parts are missing. Section 3.3 of the services agreement says Transcend may not use Inputs or Outputs to train or otherwise improve AI Features except solely for the customer's benefit, which is a contractual prohibition rather than a policy statement. The Customer Data license at 3.2 is narrow, solely to provide the Services, and improvement rights are confined to Usage Data, which excludes Customer Data.

The architecture reinforces the contract. Sombra runs inside the customer's own infrastructure, the customer keeps its own API keys, and Transcend says it cannot connect to customer systems directly and does not see the data. Customer Data is defined as the customer's Confidential Information, compelled disclosure requires prior notice, and the addendum commits to deletion within thirty days of termination on request.

Privilege and work product are never mentioned, despite a named Privacy, Legal and Risk buyer, and no position is stated on outside model providers behind the AI Features.

A responsibility allocation sits in the terms while the marketing sells the removal of legal review. Section 7.4 of the services agreement says the customer is solely responsible for its compliance with any laws and that Transcend disclaims all liability for that compliance. Section 2.3 requires the customer to obtain the permissions and consents and comply with the privacy laws the Services need. That clearly allocates who owns the legal judgment, but it says nothing about the line between an information tool and legal advice.

Nothing located says the output is not legal advice, that no professional relationship arises, or that a user should take advice on their own facts, and no jurisdiction limit or supervision point appears. The tension is sharp because of how the product is sold. The marketing promises real time campaign clearance and no three week legal review cycles, an explicit offer to replace a legal review step, alongside a disclaimer of all liability for the compliance outcome.

Nothing published addresses governance of Transcend's own models. The company publishes a good deal about AI governance as a subject, including a solution built around enforcing signals not to train and a blog arguing that AI governance is enforcement rather than documentation, but all of it concerns the customer's AI. No responsible AI page, AI policy, ethics statement, governance committee, named accountable owner, testing regime before release or bias evaluation is published.

The site navigation and full footer were read across platform, solutions, partners, resources, company and developer sections, and contain no such page. Two nearby items do not answer the question. The contractual commitment not to train is a data commitment, and the open source repositories and public documentation are engineering transparency rather than model governance.

The full stewardship picture is published, specific and dated, in a data processing addendum last updated 27 August 2026. On termination Transcend deletes all Customer Personal Data in its possession or control within thirty days of a customer request, with backups isolated and protected from further processing; without a request, deletion follows standard retention policies. Security breaches are notified without undue delay and within seventy two hours of awareness, with a set list of content covering the nature of the breach, the categories and approximate numbers of people and records, likely consequences and measures taken.

Subprocessors are named on a maintained public list, with fifteen days' notice of additions, an objection route and a mutual termination right if no cure is available. Access control is concrete: SSO with enforced MFA, least privilege and role based access, segregation of duties, and quarterly access reviews. Encryption is AES-256 at rest and TLS 1.2 or higher in transit, with annual outside penetration testing, threat modeling at design, code analysis and dependency checks, and daily backups tested at least annually. Transfers run on the EU SCCs, the UK addendum and the Swiss FADP variations.

The allocation is published, current and readable, and the indemnity is narrow. The services agreement, last updated 9 July 2026, is published openly and was independently assessed under the TermScout certification program. It sets a mutual cap at fees paid or payable in the twelve months before the event. Excluded Claims sit outside the cap: customer breaches of use restrictions, indemnity amounts payable to third parties, and either party's breach of confidentiality.

A conformance warranty says the Services will operate in substantial conformity with the Documentation and that functionality will not be materially reduced during the term, with correction, performing again or a refund of prepaid fees as the exclusive remedy. A separate warranty says Transcend will comply with all applicable laws in providing the Services. Transcend's indemnity covers only third party intellectual property claims, with none for misuse or unauthorized disclosure of Customer Data, and the confidentiality carve out expressly excludes claims about Customer Data, so a data incident stays inside the cap. No insurance position is published, and an incorrect AI output is addressed only by a disclaimer.

Named systems, a described flow and public developer documentation are published, without a stated approach to what is not covered. Integrations named on the home and security pages span the categories that matter here: Okta and Workday for identity and HR, Databricks, AWS and Azure for data, Slack and Twilio for communications, Google Ads and AdRoll for marketing, and Google Workspace for productivity. Segment is named in the agreement as an example of a customer's third party service.

What moves is described. Consent decisions propagate to the customer data platform, ad tech and loyalty systems, data subject requests are fulfilled across connected systems with proof from each, and every request passes through Sombra tokenized, authenticated and encrypted. The connector model is documented publicly at docs.transcend.io, with an API built for MCP agent access and open source repositories on GitHub. The integrations library and the documentation site were not opened, so depth beyond the named systems is unverified and they may say more.

The deployment model is clear, and the residency detail is thin. Transcend publishes an architecture in two parts rather than a hosting note: a hosted control plane, and Sombra, a security gateway the customer deploys inside its own infrastructure, through which every integration request passes. The consequences are stated concretely. Customer data never leaves the customer environment, Transcend cannot connect to customer systems directly, and the customer keeps its own API keys, with optional delegation to its own key management service for keys backed by hardware.

The data processing addendum confirms this, recording that where the customer uses Sombra less personal data is collected, because it runs on the customer's premises with encryption end to end. That answers where processing happens more directly than a region list would. The region list itself is missing. The addendum says customer data is stored and processed by default in a secure cloud environment on AWS, but no regions are listed, no residency option is offered, and nothing describes what changes between deployment tiers.

The standards are named, and none of the confirming detail is published. The security page says Transcend regularly attains SOC 2 Type II and ISO 27001 compliance and shows the AICPA SOC and ISO 27001 marks. The data processing addendum repeats both, recording that Transcend has obtained SOC 2 Type II certification and maintains ISO 27001 certification, with its security and privacy programs audited externally each year.

Supporting practice is described in depth: annual outside penetration testing, external audits, threat modeling at design, static code analysis and dependency checks, manual application security testing, and claimed alignment with the Cloud Computing Compliance Controls Catalog, the NCSC Cloud Security Principles and NIST cloud standards. Nothing lets a buyer verify it. There is no trust center, no report is downloadable or offered on request, no auditor or certification body is named, and no certificate date, examination period or scope appears. The phrase regularly attains is looser than a claim of current certification and is the vendor's own wording.

The AI Features are defined and nothing underneath them is identified. The services agreement defines AI Features as large language models or other machine learning or AI features of the Services, which confirms such models are in use. No model, model family or provider is named on any page read, and none is excluded. OpenAI and Perplexity appear in the integration strip on the home and security pages, but as customer systems Transcend connects to on the customer's behalf, not as providers of Transcend's own AI Features.

AWS is named in the addendum as the default hosting environment, which identifies infrastructure rather than models. No commitment to notify customers when the model set changes is published. The maintained subprocessor list would likely settle this, since a model provider processing customer personal data would have to appear on it. That list was not opened and may say more.

No pricing information is published at any level, including the unit of charge. The site navigation and the full footer were read across platform, solutions, partners, resources, company and developer sections and contain no pricing page; every commercial route is a demo request. What the published agreement supplies is billing mechanics rather than price or structure: fees are set in an order form, invoice or an in-account billing page, payable in US dollars, invoiced in advance with usage-based fees possibly invoiced monthly in arrears, non-refundable and not subject to set-off, with subscriptions auto-renewing and Transcend able to revise rates on forty-five days' notice before renewal, and past due amounts carrying 1.5 percent monthly.

Usage limits are said to be set in the order form or documentation without naming what is metered. A separate Customer Support document defines support tiers with a Standard tier included at no additional charge, which is the only tier structure published anywhere and concerns support rather than the platform.

Coverage is segmented three ways with real pages behind each, and the boundary is left open. By team, five audiences have their own pages, including Privacy, Legal and Risk, so a legal function is addressed on a page of its own. By use case, five specific ones are named: AI transformation and keeping data out of training, personalization and audience activation, retail media networks, loyalty and programs across several brands, and regulated and sensitive data use.

By business type, six are named: AI, consumer, healthcare, fintech, media and business to business. The use cases show who the product is for, since retail media networks and loyalty programs point at consumer enterprises with large first party data estates rather than at regulated industry generally. Where the product stops is not stated. No organization size, data volume, jurisdiction or system type is named as out of scope, and the regulated and sensitive data use case is framed as a capability rather than a limit.