> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/workflow-guides/assurance/uk-data-flows.md).

# UK Data Flows

**Open this area:** In the CORTEX menu, select **Assurance & governance → System assurance**.

Inventory processing locations, providers, handling limits, custody and declared purposes, including disabled paths.

**Who uses this:** Reviewer, Administrator.\
**Open in CORTEX:** `/governance/systems`.\
**In-app guide:** `/help?topic=uk-data-flows`.

**Expected result:** Each declared flow is tied to a specific deployment and configuration; unknown locations and expired decisions remain unresolved.

## Before you start

* Use the system baseline for the exact environment and deployment identifier.
* Have evidence for processing countries, subprocessors, support access and custody. Record unknown details honestly; do not infer them from a UK billing address.

## What to do

{% stepper %}
{% step %}

## Inventory every path

In Revise baseline, open UK data flows.

Include:

* Content
* Identity
* Logs
* Backups
* Model requests
* Telemetry
* Support
* Reference feeds

Include a disabled entry for unused paths so an omission is not mistaken for a decision.
{% endstep %}

{% step %}

## Use the running configuration

Choose a Configured connection and Use configured connection to copy its endpoint, provider, purpose and fingerprint without credentials.

Match the displayed runtime system key, deployment identifier and environment.

Supply countries, custody, support and evidence separately; copying a connection never approves it.
{% endstep %}

{% step %}

## Declare exact use

Record:

* The endpoint base without credentials, query or fragment
* Purpose
* Provider and subprocessors
* ISO country codes one per line; GB is the UK code
* The handling ceiling
* Permitted compartments/caveats
* Internal or external network
* Configuration SHA-256
  {% endstep %}

{% step %}

## Retain evidence and review

State custody and support location, evidence keys and UTC review deadline.

Save the baseline and obtain independent security-owner review. The appointed owner can then approve the exact declared flow.
{% endstep %}

{% step %}

## Handle change

Any baseline edit clears flow approval and requires review.

Unknown or non-UK processing, absent evidence, expired dates and unsupported handling cannot receive approval.

External flows are limited to OFFICIAL; host connectivity limits still apply.
{% endstep %}

{% step %}

## Recover held connections

Report drafting, headline triage, news feeds and registry checks require current exact-use approval before requests and again before returning results.

Approval required holds a feed including cached headlines.

Ask the security owner to check:

* The binding
* Evidence
* Source currency
* Handling
* Review deadline

Replace a changed configured entry in a new revision and review it again; retained records remain unchanged.
{% endstep %}
{% endstepper %}

## Check the result

* Is every processing category represented?
* Does GB cover all actual processing and support paths?
* Does the configuration hash describe this exact provider and use?
* Is the review still current?

## If you get stuck

<details>

<summary>What if the country is unknown?</summary>

Leave the country list empty and record the missing detail. The flow remains unresolved and cannot be approved.

</details>

<details>

<summary>Why was approval cleared?</summary>

The baseline changed. Review the new configuration and its impact before making a new exact-use decision.

</details>

## Responsibility and limits

* The inventory records declared evidence; it is not a discovery scan or a substitute for verifying provider arrangements.
* An approval never expands network access or overrides handling controls.

**Reference and scope:** Derived UK deployment and connectivity controls. A provider name or URL does not establish processing location or approval.

## Related workflows

* [Maintain a system control and evidence baseline](broken://pages/699956df97c18fc4ddd8894884fea67a7b6e90ce)
* [Review a model-assisted first draft from CSV](file:///7397340/product/ai-drafts.md)
* [Turn an unassessed news lead into a reviewed question](file:///7397340/direction/news.md)
* [Work through connection and deployment limits](broken://pages/e2892068271c3c1f3c4471ca5a8f532a8174ba43)