Customer data must not be stored, processed, or transferred outside approved jurisdictions such as the United States unless the customer has approved the action and appropriate safeguards are in place so that jurisdictional and contractual data protection requirements are maintained.