Transcend
Privacy infrastructure platform that automates consent, data subject requests and vendor governance through a JavaScript SDK (airgap.js) and a server side API.
What does Transcend do?
What Transcend is
Transcend Inc. is a privacy infrastructure vendor headquartered in San Francisco. Its product suite includes a Consent Management Platform powered by the airgap.js bundle, an automated Data Subject Request (DSR) engine, a vendor and data inventory tool and a privacy policy assembly module. Large enterprises use Transcend to operationalise GDPR, ePrivacy, CCPA, LGPD and emerging US state laws across their tech stack.
What data and cookies are processed
On the public website, Transcend writes a first party preference cookie (transcend.consent) and a session token (transcend.session) used to identify the consent record. The DSR engine processes the data subject email, IP, request payload and the responses fetched from your downstream tools. The vendor inventory stores metadata about each processor (legal basis, retention, transfers).
GDPR and ePrivacy posture
The Transcend consent cookie is treated as strictly necessary under recital 66 of the ePrivacy Directive because it stores the user choice. Any other cookie that airgap.js gates on the page (analytics, marketing, social) requires Article 6(1)(a) consent before it loads. The DSR and vendor governance modules rely on legitimate interest (Art. 6(1)(f)) and on compliance with a legal obligation (Art. 6(1)(c)).
Data transfers and EU residency
Transcend Inc. is a US controller of customer support and account data. The airgap.js SDK can be hosted on US AWS by default or on the EU AWS Frankfurt region for customers with EU residency requirements. Sign Standard Contractual Clauses with Transcend Inc., complete a Transfer Impact Assessment and document the chosen region in your Record of Processing Activities.
Implementation checklist
Configure airgap.js to block all non essential vendors before consent, set the EU residency where applicable, sign the Data Processing Addendum and SCCs, scope the DSR connectors to the minimum systems, log every DSR for accountability, run a yearly DPIA review and surface a clear, granular consent banner that meets EDPB Guidelines 03/2022.
Transcend and the GDPR
Transcend is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.
- Legal basis
- Legitimate interest (Art. 6(1)(f) GDPR) for the consent record itself, the DSR queue and the vendor governance log (compliance with a legal obligation, Art. 6(1)(c), is also relevant). Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for any non strictly necessary cookies served by the airgap.js bundle on the public site.
- Risk level
- medium
- Applicable regulations
- GDPR, ePrivacy Directive, UK GDPR, CCPA/CPRA, LGPD, VCDPA, CPA, CTDPA
Impact assessment (DPIA)
A DPIA is recommended when Transcend is used to centralise data subject requests across many internal systems and to broker consent for hundreds of vendors. Document the categories of data flowing through the DSR workflow, the legal basis, the residency choice and the SCCs with Transcend Inc.
Sample text for your banner
We use Transcend to manage your consent and privacy preferences. With your consent, the airgap.js bundle stores your choices and gates non essential trackers on this site.
What Transcend sets and contacts
- Tracking method
- JavaScript consent and preference management bundle (airgap.js) plus a server-side API used to orchestrate data subject requests, consent records, vendor disclosures and identity stitching across an organisation systems
- Server location
- United States (San Francisco) with optional EU residency in AWS Frankfurt for the airgap.js consent bundle
- Cookieless mode available
- Yes
- Data transferred outside the EU
- Default Transcend processing happens in AWS US regions, with an optional EU data residency for the consent SDK. SCCs are required when the US tenant is used. Verify the active region in the Transcend admin and document it.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| transcend.consent | first_party | 1 year | Stores the visitor consent preferences (categories accepted, refused) so airgap.js can decide which third party scripts to load. |
| transcend.session | first_party | Session | Session identifier used to attach the consent record to the active browsing session and the audit log. |
| airgap.consent | first_party | 1 year | Backup container used by airgap.js to store the consent payload when localStorage is unavailable. |
Third-party domains contacted (4)
transcend.iocdn.transcend.ioconsent.transcend.ioairgap.transcend.io
Frequently asked questions about Transcend
Can't find your question? Write to us, we answer fast.
What cookies does Transcend set?
The airgap.js bundle writes transcend.consent (preference record) and transcend.session (consent session). Other cookies appearing on a Transcend protected site come from third party vendors gated by airgap.js, not from Transcend itself.
Is consent required to load Transcend?
The Transcend consent cookie is considered strictly necessary because it stores the user choice and so does not require prior consent. The non essential vendors that airgap.js gates do require Article 6(1)(a) GDPR consent before they fire.
What is the legal basis for processing through Transcend?
Strictly necessary consent storage relies on Art. 6(1)(f) legitimate interest and the ePrivacy recital 66 exemption. Vendor cookies require Art. 6(1)(a) consent. DSR and vendor governance modules rely on legitimate interest and on compliance with a legal obligation (Art. 6(1)(c) GDPR).
Does Transcend transfer data to the United States?
Yes by default. Transcend Inc. processes account data in the US. The airgap.js consent SDK can be served from AWS US or AWS Frankfurt. SCCs with Transcend Inc. and a Transfer Impact Assessment are required when the US tenant or US support staff are involved.
Do I need a DPIA for Transcend?
A DPIA is recommended for the DSR engine because it centralises personal data flows from many internal systems. It is also advisable when Transcend governs hundreds of vendors with international transfers.
How do I implement Transcend compliantly?
Choose EU residency where applicable, sign the DPA and SCCs, configure airgap.js in strict mode (block before consent), define minimum DSR connector scopes, log every DSR with timestamps, integrate with your IDP and review the deployment in a yearly DPIA.
What are the alternatives to Transcend?
EU based and Europe friendly alternatives include OneTrust, Didomi, Axeptio, Usercentrics, Cookiebot, Termly and the open source Klaro. Each has a different mix of CMP, DSR automation and vendor governance features.
How do I update my cookie policy when adding Transcend?
List transcend.consent and transcend.session as strictly necessary. Mention Transcend Inc. as a processor, the chosen residency (US or EU), the SCCs in place, the DSR engine connectors and the right of users to withdraw consent at any time through the Transcend preference centre.
FlowConsent
FlowConsent is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. FlowConsent supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, FlowConsent ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
OneTrust
OneTrust is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. OneTrust supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, OneTrust ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Klaro
Klaro is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Klaro integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Klaro helps organizations maintain robust websites that meet user expectations and technical requirements.
CookieBAR
CookieBAR is a consent management platform (CMP) that helps websites comply with GDPR, CCPA, and global privacy regulations. It provides customizable cookie consent banners, preference centers, and automated compliance scanning. CookieBAR manages user consent across tracking technologies, generates compliance reports, and integrates with tag management systems. With geo-targeted policies and TCF 2.0 support, CookieBAR ensures worldwide privacy compliance.
clickio
clickio is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. clickio supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, clickio ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Didomi
Didomi is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Didomi supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Didomi ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.