As far as I know they have to provide schematics and documentation about how and where they process data.