Docs/Compliance

Enterprise Compliance

Compliance Documentation

How Tork helps you meet regulatory requirements for AI governance across SOX, PCI-DSS, HIPAA, GDPR, and the EU AI Act.

SOX

PCI-DSS

HIPAA

GDPR

EU AI Act

Trust Center Security Overview

Why AI Compliance Matters

As AI systems increasingly make or influence business decisions, regulators are extending existing compliance frameworks to cover AI. Organizations using AI for financial reporting, payment processing, healthcare, or personal data processing must demonstrate that their AI systems are governed, auditable, and compliant.

Tork provides the infrastructure to enforce policies, generate audit trails, require human oversight, and protect sensitive data—all mapped to specific regulatory requirements.

SOX (Sarbanes-Oxley)

Internal controls over financial reporting for public companies.

What SOX Requires for AI Systems

When AI systems influence financial reporting, SOX Sections 302 and 404 require documented internal controls, management certification, and auditable processes. AI decisions affecting revenue recognition, expense classification, or fraud detection must have proper oversight.

SOX Requirement → Tork Feature Mapping

Requirement	Tork Feature	How It Helps
Section 302 - Management Certification	HITL Enforcement	Require executive sign-off on AI decisions affecting financial statements.
Section 404 - Internal Controls	Policy Engine + Audit Trails	Enforce documented policies with audit logs for every AI decision, included in the daily on-chain anchor.
Control Documentation	Compliance Receipts	Generate receipts with timestamps, hashes, and decision rationale, made immutable by the daily on-chain anchor.
Segregation of Duties	Agent Permissions	Define separate permissions for AI agents handling different financial functions.
Change Management	Policy Versioning	Track all policy changes with version history and approval workflows.
Audit Trail Retention	7-Year Log Retention	Configurable retention periods meeting SOX 7-year requirement.

Example: SOX-Compliant HITL Policy

yamlsox-hitl-policy.tork.yaml

# sox-hitl-policy.tork.yaml
version: "1.0"
name: sox-financial-controls
description: SOX-compliant HITL for financial AI decisions

rules:
  - name: require-approval-high-value
    action: escalate
    condition: transaction_value > 10000
    hitl:
      required: true
      approvers:
        - role: finance_manager
        - role: compliance_officer
      timeout_hours: 24
      audit_reason: "SOX Section 302 management certification"

  - name: flag-material-changes
    action: warn
    condition: affects_financial_statements
    hitl:
      required: true
      approvers:
        - role: cfo
      audit_reason: "Material change requires executive sign-off"

audit:
  retention_days: 2555  # 7 years for SOX
  immutable: true
  include_approver_identity: true

Example: Generating Audit Trails

python

# Server-governed decisions are recorded by Tork and included in the
# daily on-chain anchor, which makes them immutable.
#
# There is no Python cloud SDK — call the REST API with a Bearer token.
# (In JavaScript, use @torknetwork/sdk and its TorkClient class.)
import os, requests

TORK_API = "https://tork.network/api/v1"
HEADERS = {"Authorization": f"Bearer {os.environ['TORK_API_KEY']}"}

r = requests.post(f"{TORK_API}/govern", headers=HEADERS, json={
    "content": "Transaction approved for $50,000",
    "options": {
        "agentId": "finance-agent-1",
        "mode": "redact",
    },
})
result = r.json()

# The compliance receipt is the handle you cite in an audit
print(result["action"])       # allow | redact | deny
print(result["receipt_id"])
print(result["latency_ms"])

PCI-DSS

Payment Card Industry Data Security Standard for cardholder data protection.

What PCI-DSS Requires

PCI-DSS v4.0 has 12 requirements covering cardholder data protection. AI systems that process, store, or transmit card data must protect it, restrict access, encrypt transmissions, and maintain detailed audit logs.

PCI-DSS Requirement → Tork Feature Mapping

Requirement	Tork Feature	How It Helps
Req 3 - Protect Stored Data	PII/Card Detection + Redaction	Automatically detect and redact PANs, CVVs, and expiry dates in AI interactions.
Req 4 - Encrypt Transmissions	TLS 1.3 + E2E Encryption	All API communications encrypted with TLS 1.3. Optional E2E encryption for content.
Req 7 - Restrict Access	Agent Permissions + RBAC	Define which agents can access card data, with IP allowlists and rate limits.
Req 8 - Identify Users	API Key Authentication	Unique API keys per agent with full audit trail of all actions.
Req 10 - Track Access	Immutable Audit Logs	Log all access to cardholder data with timestamps, user IDs, and actions.
Req 11 - Test Security	Policy Testing + TORKING-X	Test policies before deployment. Continuous security scoring.
Req 12 - Security Policies	Policy Engine	Enforce documented security policies for all AI interactions.

Example: Detecting and Redacting Card Data

python

# Detect and redact cardholder data (PCI-DSS Requirement 3).
#
# This one can run entirely on-device: install tork-governance and the
# card number never leaves the machine. With no API key there are zero
# network calls — and so also no receipt.
from tork_governance import Tork

tork = Tork()

result = tork.govern("Customer payment info: 4111-1111-1111-1111, exp 12/25")

print(result.action)   # 'redact'
print(result.output)
# "Customer payment info: [CREDIT_CARD_REDACTED], exp 12/25"

print(result.pii.has_pii)   # True
print(result.pii.types)     # ['credit_card']

# Log for PCI-DSS audit trail (Requirement 10)
audit_log = {
    "event": "cardholder_data_detected",
    "action": result.action,
    "pci_requirement": "3.4",
}

Example: PCI-DSS Access Control Policy

yamlpci-access-control.tork.yaml

# pci-access-control.tork.yaml
version: "1.0"
name: pci-access-controls
description: PCI-DSS Requirement 7 - Restrict access to cardholder data

agents:
  - id: payment-processor
    permissions:
      - read_card_data
      - process_transactions
    allowed_ips:
      - "10.0.0.0/8"
    rate_limit: 1000
    pci_scope: true

  - id: customer-service
    permissions:
      - read_masked_card  # Last 4 digits only
    pci_scope: false

rules:
  - name: block-unauthorized-card-access
    action: block
    condition: |
      agent.pci_scope == false AND
      content.contains_full_card_number
    log_level: critical
    alert:
      - security_team
      - pci_qsa

encryption:
  at_rest: AES-256
  in_transit: TLS-1.3
  key_rotation_days: 90

HIPAA

Health Insurance Portability and Accountability Act for protected health information.

HIPAA requires covered entities and business associates to protect PHI (Protected Health Information). AI systems handling patient data, medical records, or healthcare communications must implement appropriate safeguards.

HIPAA Requirement → Tork Feature Mapping

Requirement	Tork Feature	How It Helps
Privacy Rule - PHI Protection	PHI Detection + Redaction	Detect and redact 18 HIPAA identifiers including MRNs, SSNs, and health conditions.
Security Rule - Access Controls	Agent Permissions + HITL	Restrict PHI access to authorized agents with required human approval.
Security Rule - Audit Controls	Compliance Receipts	Generate audit logs for all PHI access with 6-year retention.
Breach Notification	Alerting + Webhooks	Immediate alerts when PHI exposure is detected in AI outputs.

HIPAA Business Associate Agreement

Enterprise customers can sign a BAA with Tork. View BAA template →

GDPR

EU General Data Protection Regulation for personal data protection.

GDPR applies to any organization processing EU residents' personal data. AI systems must implement data minimization, purpose limitation, and support data subject rights including access, rectification, and erasure.

GDPR Requirement → Tork Feature Mapping

Requirement	Tork Feature	How It Helps
Article 5 - Data Minimization	PII Detection + Redaction	Automatically minimize personal data in AI interactions.
Article 17 - Right to Erasure	Data Retention Policies	Configure automatic deletion of personal data after retention period.
Article 22 - Automated Decisions	HITL Enforcement	Require human oversight for AI decisions with significant effects.
Article 30 - Records of Processing	Audit Trails	Maintain records of all AI processing activities.

Example: GDPR-Compliant Policy

yamlgdpr-policy.tork.yaml

# gdpr-policy.tork.yaml
version: "1.0"
name: gdpr-data-protection
description: GDPR Article 5 - Data minimization and purpose limitation

rules:
  - name: minimize-personal-data
    action: redact
    condition: personal_data_detected
    redact_types:
      - name
      - email
      - address
      - phone
    log_purpose: true

  - name: enforce-retention
    action: delete
    condition: data_age > retention_period
    audit_reason: "GDPR Article 17 - Right to erasure"

  - name: require-consent-context
    action: block
    condition: |
      processing_personal_data AND
      NOT consent_verified
    message: "Processing requires valid consent"

data_subject_rights:
  access_request: enabled
  rectification: enabled
  erasure: enabled
  portability: enabled

Data Processing Agreement

GDPR-compliant DPA with Standard Contractual Clauses available. View DPA →

EU AI Act

EU regulation on artificial intelligence systems and risk classification.

The EU AI Act classifies AI systems by risk level and imposes requirements including human oversight, transparency, and documentation. High-risk AI systems (including those used in employment, credit, and critical infrastructure) face the strictest requirements.

EU AI Act Requirement → Tork Feature Mapping

Requirement	Tork Feature	How It Helps
Article 14 - Human Oversight	HITL Enforcement	Configurable human-in-the-loop for high-risk AI decisions.
Article 9 - Risk Management	TORKING-X Metrics	Continuous risk assessment and scoring across multiple dimensions.
Article 12 - Record Keeping	Audit Trails + Receipts	Automatic logging of all AI system operations.
Article 13 - Transparency	Decision Explanations	Explain AI decisions with policy violations and confidence scores.
Article 10 - Data Governance	Policy Engine	Enforce data quality and governance rules for AI training/inference.

EU AI Act Timeline

The EU AI Act enters into force in stages from 2024-2027. High-risk AI systems must comply by August 2026. Start implementing governance now to ensure readiness.

TORKING-X Compliance Scoring

Continuous compliance monitoring and risk assessment.

TORKING-X provides a unified compliance score across all frameworks, helping you identify gaps and track improvement over time.

python

# Generate a compliance report over a period, for an auditor.
# There is no Python cloud SDK — call the REST API with a Bearer token.
import os, requests

TORK_API = "https://tork.network/api/v1"
HEADERS = {"Authorization": f"Bearer {os.environ['TORK_API_KEY']}"}

r = requests.post(f"{TORK_API}/reports", headers=HEADERS, json={
    "action": "generate",
    # 'daily_digest', 'weekly_summary', 'monthly_compliance',
    # 'custom_range', 'incident_report'
    "reportType": "custom_range",
    "periodStart": "2024-10-01",
    "periodEnd": "2024-12-31",
})
print(r.json())

# Or pull the evidence report for the same window
r = requests.get(f"{TORK_API}/evidence-report", headers=HEADERS, params={
    "from": "2024-10-01",
    "to": "2024-12-31",
    "format": "json",
})
evidence = r.json()

Scoring Dimensions

Audit Trail Coverage

Completeness of logging

Access Control

Permission enforcement

Data Protection

PII/PHI handling

Human Oversight

HITL implementation

Policy Enforcement

Rule compliance rate

Incident Response

Alert handling speed

Independent verification

Checking the record without trusting Tork

Evidence that only its author can validate is weak evidence. Every server-governed receipt carries a TORK-DNA-v2 fingerprint — a salted SHA-256 whose entire input is disclosed alongside the receipt. A third party can recompute the leaf hash and check it against the daily Merkle root published on Solana mainnet without an API key, without a Tork account, and without running any Tork software. The method is specified at /docs/receipt-verification in enough detail to reimplement, and the specification is itself under test: a guard recomputes the worked example directly from that document's prose, so the doc and the implementation cannot silently drift apart.

To sample a population rather than a single record, the bulk proof export returns one row per governed call, with pagination totals, so you can pull a page, select your own sample and verify each row using nothing but the published specification:

bash

curl -H "Authorization: Bearer $TORK_API_KEY" \
  "https://tork.network/api/v1/receipts/proof-export?limit=100"

What is and is not proven

Anchoring covers every organisation on every plan, including Free. It is not a paid add-on and is not opt-in.
All 8 governed surfaces write an anchored receipt — the REST API, each live protocol route, MCP scans, and on-device SDK attestations.
Anchored and independently reproducible are different properties, and 7 of those 8 surfaces carry a reproducible fingerprint. Rows from /api/v1/scan are anchored but carry none; the export reports them as not_fingerprinted rather than implying a proof exists.
A client attestation is a decision your own system made and reported. Anchoring makes it immutable; it does not mean Tork executed or confirmed it. The export labels these separately.
Receipt chain linearity is guaranteed from 2026-07-31T04:14:16Z forward. Records before that boundary are individually signed and anchored, but the chain link between them is not asserted.

Compliance Implementation Checklist

Steps to achieve compliance with Tork

Enable audit logging with appropriate retention period (7 years for SOX, 6 years for HIPAA)

Configure PII detection for relevant data types (PAN, PHI, personal data)

Define HITL policies for high-risk decisions

Set up agent permissions with least-privilege access

Enable TLS 1.3 and configure encryption settings

Create alerting webhooks for compliance violations

Implement data retention and deletion policies

Generate initial TORKING-X compliance report

Schedule quarterly compliance reviews

Need Help with Compliance?

Our compliance team can help you map Tork features to your specific regulatory requirements and audit preparations.

Contact Enterprise Sales Compliance Receipts Docs

Documentation

Learn to integrate TORK

Upgrade Plan

Current: free

Support

Get help from our team

Compliance Documentation

Why AI Compliance Matters

SOX (Sarbanes-Oxley)

What SOX Requires for AI Systems

SOX Requirement → Tork Feature Mapping

Example: SOX-Compliant HITL Policy

Example: Generating Audit Trails

PCI-DSS

What PCI-DSS Requires

PCI-DSS Requirement → Tork Feature Mapping

Example: Detecting and Redacting Card Data

Example: PCI-DSS Access Control Policy

HIPAA

HIPAA Requirement → Tork Feature Mapping

GDPR

GDPR Requirement → Tork Feature Mapping

Example: GDPR-Compliant Policy

EU AI Act

EU AI Act Requirement → Tork Feature Mapping

TORKING-X Compliance Scoring

Scoring Dimensions

Independent verification

Compliance Implementation Checklist

Additional Resources

Trust Center

Security Overview

Data Residency

BAA Template

DPA Template

SCCs

Need Help with Compliance?

Documentation

Upgrade Plan

Support