Compliance Documentation

SOX (Sarbanes-Oxley)

Internal controls over financial reporting for public companies.

# sox-hitl-policy.tork.yaml
version: "1.0"
name: sox-financial-controls
description: SOX-compliant HITL for financial AI decisions

rules:
  - name: require-approval-high-value
    action: escalate
    condition: transaction_value > 10000
    hitl:
      required: true
      approvers:
        - role: finance_manager
        - role: compliance_officer
      timeout_hours: 24
      audit_reason: "SOX Section 302 management certification"

  - name: flag-material-changes
    action: warn
    condition: affects_financial_statements
    hitl:
      required: true
      approvers:
        - role: cfo
      audit_reason: "Material change requires executive sign-off"

audit:
  retention_days: 2555  # 7 years for SOX
  immutable: true
  include_approver_identity: true

from tork import TorkClient

client = TorkClient(api_key="tork_live_xxx")

# Every evaluation generates a blockchain-anchored audit trail
result = client.evaluate(
    prompt="Process financial transaction",
    response="Transaction approved for $50,000",
    metadata={
        "user_id": "finance_admin_001",
        "transaction_id": "TXN-2024-001234",
        "department": "accounts_payable",
        "sox_control": "AP-001"
    }
)

# Access the compliance receipt
receipt = result.compliance_receipt
print(f"Receipt ID: {receipt.id}")
print(f"Timestamp: {receipt.timestamp}")  # ISO 8601, cryptographically verifiable
print(f"Hash: {receipt.content_hash}")     # SHA-256 integrity hash
print(f"Decision: {receipt.decision}")

PCI-DSS

Payment Card Industry Data Security Standard for cardholder data protection.

from tork import TorkClient

client = TorkClient(api_key="tork_live_xxx")

# Detect and redact cardholder data (PCI-DSS Requirement 3)
result = client.evaluate(
    prompt="Customer payment info: 4111-1111-1111-1111, exp 12/25",
    checks=["pii", "credit_card"],
    redact=True
)

if result.has_pii:
    print("Cardholder data detected!")
    print(f"Types found: {result.pii_types}")  # ['credit_card', 'expiry_date']
    print(f"Redacted: {result.redacted_content}")
    # Output: "Customer payment info: [CREDIT_CARD], exp [EXPIRY_DATE]"

# Log for PCI-DSS audit trail (Requirement 10)
audit_log = {
    "event": "cardholder_data_detected",
    "action": "redacted",
    "timestamp": result.timestamp,
    "receipt_id": result.compliance_receipt.id,
    "pci_requirement": "3.4"
}

# pci-access-control.tork.yaml
version: "1.0"
name: pci-access-controls
description: PCI-DSS Requirement 7 - Restrict access to cardholder data

agents:
  - id: payment-processor
    permissions:
      - read_card_data
      - process_transactions
    allowed_ips:
      - "10.0.0.0/8"
    rate_limit: 1000
    pci_scope: true

  - id: customer-service
    permissions:
      - read_masked_card  # Last 4 digits only
    pci_scope: false

rules:
  - name: block-unauthorized-card-access
    action: block
    condition: |
      agent.pci_scope == false AND
      content.contains_full_card_number
    log_level: critical
    alert:
      - security_team
      - pci_qsa

encryption:
  at_rest: AES-256
  in_transit: TLS-1.3
  key_rotation_days: 90

HIPAA

Health Insurance Portability and Accountability Act for protected health information.

HIPAA Business Associate Agreement

Enterprise customers can sign a BAA with Tork. View BAA template →

GDPR

EU General Data Protection Regulation for personal data protection.

# gdpr-policy.tork.yaml
version: "1.0"
name: gdpr-data-protection
description: GDPR Article 5 - Data minimization and purpose limitation

rules:
  - name: minimize-personal-data
    action: redact
    condition: personal_data_detected
    redact_types:
      - name
      - email
      - address
      - phone
    log_purpose: true

  - name: enforce-retention
    action: delete
    condition: data_age > retention_period
    audit_reason: "GDPR Article 17 - Right to erasure"

  - name: require-consent-context
    action: block
    condition: |
      processing_personal_data AND
      NOT consent_verified
    message: "Processing requires valid consent"

data_subject_rights:
  access_request: enabled
  rectification: enabled
  erasure: enabled
  portability: enabled

Data Processing Agreement

GDPR-compliant DPA with Standard Contractual Clauses available. View DPA →

EU AI Act

EU regulation on artificial intelligence systems and risk classification.

EU AI Act Timeline

The EU AI Act enters into force in stages from 2024-2027. High-risk AI systems must comply by August 2026. Start implementing governance now to ensure readiness.

TORKING-X Compliance Scoring

Continuous compliance monitoring and risk assessment.

Compliance Implementation Checklist

Steps to achieve compliance with Tork