Standard Contractual Clauses (SCCs)
EU-Approved Safeguards for International Data Transfers
What are Standard Contractual Clauses?
Standard Contractual Clauses (SCCs) are pre-approved legal contracts published by the European Commission. They provide a lawful mechanism for transferring personal data from the European Union (EU) or European Economic Area (EEA) to countries that don't have an "adequacy decision" from the EU—including the United States.
Think of SCCs as a standardized "promise" that ensures your data receives GDPR-level protection, even when it crosses borders. Both the data exporter (you) and the data importer (Tork) sign these clauses, creating binding legal obligations.
When Do SCCs Apply?
SCCs are required when personal data is transferred from the EU/EEA to a "third country" without an adequacy decision. In the context of Tork:
- • You are established in the EU/EEA (or subject to GDPR)
- • You send personal data to Tork for processing
- • That data is processed in Tork's US-based infrastructure
- • You are not subject to GDPR (e.g., US-only operations)
- • No personal data is being transferred (anonymized data only)
- • Future: Using Tork's EU-region deployment (coming 2026)
Tork's SCC Implementation
Tork uses the June 2021 SCCs adopted by the European Commission, which are specifically designed to address post-Schrems II requirements. We implement two modules depending on the transfer scenario:
Module 2: Controller to Processor
For most Tork customersThis module applies when you (the customer) are the data controller and Tork is the data processor. This is the standard relationship for most customers using Tork to evaluate their AI outputs.
Module 3: Processor to Processor
For sub-processor transfersThis module applies when Tork transfers data to our sub-processors (Vercel, Supabase, Resend). We have Module 3 SCCs in place with each of our sub-processors.
How to Execute SCCs with Tork
Included in DPA Annex
For Enterprise customers, SCCs are automatically included as Annex 3 to your Data Processing Agreement. When you sign the DPA, you're also executing the SCCs. Your Customer Success Manager will provide the pre-signed documents.
Contact Enterprise SalesRequest via Email
For Starter and Professional plan customers, you can request our DPA with SCCs by emailing legal@tork.network. We'll send you the documents for electronic signature within 2 business days.
Request DPA with SCCsDownload SCC Template: You can download a template of our SCCs for review before signing.
Supplementary Measures
Following the Schrems II decision and EDPB recommendations, SCCs alone may not be sufficient. Tork implements the following supplementary measures to ensure EU personal data is adequately protected:
Technical Measures
Encryption in Transit
All data transmitted to and from Tork is protected using TLS 1.3, the latest transport layer security protocol.
Perfect forward secrecy enabled, strong cipher suites only
Encryption at Rest
All persistent data is encrypted using AES-256, a military-grade encryption standard.
Keys managed via cloud provider KMS with automatic rotation
Data Minimization
API request content is processed in-memory only and never written to persistent storage.
Only metadata required for audit logs is retained
Pseudonymization
Where possible, personal identifiers are replaced with pseudonymous identifiers.
Audit logs use hashed request IDs, not user identifiers
Organizational Measures
Access Controls
Strict role-based access controls limit who can access customer data.
Principle of least privilege enforced, MFA required
Audit Logging
All access to customer data is logged and monitored.
Logs retained for security review, anomaly detection enabled
Staff Training
All staff with data access receive GDPR and security training.
Annual recertification required
Vendor Assessment
Sub-processors undergo security and privacy assessments before engagement.
Annual reviews and contractual protections required
Contractual Measures
Sub-processor SCCs
All sub-processors have executed SCCs or equivalent safeguards.
Vercel, Supabase, and Resend all maintain SCCs
Data Processing Agreements
Binding DPAs in place with all sub-processors.
GDPR Article 28 compliant terms
Incident Notification
Contractual commitment to notify of breaches within required timeframes.
72-hour notification for personal data breaches
Audit Rights
Customers have contractual rights to audit our compliance.
Annual third-party audits available upon request
Transfer Impact Assessment
Tork has conducted a Transfer Impact Assessment (TIA) as required by the new SCCs. Our assessment evaluated US law and its application to the personal data we process. Key findings:
Minimal Data Exposure
API request content is processed in-memory only and never persisted. This means even in the event of a government request, Tork has no substantive content to produce. Only account metadata and audit log metadata is stored.
Strong Encryption
All stored data is encrypted with AES-256. Even if data were accessed, it would be unreadable without the encryption keys, which are managed by cloud provider KMS with strict access controls.
Legal Protections
Tork commits to challenging any government request we believe is unlawful or overly broad. We will notify affected customers unless legally prohibited, and we will exhaust all available appeals before complying with requests we disagree with.
Our full TIA is available to Enterprise customers upon request under NDA.
Sub-processors Covered by SCCs
All of Tork's sub-processors have executed SCCs (or equivalent transfer mechanisms) and implement their own supplementary measures:
Frequently Asked Questions
SCC & Legal Inquiries
For questions about SCCs, to request a copy of our DPA with SCCs, or for any legal inquiries related to data transfers, contact our legal team.
legal@tork.network