If you intend on launching your app to users in the United States, United Kingdom, or regions in the European Union, you must provide details about your company and its data usage in an approval request form on the Developer Portal. After receiving your request, TikTok may conduct a full third-party risk management (TPRM) analysis to assess whether your company meets our compliance standards for data usage.

This analysis allows TikTok to ensure that vendor relationships remain secure, legally sound, and aligned with our obligations under U.S. and EU/UK law and internal standards. Your participation is essential to maintaining a trusted partnership.

#Process for launching your app to U.S. or EU/UK users

exTo receive approval to launch your app to users in the U.S. or EU/UK, you must complete the following:

1. Submit the general launch approval request: Complete the short questionnaire indicating your intended data access and management practices. This is required for launch to all regions.
2. Submit the launch approval request: Fill out the approval request form on the Developer Portal to determine eligibility for launch in the U.S. or EU/UK.
1. Organization details: Provide your company's business and operations information.
3. Complete the TPRM questionnaire: If you indicated that you need access to sensitive data in your approval request form, you will receive a TPRM questionnaire in the next 7-10 days. If your submission is approved, you may launch your app to users in the U.S. or EU/UK
4. Sign agreement: You must sign a data security agreement for your scope to take effect.

#U.S. & EU/UK launch approval request

To start the approval request process, you must first complete the U.S. and EU/UK launch approval request form on the Developer Portal. This requires you to provide information about your company's operations and intended data usage.

#Organization details

In the request form, you must provide information about the following:

• Country where your company is registered
• Your company's majority stakeholders (only those with a controlling interest of 25% or more), and their countries of residence and citizenship
• All locations of the teams that will support your U.S. or EU/UK launch, operations, and customer support in any way
• Location of primary data centers where U.S. or EU/UK user data will be stored
• Your intended business case (mini games or mini dramas) and TikTok representative contact

#Third-Party Risk Management questionnaire

If you indicate that your company requires sensitive data, a representative from the TikTok U.S. Data Security Inc. (USDS) will email you an additional questionnaire. TikTok USDS is an organization tasked with managing TikTok's business functions that require access to U.S. user data. Learn more about TikTok USDS.

#Vendor compliance review process

To align with TikTok USDS's data protection requirements, you must complete a Vendor Compliance Questionnaire (VCQ) through our TPRM platform.

This review covers key risk areas, including the following:

• Ultimate Beneficial Ownership (UBO)
• Headquarters and workforce locations
• Service and support geography
• Data access, processing, and storage practices
• Use of subcontractors and fourth parties

Your cooperation in this process helps ensure a secure and trusted partnership for both our organizations.

#Compliance review definitions and requirements

More information about the compliance review's key risk areas is listed below.

#Ultimate Beneficial Ownership (UBO)

UBO refers to the individuals or entities who ultimately own or control your company. Even if ownership is indirect or layered through holding companies, the ultimate decision makers must be disclosed.

#Headquarters and workforce locations

Your personnel who support TikTok U.S. users—whether employees, contractors, or subcontractors—must not be based in a restricted country. This restriction applies regardless of employment classification or whether the personnel support us directly or indirectly.

#Service and support location restrictions

All technical support and operational services related to TikTok USDS must be performed outside restricted countries. This includes the following:

• Hosting environments
• Development teams
• Customer support personnel

Failure to comply with this requirement may lead to disqualification or reassessment of the vendor relationship.

#Data handling locations

TikTok USDS data cannot be accessed, processed, modified, or stored in a restricted country.

Please confirm your cloud and infrastructure configurations before completing the VCQ, especially if your services use auto-scaling or globally distributed environments.

#Fourth-party disclosure requirements

If your organization relies on other entities (cloud providers, IT subcontractors, for example) to support your TikTok USDS engagement, those are considered fourth parties. Disclosure is required if these parties engage in the following:

• Host, transmit, or process USDS data
• Provide core infrastructure for your services
• Offer necessary services for your operational delivery to TikTok

#Approval request results

After completing the approval request process, you may receive one of the following results.

• Approved: You may launch your app in the U.S. or EU/UK without restrictions. No aggregation is required for data reporting.
• Information needed: You must provide additional clarification and evidence related to any Country of Concern ownership, data access, or engineering activities.
• Not approved: You may not launch your app in the U.S. or EU/UK Contact your TikTok operations representative for support.

If you have any questions, please reach out to the TikTok USDS TPRM team at TPRM@tiktokusds.com.

#Sign agreement to access sensitive data

You must sign a data security agreement after your request has been approved for the data scope to take effect.