US data security review

The US Data Security Questionnaire is provided and managed by our US Data Security (USDS) team. The specific purpose of the form is to gather information about a developer to ensure they are keeping US user data safe and secure, in line with TikTok Business Messaging API Developer expectations and best practices. All developers managing Business Messaging for TikTok Business Accounts signed up in the US must pass this review and agree to the USDS Addedum.

This review is conducted with the best interest in mind of not only our users, but also our Business Account users, advertisers, developers, and companies. Furthermore, a developer app cannot obtain Business Messaging scope of permission without approval from the US Data Security team and agreement on USDS addendum. This team will make their determination based on the inputs to this form (this review process typically can take 7-10 business days after submission, dependent upon follow-ups with the developer and timely submission).

There are a number of causes why a developer can get rejected during this process. In certain instances we may have follow up questions or ask for additional information, and in other instances we may completely reject a developer for security reasons. The TikTok API for Business team will follow up if necessary. Should the additional information not suffice or address the concerns of the US Data Security team, the developer will not be able to obtain Business Messaging scope of permission for the developer app. Upon approval from this process, TikTok will reach out to execute the USDS Addendum.

Please ensure that you are answering all questions thoroughly and truthfully to make this process as streamlined as possible. We recommend you provide more details and supporting documents, such as ISO27001 certificate or SOC 2 report, and the latest vulnerability scan or penetration testing report, so as to speed up the approval process.

USDS Restricted Countries

As part of the security review process, USDS enforces strict compliance with US national security regulations, including restrictions on developers and entities associated with OFAC-sanctioned and CFIUS-designated Restricted Countries.

Developers located in, organized under the laws of, or with Ultimate Beneficial Owners (UBOs) from Restricted Countries — such as China (including Hong Kong), Russia, Iran, North Korea, Cuba, and Syria — may not be eligible to launch an app or obtain Business Messaging scope of permission in the US market. This restriction also applies to entities with ownership structures that aggregate to more than 25% total ownership by individuals or entities from Restricted Countries, even if no single owner exceeds the threshold.

USDS reserves the right to request additional documentation to validate ownership, geographic operations, or developer affiliations, and may deny approval based solely on affiliation with a Restricted Country, consistent with national security and compliance obligations. All developers must undergo vetting in accordance with this policy, and any misrepresentation or omission related to ownership or geographic ties will result in immediate disqualification.