Data Sovereignty & Residency Policy

This policy sets out how QCE Vision stores, processes, transfers, and protects data across jurisdictions. It exists because sovereignty is an engineering discipline, not a marketing claim, and because the enterprises we serve are accountable to regulators, boards, and customers who expect their data to remain where the law requires it.

This policy applies to all data processed through QCE Vision platforms and the sovereign substrate, including customer data, enterprise workloads, the Enterprise Intelligence Platform (EIP), the OmniPlace marketplace, and the QaaS offerings. It is binding on all QCE Vision entities, QCE Global, QCE Gateway, QCE Technologies, QCE AI, and QCE 360, and on every sub-processor we engage.

QCE Vision operates from the Johor-Singapore Special Economic Zone, with a dual-headquarters structure spanning the JS-SEZ and Singapore. Our sovereignty doctrine rests on five commitments:

• Residency by Default. Data is stored and processed in the jurisdiction you select during onboarding. Where no selection is made, data resides in our primary JS-SEZ and Singapore infrastructure.
• No-Transfer by Default. We do not move personal or confidential data across borders unless a lawful transfer mechanism is in place and the transfer is necessary to deliver the service you engaged.
• Cryptographic Custody. Encryption keys are held in hardware security modules under our control. Core intellectual property, algorithms, and keys reside in private, sovereign enclaves, never on public cloud infrastructure.
• Zero-Trust Boundary. Every human, agent, and machine-to-machine request is authenticated and authorised. Network position confers no implicit trust.
• Verifiable Control. You can audit where your data lives, who can access it, and under what conditions, through logs, attestations, and exportable evidence.

These commitments are enforced by design across every server, codebase, contract, and workflow in the QCE Vision ecosystem.

We classify data into four tiers, each with its own residency and handling rules:

The classification applied to your data is recorded in your onboarding agreement. If you are uncertain which tier applies, contact us before submitting the data.

QCE Vision operates a default no-transfer posture. This means:

• Data you submit to a QCE Vision platform is stored and processed in the jurisdiction you selected, or, if none was selected, in our primary JS-SEZ and Singapore infrastructure.
• We do not transfer Tier 3 or Tier 4 data across borders unless (a) you have explicitly authorised the transfer, (b) a lawful transfer mechanism is in place, and (c) the transfer is necessary to deliver the service you engaged.
• Where a lawful transfer mechanism is required, we use Standard Contractual Clauses, an adequacy decision, or another legally recognised instrument, and we document the mechanism in your agreement.
• We do not use your data for advertising, profiling, or the training of third-party models, anywhere.

You are the sovereign of your data. Within the QCE Vision ecosystem, you hold the following controls:

• Jurisdiction Selection: Designate the jurisdiction in which your data is stored and processed, subject to our operational coverage.
• Residency Attestation: Request evidence of where your data resides, including infrastructure attestations and access logs.
• Transfer Authorisation: Approve or refuse any cross-border transfer of your data. Refusal does not degrade your access to the Services, though it may limit features that inherently require multi-region coordination.
• Access Control: Define which of your personnel and which QCE Vision personnel may access your data, and under what conditions.
• Deletion: Request deletion of your data at any time, subject to legal-retention obligations, with confirmation that deletion has been completed.
• Portability: Export your data in a structured, machine-readable format (JSON/CSV) at any time, without penalty or lock-in.

To exercise any of these controls, contact your account team or write to sovereignty@qcevision.com.

Encryption is the foundation of sovereignty. QCE Vision applies the following custody model:

• Hardware Security Modules (HSMs): All encryption keys are generated, stored, and used within certified HSMs. Keys never leave the HSM boundary in plaintext.
• Key Separation: Keys are separated by tenant and by purpose. A compromise in one tenant does not expose another.
• Customer-Managed Keys: Tier 4 customers may hold their own key material or require dual control over key operations. In this configuration, QCE Vision cannot decrypt customer data without the customer's participation.
• Rotation: Keys are rotated on a scheduled cadence and on demand following any suspected exposure.
• Post-Quantum Readiness: We are migrating key material toward post-quantum cryptographic algorithms to protect against future decryption threats.

Sovereignty is not only a policy, it is a physical architecture. QCE Vision operates the following sovereign substrate:

• Bare-Metal Compute: Core workloads run on bare-metal infrastructure under our operational control, with no dependency on public-cloud hypervisors for the critical path.
• Private Enclaves: Regulated and sovereign workloads run in isolated enclaves with dedicated network paths and no shared tenancy.
• JS-SEZ Anchor: Our primary data centre footprint is anchored in the Johor-Singapore Special Economic Zone, providing jurisdictional stability and physical control.
• Dual-Region Resilience: Where required, we operate paired regions within the same jurisdiction to provide resilience without violating residency constraints.
• No Rented Middleware: The critical path, compute, storage, networking, and key custody, does not rely on rented middleware from third-party clouds.

Where a cross-border transfer is lawful and authorised, QCE Vision uses one or more of the following mechanisms:

• Adequacy Decision: Transfer to a jurisdiction recognised as providing an adequate level of protection by the relevant regulator.
• Standard Contractual Clauses (SCCs): The European Commission's SCCs, or an equivalent jurisdiction-specific instrument, incorporated into your agreement.
• Binding Corporate Rules: Where transfers occur within the QCE Vision group, we operate under binding corporate rules that impose equivalent protection.
• Explicit Consent: Where you have provided explicit, informed consent for a specific transfer.
• Contract Necessity: Where the transfer is necessary to perform a contract with you or to implement pre-contractual measures at your request.

Every transfer is documented, logged, and available for audit. You may request a copy of the mechanism applicable to your engagement at any time.

We engage a limited set of sub-processors to deliver the Services. Every sub-processor is bound by a written agreement that imposes data-protection obligations at least as protective as this policy.

• Categories: Infrastructure operators within our sovereign footprint, regulated payment processors, and professional advisers engaged under confidentiality.
• Approval: We maintain a current list of sub-processors and notify customers of any material change, allowing a reasonable objection window.
• Residency: Sub-processors are selected so that their processing aligns with your jurisdiction selection. Where a sub-processor cannot meet the residency requirement, we do not engage it for your workload.
• Audit Rights: We hold the right to audit sub-processors and flow down equivalent obligations, and we can provide evidence of that flow-down on request.

QCE Vision respects the rule of law and the sovereignty of every jurisdiction in which we operate. When we receive a request for customer data from a government or law-enforcement authority, we apply the following procedure:

• Legal Review: Every request is reviewed by our Legal, Sovereignty & Compliance function to confirm it is lawful, specific, and issued by a competent authority.
• Customer Notice: Where lawful, we notify the affected customer before disclosure, so the customer can seek to narrow or challenge the request.
• Minimum Disclosure: We disclose only the data strictly required to satisfy the request, and we do so through secure channels.
• Record Keeping: We maintain a record of every request received, our response, and the legal basis for that response. We publish aggregate transparency statistics annually.
• Cross-Border Requests: Where a request originates outside the jurisdiction where the data resides, we do not disclose without an applicable mutual legal-assistance treaty or equivalent legal process.

Sovereignty you cannot verify is sovereignty you do not have. QCE Vision provides the following verification mechanisms:

• Residency Attestations: On request, we provide a written attestation of the jurisdictions in which your data is stored and processed.
• Access Logs: We maintain and can provide logs of access to your data, including the identity of the accessor, the time, and the purpose.
• Third-Party Audits: We commission independent security and compliance audits on a scheduled cadence, and we make the relevant reports available to enterprise customers under NDA.
• Continuous Monitoring: Automated integrity and schema audits run on a fixed cadence across the substrate. Anomalies trigger immediate investigation.
• Transparency Reporting: We publish an annual transparency report covering government requests, security incidents, and remediation actions.

Sovereignty includes the right to leave. QCE Vision commits to the following exit guarantees:

• Export Without Penalty: You may export your data at any time, in a structured, machine-readable format (JSON/CSV), without penalty or additional fee.
• Coverage: Export includes your account data, submitted content, and metadata necessary to reconstruct your workloads elsewhere.
• Post-Termination Access: Following termination, you retain access to your data for a defined window (typically 30 days) sufficient to complete the export, after which it is deleted in accordance with our Privacy Policy.
• Deletion Confirmation: We provide written confirmation that your data has been deleted from production systems and, within the standard backup-rotation window, from backups.
• No Lock-In: We do not use data gravity, proprietary formats, or contractual restrictions to impede your ability to leave.

We may update this policy as our substrate, our entities, or applicable law evolve. Where a change is material, we will notify affected account holders by email and in-product notice at least 14 days before the change takes effect. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the Services after the effective date constitutes acceptance of the revised policy.

Sovereignty questions, residency attestations, and jurisdictional-control requests are handled by our Legal, Sovereignty & Compliance function, one of the nine core business functions that govern the QCE Vision ecosystem.