Qovane / Trust center
Compliance & security
Compliant by design,
not by wording.
Cross-border compute sits under export-control, sanctions, securities, digital-asset and data rules at once. We stay out of high-risk territory at the business-model level, then hold the line with policy and process.
| Area | When it applies | What we do |
|---|---|---|
| Export controls (EAR / BIS) | Supplying high-performance AI chips or compute to China and other controlled destinations | Deliver primarily as remote compute, not physical export of controlled chips; review each case, with counsel sign-off before go-live. |
| Sanctions (OFAC) | Dealings with sanctioned countries, regions or persons | Restricted-party screening of customers, partners and their 50%+ owners; any hit stops the deal. |
| Forced labour (UFLPA) | Supply chains touching high-risk regions | Partners must certify no forced labour and accept audits; no sourcing from listed entities. |
| New York BitLicense | Custody, transfer or exchange of crypto, or issuing tokens | No custody, transfer or issuance of any digital asset; USD settlement only. |
| Securities & blue-sky laws | Packaging compute as "shares", yield products or fixed returns | We sell only usage- or term-based services, with no promised yield or dividends. |
| Data protection | Processing personal data, cross-border transfers | Compute and hosting focus with minimal access to personal data; a data processing addendum where needed, and respect for localisation rules. |
| Anti-corruption (FCPA) | Dealing with officials and intermediaries | Third-party due diligence, gift and hospitality limits, accurate books, whistleblower protection. |
| Telecom licensing | Offering telecom or ISP services to the public | We don't offer telecom or ISP services to the public. |
For customers
What we ask before activation.
KYC
Identity & ownership
Company registration details and any shareholders owning 25% or more.
End use
End-use statement
Describe how and where the compute is used and confirm it won't support military or other prohibited uses.
Security
Security controls
- Tenant isolation: bare-metal nodes are dedicated per customer and networks are segmented by tenant.
- Access control: least privilege, multi-factor authentication, retained access logs.
- Partner facilities: written security requirements; supply partners have no access to customer data.
- Incident response: a documented process, with notification as contracts and law require.
- Certifications: SOC 2 Type II and ISO/IEC 27001 are planned and not yet obtained.
Seen a problem?
Report compliance concerns, abuse or security issues directly.