TRUST CENTER

1.1 Neutral Jurisdiction & Legal Data Sovereignty

MFour Labs (Pvt) Ltd. is a legal entity incorporated and governed exclusively by the laws of the Democratic Socialist Republic of Sri Lanka.

• Non-Aligned Intelligence Status: Sri Lanka is not a member of the "Five Eyes," "Nine Eyes," or "Fourteen Eyes" intelligence-sharing alliances. This ensures your Administrative Data is not subject to automated, multilateral signals intelligence (SIGINT) harvesting or bulk data sharing between Western intelligence agencies.
• Jurisdictional Independence: As a Sri Lankan entity with no US-based parent company, MFour Labs is not subject to the US CLOUD Act, the Patriot Act, or FISA Section 702. We are under no legal obligation to comply with warrantless data requests from foreign intelligence agencies.

1.2 The "Backdoor-Free" Architectural Covenant

We convert our jurisdictional neutrality into a technical certainty through a Zero-Telemetry Architecture that physically prevents state overreach:

• Data Plane Isolation (No Exfiltration): The IronGrade Runtime executes 100% locally within the Licensee's infrastructure. MFour Labs lacks the technical means to intercept, view, or exfiltrate your Runtime Content.
• Air-Gap Compatibility: Following initial cryptographic identity verification, the software is engineered for Offline Validation. It requires no persistent internet connection to execute logic kernels, ensuring the "Logic Gate" remains closed to external interference.
• Zero Model Training: We do not log, persist, or utilize client inputs or outputs for model training. Your Intellectual Property remains mathematically air-gapped from our foundation models.

2.1 Our Role in the Data Ecosystem

• As a Data Controller: We minimize the collection of account-level data (e.g., developer emails) strictly to what is necessary for license performance under Section 6 of the PDPA.
• As a Zero-Knowledge Processor: For the IronGrade Runtime, MFour Labs acts as a Processor with no access to your underlying data. All processing is transient (RAM-only) within your sovereign environment.

2.2 Data Subject Rights

We honor all statutory rights under Part II of the PDPA, including the Right of Access (Sec 13), Right to Rectification (Sec 14), and Right to Withdrawal of Consent (Sec 19).

4.1 Validity of Digital Contracts & Credentials

All digital signatures, identity keys, and cryptographic handshakes utilized by the IronGrade Software are legally recognized and admissible under the Electronic Transactions Act, No. 19 of 2006 (as amended by Act No. 25 of 2017).

• Functional Equivalence [Sec 7]: In accordance with Section 7 of the ETA, an Ed25519-signed SPU Kernel or digital credential is deemed to satisfy any legal requirement for a "signature," carrying the same weight and enforceability as a traditional wet-ink signature.
• Non-Repudiation & Attribution [Sec 12]: The Software utilizes Automated Information Systems as defined in Section 26. Under Section 12, any electronic record generated by the IronGrade Runtime is legally attributed to the Originator (the Licensee), providing the highest level of non-repudiation for audit trails.
• Integrity Assurance [Sec 5]: Our use of SHA-256 and Ed25519 ensures a "reliable assurance as to the integrity of the information" from the time it was first generated, meeting the "Original Form" requirements of the Act.

4.2 Export Control & Sanctions Compliance

MFour Labs (Pvt) Ltd. operates in compliance with the Imports and Exports (Control) Act, No. 1 of 1969 and the relevant regulations of the Sri Lanka Customs Department.

• Mass-Market Cryptography: IronGrade utilizes standard, non-proprietary cryptographic primitives (e.g., Ed25519, AES-256-GCM). Under global export standards (including the Wassenaar Arrangement principles), these are generally classified as "Mass-Market" encryption for commercial use, requiring no individual export licenses for most benign jurisdictions.
• End-User Responsibility: While MFour Labs is a Sri Lankan entity, the Licensee is strictly responsible for ensuring that the deployment of the Software complies with all applicable local and international export control laws, including the U.S. Export Administration Regulations (EAR) and OFAC sanctions.
• Prohibited Destinations & End-Uses: The Software may not be exported, re-exported, or transferred to any country or entity subject to international embargoes. Furthermore, use of the Software for the development of restricted weaponry (nuclear, chemical, or biological) is strictly prohibited under our EULA.

5.3 Liability Cap (Proportionality & Reasonableness)

5.4 Exceptions to Limitations

Nothing in this Agreement shall exclude or limit liability for:

• (a) Death or personal injury caused by Gross Negligence;
• (b) Fraud or Willful Misconduct;
• (c) Breach of Intellectual Property rights or Data Confidentiality obligations (as defined in the MSA).