TRUST & COMPLIANCE CENTER

Apex One Berhad is committed to building trusted business relationships through responsible governance, transparent communication, appropriate delivery controls and collaboration with qualified technology providers and specialist partners.

Our projects may span enterprise technology, AI, digital platforms, cybersecurity, engineering, infrastructure, supply chains and other specialized business environments. Depending on the nature of an engagement, delivering these solutions may involve collaboration with partners whose qualifications, certifications, accreditations, technical capabilities or industry experience are relevant to the project.

This Trust & Compliance Center explains our approach to partner credentials, project assurance, responsible technology, information protection and compliance-related matters. It also clarifies how third-party credentials are referenced and represented in our business activities.

1. Our Approach to Trust and Compliance

We believe trust should be supported by clear responsibilities, appropriate evidence and transparent communication—not by broad claims that cannot be verified.

Our approach focuses on five principles:

1. Transparency: We aim to describe our capabilities, partnerships and relevant qualifications accurately, with appropriate distinction between Apex One's own capabilities and those of third parties.

2. Accountability: Project responsibilities, delivery scope and relevant obligations should be established through appropriate documentation and agreements.

3. Evidence-Based Assurance: Where certifications, credentials, technical qualifications or other supporting evidence are relevant, we seek to use appropriate documentation to support the applicable claims.

4. Responsible Partnerships: We work with relevant technology providers, manufacturers, consultants and specialist partners according to the requirements of individual engagements.

5. Scope-Appropriate Compliance: Compliance requirements depend on the industry, jurisdiction, product, service and project. We seek to identify and address requirements relevant to the agreed scope rather than implying universal compliance across every activity.

2. Partner Certifications, Accreditations and Credentials

Qualified Partners. Clearly Attributed Credentials.

Apex One may collaborate with third-party organizations that hold relevant certifications, accreditations, professional qualifications, memberships or other recognized credentials.

Depending on the project, these may include credentials relating to information security, cybersecurity testing, quality management, technical services, manufacturing or other specialized capabilities.

Examples may include credentials associated with ISO standards, CREST and other relevant industry bodies, certification organizations or professional institutions.

These credentials remain attributable to the organizations or individuals that hold them. A partner's certification, accreditation or professional qualification does not automatically mean that Apex One Berhad, all Apex One services or every project delivered by Apex One holds the same credential.

Where appropriate and authorized, Apex One may reference relevant partner credentials in project proposals, technical submissions, tender responses and other business documents to explain the qualifications available to support a specific engagement.

All such references must be relevant to the proposed work and presented within the scope of the credential concerned.

3. Permission, Attribution and Use of Certification Marks

Respecting Ownership and Usage Rights

Apex One recognizes that certificates, accreditation statements, certification marks, membership designations and organizational logos may be subject to intellectual property rights, brand guidelines, licensing conditions and specific rules established by the relevant organizations.

Our approach is to:

• Obtain written permission from the relevant partner before referencing or reproducing its credentials where permission is required.

• Confirm that the permission covers the intended use, including whether the material may appear in project proposals, tender submissions, presentations, marketing materials or on the public website.

• Attribute credentials to the correct partner, legal entity or qualified individual.

• Respect the applicable scope, validity period, usage conditions and restrictions associated with the credential.

• Obtain any additional authorization required from the relevant certification body, accreditation body or trademark owner.

• Avoid altering certification marks, logos or credential statements in ways that could misrepresent their meaning or status.

• Review or remove outdated references when an authorization expires, a credential changes status or its continued use is no longer permitted.

Written permission from a partner does not override the usage rules of the organization that owns or administers a certification mark or trademark.

4. Project-Specific Assurance

The Right Evidence for the Right Engagement

Not every project requires the same credentials, controls or assurance documentation.

Depending on the customer, contract, technical scope and applicable requirements, project-specific assurance may involve:

• Technical Capability: Relevant technical experience, product specifications, implementation qualifications and the capabilities of participating delivery partners.

• Information Security: Relevant security policies, technical controls, testing capabilities or third-party security credentials, where applicable to the engagement.

• Quality and Operational Processes: Relevant quality-management credentials, inspection arrangements, testing processes or manufacturer documentation, where required.

• Regulatory and Industry Requirements: Relevant licences, approvals, certifications, professional qualifications or other documentation required for the specific product, service or jurisdiction.

• Delivery Responsibilities: Defined roles, responsibilities, deliverables, acceptance requirements and escalation arrangements under the applicable project documentation.

• Drone-Specific Regulatory Requirements: Drone supply, manufacturing, operation and training are subject to applicable civil aviation, radio spectrum, export-control, safety, privacy and data-protection requirements. We provide compliance-aware delivery and works with clients to identify applicable requirements. Clients remain responsible for obtaining required permits, licences, registrations and approvals for their operations and jurisdictions. Certification, airworthiness, flight approval and regulatory status are confirmed per product, project and jurisdiction.

The relevant evidence will depend on the project and the documentation available. The presence of one credential should not be interpreted as evidence that every aspect of a project or deployment is independently certified or approved.

5. Information Security and Data Protection

Information security and personal-data protection are important considerations in the delivery of technology-enabled solutions.

Depending on the engagement, relevant considerations may include access management, data handling, system security, confidentiality, infrastructure configuration, secure development, incident management and applicable privacy requirements.

Where Apex One engages third-party service providers or technology partners, their roles and responsibilities may be addressed through applicable contracts, technical arrangements and project requirements.

Our Privacy Policy explains how personal information may be handled through our corporate website. Separate product-specific privacy notices, security documentation or contractual provisions may apply to particular platforms, applications and services.

Any security certification or independent assurance claim must be supported by the relevant evidence and attributed to the correct organization and scope.

6. Responsible Technology and AI Governance

Apex One's technology activities may involve AI, machine learning, analytics, automation, cloud infrastructure, blockchain and connected systems.

The appropriate governance measures depend on the technology, its intended use, the data involved and the potential operational impact.

Where relevant to a project, considerations may include:

• Appropriate access controls and protection of information.

• Assessment of system performance and operational risks.

• Human oversight of consequential automated decisions.

• Data governance and responsible use of information.

• Documentation of technical limitations and dependencies.

• Monitoring, testing and maintenance appropriate to the deployment.

• Applicable legal, contractual and industry requirements.

These considerations are intended to support responsible implementation. They should not be interpreted as a claim that every Apex One solution has undergone independent certification, formal assurance or the same governance assessment.

7. Supply Chain and Third-Party Due Diligence

Certain projects may depend on external manufacturers, equipment suppliers, technology vendors, distributors, consultants or specialist service providers.

Depending on the nature and risk of an engagement, relevant considerations may include supplier capability, product specifications, quality documentation, manufacturing suitability, delivery capacity, commercial terms and applicable regulatory requirements.

Where third-party credentials or manufacturer documentation are used to support a proposal or delivery, they should relate to the relevant organization, product, facility or service and be appropriate to the intended purpose.

The involvement of a third party does not remove the need to define the responsibilities of the respective parties under the applicable project or commercial arrangements.

8. Governance, Integrity and Responsible Business

Apex One recognizes the importance of professional conduct, clear business responsibilities and appropriate controls in building sustainable business relationships.

Our approach to responsible business includes the following principles:

• Accurate Representation: Business capabilities, certifications, partnerships and project experience should be represented fairly and without misleading claims.

• Responsible Engagements: Commercial and project arrangements should be supported by appropriate scope definition, documentation and authorization.

• Respect for Confidentiality: Confidential business, technical and customer information should be handled according to applicable agreements and legal requirements.

• Compliance Awareness: Relevant laws, regulatory requirements and contractual obligations should be considered in the planning and delivery of each engagement.

• Appropriate Escalation: Questions concerning compliance, credential validity, permission or the accuracy of a published claim should be directed to the relevant responsible contact.

These principles describe our intended approach to responsible business and do not, by themselves, represent a claim of certification under a particular governance or compliance standard.

9. Verification and Supporting Documentation

Where relevant to a proposed engagement, Apex One may provide or refer to appropriate supporting documentation, subject to availability, authorization, confidentiality obligations and applicable restrictions.

Such documentation may include partner credentials, certificate details, technical specifications, manufacturer documentation, authorized partner references or other evidence relevant to the proposed scope.

The ability to share a document publicly may differ from the ability to share it confidentially with a prospective customer during a procurement or project evaluation.

Requests for verification should identify the relevant organization, credential, product or project requirement wherever possible. Verification may also be sought from the issuing organization or relevant certification or accreditation body, where appropriate.

Confidential or commercially sensitive documentation may require a formal request, non-disclosure agreement or other appropriate authorization before it can be shared.

10. Scope and Limitations

The information presented in this Trust & Compliance Center describes Apex One's general approach to governance, partner credentials and project-related assurance.

The content does not constitute a blanket representation that Apex One or all its products, services, systems, projects or partners hold any particular certification, accreditation, licence or regulatory approval.

Credentials and certifications are subject to their stated scope, issuing organization, validity period and applicable usage conditions. Their relevance to a particular engagement must be assessed against the actual project requirements.

A website reference to a partner, credential, standard or certification body does not, by itself, establish endorsement, certification, accreditation or approval of Apex One by that organization.

Project-specific commitments and obligations are governed by the applicable written agreements, technical documentation and relevant law.

11. Updates to This Center

Apex One may update this Trust & Compliance Center as our business activities, partnerships, governance practices, supporting documentation or applicable requirements evolve.

Any specific certification, accreditation, credential or partner reference published here should be reviewed for continued accuracy and authorized use.

The latest version of this page will be published on our website with the corresponding “Last Updated” date.

12. Contact Us

For enquiries concerning governance, partner credentials, certification references or project-specific compliance documentation, please contact us.

Please indicate the relevant project, requirement or credential where possible so that your enquiry can be directed appropriately.