Before a regulated workload moves to the cloud, boards in Bangladesh ask the same two questions: where will the data live, and which country’s law will apply to it? Those are different questions. TiCON Cloud (TICON System Limited) designs the architecture that answers both in writing — usually an AWS estate invoiced in taka, sometimes a hybrid with a local data centre or a custom CDN for the categories that must stay in-country. This page is that conversation. It is not a gazette. Circular numbers, statute titles, article numbers and company certificates wait on sourced lists rather than being guessed so the page can look complete.
A residency page that quotes circulars without a sourced list is a liability. This one names institutions, names regions, and names the work. It does not invent the gazette.
Bangladesh Bank is the sector regulator for banks. The Bangladesh Telecommunication Regulatory Commission is the sector regulator for telecom. The ICT Division is the ministry that owns ICT policy. Those are public institutions. This page does not restate their circular numbers, gazette IDs, or the wording of a “cloud-first” instruction as if a primary source had been checked this week. Personal-data rules exist; counsel names the statute. Act titles, articles and gazette dates are omitted here.
Company certificates are also omitted. The facts file has an empty ISO list. This page does not claim SOC 2, ISO 27001, or a PCI-DSS certificate, and it does not dress encryption and IAM as if they were those certificates. Staff certification counts are not listed. Ping times from Dhaka to Mumbai or Singapore are not published; those need a dated measurement from a Bangladeshi ISP.
What is sourced: AWS has no region in Bangladesh; the usual regions for TiCON production are Asia Pacific (Mumbai) and Asia Pacific (Singapore). Azure and Google Cloud also have no Bangladesh region. TiCON is an AWS Advanced Tier Partner on Partner Solutions Finder and resells AWS usage on a taka invoice. A taka invoice is billing. It is not a statement that the bits sit in Dhaka.
People use the words as synonyms. An auditor does not. Write both down, or the design will be argued about after cutover.
Data residency is the physical and logical place the data is stored and processed: a named AWS region, a named local facility, a cache at an edge, a laptop. If the object lives in ap-south-1, its residency is India for that copy, regardless of the invoice currency. CloudFront and a local CDN can pull cacheable bytes closer to Dhaka; they do not move the origin. Treating an edge hit as “data in Bangladesh” is how reviews fail.
Data sovereignty is which country’s law can reach the data, the operator, and the keys. A copy in Mumbai is still reachable under Indian and US legal process that applies to AWS, and under Bangladeshi process that applies to the customer and to TiCON as the local company on the contract. Encryption and IAM shrink the set of people who can read the copy. They do not delete the legal overlay. The architecture has to say which copy, which region, which keys, and who can compel them.
For a Bangladeshi regulated estate, both answers go in the audit pack before the first replica. “We use AWS” is not either answer. “We pay in taka” is not either answer. “Mumbai, encrypted, keys in a customer-managed store, these IAM roles, this local copy for category X” is a start.
AWS, Microsoft Azure and Google Cloud do not operate a region here. Traffic from Dhaka lands in India or Singapore. That is geography, not a ping-time contest on this page.
AWS’s public regions list, checked on 21 September 2026, has no Bangladesh region. The regions TiCON uses for Bangladeshi production, from the facts file, are ap-south-1 (Mumbai) and ap-southeast-1 (Singapore). Other AWS regions exist; they are not implied as nearer by this page.
Azure’s published India geography lists Central India (Pune), South India (Chennai) and West India (Mumbai), plus Southeast Asia (Singapore). Google Cloud’s published compute regions nearest this work are typically Mumbai, Delhi and Singapore. Announced-but-not-live regions are not treated as available. None of those lists includes a Bangladesh region.
If a board asks “can we put this on AWS and keep it in Bangladesh?”, the honest first sentence is no, not as a region. The honest second sentence is: some categories can run in Mumbai or Singapore with a written control set; some categories need an in-country path; the split is a classification exercise, not a slogan.
| Path | Where the bits sit | What this page will not claim |
|---|---|---|
| AWS in-region | Usually Mumbai (ap-south-1) or Singapore (ap-southeast-1). Encrypted, IAM-scoped, logged. Invoiced in taka on a reseller engagement | A Bangladesh AWS region, or millisecond figures from Dhaka |
| Azure or Google Cloud in-region | India or Singapore, as those providers currently publish. Architecture and operations; not a TiCON taka reseller invoice | A Bangladesh Azure or GCP region, or a CSP/reseller product invented here |
| Local data centre or custom CDN | In-country facility for categories that must stay. TiCON’s custom CDN inside local data centres is the content-sovereignty path already described on the company pages | Sub-millisecond delivery, or a named third-party DC as if it were a published SKU |
| Controlled hybrid | Split by data category: in-region for what may leave, in-country for what must stay, with the boundary in the audit pack | “Hybrid” as a badge with no map of which object goes where |
| CloudFront / edge cache | Cacheable bytes closer to the user. Origin residency is still the named region or local origin | An edge hit counted as in-country storage of the system of record |
AWS region names from the global infrastructure page, accessed 21 Sep 2026. Azure geographies and Google Cloud regions accessed the same day. Ping times omitted.
Source: AWS global infrastructure (opens in a new tab) Checked
Finance and architecture are different workstreams. Mixing them is how a board thinks “we pay locally, so the data is local.”
On a TiCON AWS reseller engagement, usage arrives on a monthly invoice in taka. That document is for the customer’s accounts team and for whoever files the local bill. It does not move S3 objects from Mumbai to Dhaka. The same estate can be fully in ap-south-1 and fully billed in BDT. Both facts can be true at once. Only one of them is residency.
Azure and Google Cloud usage, when those clouds belong in the estate, stay on the paper those providers issue unless a written contract says otherwise. Quoting architecture work in taka does not create an Azure-in-taka or GCP-in-taka reseller product, and it does not create a Bangladesh region for those clouds either.
If the requirement is “the system of record must not leave the country,” start with classification and a local or hybrid path. If the requirement is “we need a local invoice for AWS,” start with the reseller conversation. Do both when both are required. Do not substitute one for the other.
There is rarely one box to tick. The design blends paths by data category, then writes the blend down.
Run the workload in a named AWS region — usually Mumbai or Singapore — with encryption in transit and at rest, least-privilege IAM, logging, and a written statement of where each data class sits. This is the default for estates that may leave the country. It is not “data in Bangladesh.”
Keep origin or a copy in-country when the category must stay. TiCON builds a custom CDN inside local data centres for content sovereignty — the path used when broadcast or OTT bits should not rely on an overseas origin alone. This page does not publish a data-centre SKU list or a millisecond delivery claim.
Split by sensitivity: identity, logs and the product in region; the regulated store or the content library on the local path. The expensive part is the map, not the diagram. If the map is missing, hybrid is just two places the auditor has to chase.
Controls that are not written down do not exist for an auditor. The pack is the product of a residency engagement, not a slide.
TiCON writes the architecture and operates the estate when that is in scope. Counsel writes the legal opinion. Mixing those jobs on a marketing page is how “compliant” becomes a word with no owner. We will refuse to put a circular number on this site that we did not receive as a sourced primary.
The industry page has the architecture pattern per sector. This section is only the residency stance. Legal names of clients are omitted; case studies use descriptor titles.
Banks: Bangladesh Bank is the regulator. The usual pattern is a landing zone in a named region, a taka invoice for AWS usage, and an audit pack. Categories that must stay in-country get a hybrid path. Circular numbers are not restated here. Cardholder-data workloads need a documented boundary. This page does not claim a PCI-DSS certificate.
Government and broadcast: public-sector work needs a sovereignty split in writing. The published write-up is the government-broadcaster case study. A local CDN path is in scope when content must stay. ICT Division circulars are not restated.
Telecom: BTRC is the regulator. Data platforms still need a named region and an access model. Circular numbers are not restated. The telecom data-platform case study is the descriptor write-up for that shape of work.
Personal data: classify it. Counsel names the statute that applies. This page does not restate an act title to look current. Encryption and a location map still have to exist even when the statute citation is attached later.
Bring categories and the regulator you answer to. Do not expect a circular lecture from a page that has no sourced gazette list.
Brief a data-residency design with TiCON
About 30 minutes
A working briefing is classification, the regulator you file with, and a named path per class — not a request for circular numbers this page does not publish.
List the data classes
What may leave Bangladesh, what must stay, whether cardholder or citizen data is in scope, and where backups and logs will live. A single “all of it” line is not a classification.
Name the regulator you answer to
Bank, telecom, public sector, or none of those. Bring the circulars your counsel already holds. This page will not invent them, and the first call will not quote a gazette ID you did not bring.
Pick a path per class
In-region (usually Mumbai or Singapore on AWS), local data centre or custom CDN, or hybrid. CloudFront is an edge, not an origin. Azure or Google Cloud only when that cloud is already the reason — and still with no Bangladesh region.
Separate billing from location
AWS usage can be invoiced in taka while the objects sit in Mumbai. Say both sentences in the brief so finance and architecture do not steal each other’s conclusion.
Demand the audit pack before cutover
Classification, location map, IAM and keys, encryption, logging, and the commercial path. Then talk to an architect. Statute citations belong to counsel; they attach to the pack, they are not a substitute for it.
It depends on the data category and the regulator you answer to. There is no hyperscaler region in Bangladesh. Much of a commercial estate can run in Mumbai or Singapore with a written control set. Categories that must stay in-country need a local or hybrid path. Circular numbers are not restated here.
Residency is where the bits sit. Sovereignty is which country’s law can reach them. A taka invoice decides neither. Name the region or local path, the keys, and who can compel them, in the audit pack.
Banks run cloud workloads. Bangladesh Bank is the sector regulator; circular numbers are not restated on this page. The pattern we publish is a landing zone in a named region, a taka invoice for AWS usage, and an audit pack — hybrid where a category must stay. This page does not claim a PCI-DSS certificate.
No. A taka invoice is billing. AWS production for TiCON estates is usually Mumbai or Singapore. If the system of record must not leave the country, that is a residency design, not a reseller line.
There is no AWS region in Bangladesh. The regions used for this work are ap-south-1 (Mumbai) and ap-southeast-1 (Singapore). Ping times are not published on this page.
A classification, a location map (including backups and logs), IAM and keys, encryption, logging, and the commercial path. Counsel attaches statute citations. Circular numbers are not filled in from this page.
No. Circular numbers, gazette IDs and statute articles wait on a sourced list. This page names the institutions and the architecture. Bring the primary texts you already file against; we will not invent them.
Neither has a region in Bangladesh. Nearest published regions are in India or Singapore. TiCON designs and operates those clouds; it does not invoice their usage as a taka reseller product on this page. Residency is still a named region plus an audit pack.
