Data & compliance
Your data stays where it must.
How we handle client data on every project, and how we help you meet GCC data protection rules.
Our commitments
Seven rules on every project.
- NDA and DPA first
Both are signed before we see any of your data.
- Deployed in your region
Your cloud or ours, in-country when your rules require it.
- No data in AI tools without consent
Your data goes into an AI tool only when you have agreed to it in writing.
- We don't train models on your data
Your documents are used to answer your users' questions, nothing else.
- Least access, logged
Engineers get only the access a task needs, and access is logged.
- Tested before launch
Accuracy, safety and failure cases are tested in Arabic and English before anything goes live.
- Deleted at the end
When the project ends, we delete or return your data as the contract says.
GCC rules
Which data protection law applies.
| Country | Law | What it means for an AI project |
|---|---|---|
| UAE | Federal Decree-Law No. 45 of 2021 on Personal Data Protection. DIFC and ADGM have their own rules. | A lawful basis and a clear purpose for personal data, and limits on transfers outside the UAE. |
| Saudi Arabia | Personal Data Protection Law (PDPL), overseen by SDAIA. | Strict rules on sending personal data abroad. Many public-sector and regulated projects keep data in the Kingdom. |
| Qatar | Law No. 13 of 2016 on Personal Data Privacy Protection. QFC has its own regulations. | Consent and purpose rules for personal data, and duties to protect it. |
General information, not legal advice. Your legal team decides what applies to your project.
In-country hosting
Where we can deploy.
- UAE
Microsoft Azure UAE North and UAE Central, AWS Middle East (UAE), or your own servers.
- Saudi Arabia
Google Cloud Dammam, Oracle Cloud Jeddah and Riyadh, or your own servers.
- Qatar
Google Cloud Doha, Microsoft Azure Qatar Central, or your own servers.
- Fully private
Open models running on your own hardware when no data may leave your building.
FAQ
Questions security teams ask.
Which AI models do you use?
We choose per project: models from Microsoft Azure, AWS or Google Cloud in your region, or open models on your own servers when data can't leave.
Do you train models on our data?
No. Your documents are used to answer your users' questions. They are not used to train any model.
Can you sign our NDA and security questionnaire?
Yes. We work with your NDA, your DPA and your security questionnaire, and we can use our templates if you don't have one.
Do users know they are talking to AI?
Yes. We build that into every assistant, and every answer shows its source so people can check it.
Templates
Request our DPA template.
Our data processing agreement and NDA templates, sent to you within 24 hours.
Ask us anything about data.
A 30-minute call with a senior engineer, in English or Arabic.