The questions a risk officer asks.
Answered here, in plain language, before you have to ask them.
- Where does our data live?
Inside the United Arab Emirates. Systems are built and hosted in-country, aligned to sovereign data expectations for public-sector work. Where a client requires deployment on their own infrastructure, that is supported.
- What can a system decide on its own?
Only what you have written down and approved. Every engagement produces an explicit permission model — what a system may read, write and decide, and where it must stop and ask a named person.
- How do we prove what happened?
Every action is logged against the person accountable for it. An audit log is a build requirement, not an add-on, because a system nobody can reconstruct is a system nobody can defend.
- What if it is wrong?
Escalation paths and rollback are designed in before deployment. Incidents are the case we plan for first, on the basis that a system will eventually be wrong and the question is only whether you find out.
- Is our data used to train anything?
No. Client data is used to serve that client's systems and nothing else. This is contractual, and we will put it in writing before an engagement begins.
- What happens if we stop working with you?
The system keeps running. Documentation, configuration access and a trained owner inside your organisation are handover conditions, not optional extras.
- Who is accountable?
A named person inside your organisation, supported by us. We do not accept a model where accountability sits with a supplier, because a regulator will not accept it either.
What we do not do.
We do not build systems that make hiring decisions, that score individuals against opaque criteria, or that take consequential action without a human gate.
We will decline work that requires any of the above. It is not a marketing position — it is the reason our systems survive a governance review, and it is the reason a government entity can put its name on one.