What your security team will ask, answered before they ask
This page exists to be forwarded. If you need to take an AI project through procurement, your security and legal colleagues will want the answers below in writing. Here they are, including the places where the honest answer is a limitation rather than a feature.
Where your data sits
Data residency is decided per project, before the build, and written into the proposal rather than left to the deployment. Three shapes are available, and they are genuinely different builds rather than a configuration switch:
The trade-off is real and we will put numbers on it for your case: an air-gapped build gives up hosted frontier models and hosted speech synthesis, and on some tasks that costs accuracy. We would rather show you which tasks and by how much on your own evaluation set before you commit than discover it together afterwards.
What happens to your data
- Three permissions, kept separateWhat may be used to train a model, what may only be retrieved at query time, and what must never leave your environment are three different permissions. They are frequently confused, and for regulated material the distinction between training on a document and retrieving from it is often what makes a project possible at all.
- Encryption, access control, audit loggingEncrypted transmission, role-based access control and complete audit logging are part of every project rather than an upgrade. Systems are built to United Arab Emirates PDPL requirements.
- Ownership is set in the contract, not assumedWho owns the fine-tuned weights produced from your data, the vector index built from your documents, and the evaluation set, is written down before work starts. Ask for it in writing. If a proposal leaves it open, that is a reason to ask, whoever the supplier is.
Which entity does what
You contract with FFINITIBYTE TECHNOLOGY L.L.C in Dubai, DED licence no. 1642222. That is the entity that carries the obligation, and the people named on our leadership page are the people you escalate to.
Ffinitibyte itself does not hold ISO 27001. Our development partner does, and work that requires a certified environment is delivered there under our contract with you rather than through a separate relationship you have to manage. Where a project runs partly in a partner environment, the proposal names which components sit where before you sign it.
Figures on this site that belong to the wider group are labelled as the group’s throughout. The Dubai company is young; the group’s delivery record is the group’s. We keep the two apart on purpose, because a procurement reviewer will separate them anyway and would rather we had done it first.
How an AI system is judged before it ships
The evaluation set is agreed before the architecture, drawn from your material rather than a public benchmark, with a threshold per task that decides whether we ship. Your team owns that set; we do not grade our own work on data we chose.
The harness is written before the pipeline and runs on every change afterwards, which is what turns a later model swap into a measurement instead of an argument. Where a task has no clean automatic metric, we define a sampled human review with a written rubric and say so, rather than inventing a score.
After go-live, monitoring covers two things where many deployments cover one: whether the system is up, and whether it is still right. A system that is fast and confidently wrong looks healthy on a standard dashboard. Retraining is triggered by measured drift rather than by a calendar.
What we do not have
Said plainly, because you will find out anyway and it is better coming from us. No ISO 27001 in this entity. No published third-party penetration test yet. No client logos on this site, because most of the work sits under confidentiality. No public benchmark figures beyond what our own running systems report.
What we offer instead is software you can open without asking us. Sylos and Qudwah are both live. Push them, time them, and try to make them say something they cannot support. That is a harder test than a reference call, and it is the one we would rather be judged on.
Something here your team still needs?
Send the question and we will answer it in writing, including where the answer is that we cannot do it. An NDA before detail is standard practice here.
Send the questionStart a conversation
What needs to
work better?
Tell us about the problem, the people and the data.
We will help you work out the next step.