Operated to the GDPR, with every client in its own boundary.

Six controls in every build.

Standard from the first release, at no extra cost.

• Isolation per client

  A separate container, a separate database and separate credentials for every client. No route leads from one customer's system into another's.

• Authorisation at the record

  Every record a route returns is checked against the caller, whichever menu they came through.

• Stripping at the read

  Fields a role may not see are removed on the server and never reach that user's browser.

• Reversible releases

  Each release starts beside the live one and takes over only when it responds correctly, so going back is a single command.

• Secrets in a vault

  Passwords and keys live in a vault, and stay out of repositories, committed configuration files and chats.

• Gates on irreversible actions

  A model may read, draft and file. A person releases anything that spends money, deletes a record or contacts a customer for the first time, through a gate in code the model cannot reach.

• Model guardrails
• The release gate

Your data lives where the contract says.

We operate to the GDPR, and by default the servers are in Germany. UAE data residency is available on request and quoted separately. The system can also run on your own infrastructure: we build it, hand it over and support it there, with a 90-day warranty in place of 12 months because we no longer control the machine.

When we arrange hosting, we act as your agent with a reputable third-party provider and manage it for you. We run no data centre of our own. You can move to your own or another provider whenever you choose, and we hand over the paid source code and your data for the move.

• Private & sovereign models

Backups are proven by restoring them.

A backup is a claim until somebody restores it. Ours are verified by extracting the archive, counting files and bytes against that archive's own manifest, and opening every recovered file to find its format's completion marker. They are kept off-site and encrypted.

An exit code proves that a job ended. It says nothing about the data.

One limit to know before you sign. Backups are not part of the delivered build, and the warranty does not cover them. Once a system we host is delivered, they run under a paid plan, either the Premium Subscription or a hosting plan in your proposal that lists them.

Monitoring follows the same rule. A check earns its place only if it goes red when the thing it watches breaks, and silence has to read red too, or 'no news' and 'it died three weeks ago' look identical.

• Managed hosting & support

Personal data, processed only on your instructions.

• You are the controller and SolaryxDev is the processor, acting only on your documented instructions. Article 28 of the GDPR asks that of a processor, and the agreement also binds us to it under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
• Our people are bound to confidentiality, and we apply appropriate technical and organisational security measures.
• Sub-processors work under equivalent obligations. We remain responsible for them and tell you when they change.
• A personal-data breach is reported to you without undue delay.
• Personal data leaves the UAE only as that law permits. Data that originates in the EU moves only under a recognised mechanism such as Standard Contractual Clauses.
• When the agreement ends, your data is deleted or returned, as you choose, unless the law requires it to be kept.

The confidentiality duty lasts three years beyond the end of the agreement, with no end date for trade secrets and source code. This summarises the clauses you sign and is not legal advice.

• Every commitment, clause by clause

Your data trains no model anyone else can reach.

We do not use your confidential information, materials or prompts to train general-purpose AI models. Retrieval puts your passages into the context of one request and nothing is learned from them. For data that must never leave your premises, open-weight models run on your own hardware.

No certifications held, and evidence for every answer.

We do not hold ISO/IEC 27001 or a SOC 2 report, and we do not imply either. What we give you instead is a written answer to your security questionnaire, whether SIG Lite, the CSA CAIQ or your own, with the evidence behind each answer: the configuration, the test or the restore that proves it.

Send it before the proposal, when it is easier for both sides to settle than in the middle of procurement.

Five things we will never do with your data.

• Use your data to train a model anyone else can reach.
• Keep a copy of your database on a laptop.
• Let an automated system spend, delete or contact a customer unsupervised.
• Report a backup as good because the job exited zero.
• Put a secret into a repository, a log or a chat.