Data residency within the UAE

Where your data is stored

Customer data at rest is stored in Microsoft Azure UAE North, in Dubai. Backups stay inside the Azure UAE geography, which contains only UAE North and UAE Central. Both www.regulation10.ae and app.regulation10.ae run on Azure Container Apps in UAE North.

A workspace's residency region is set when the workspace is created and stays as set for the life of that workspace. It is the one onboarding choice worth pausing over: moving a workspace to another region later means creating a new workspace rather than changing a setting.

Where processing happens

Storage and processing are separate questions. We answer both.

Personal data detection and Arabic drafting run in UAE North.

Judgement and explanation inference runs on an Azure OpenAI deployment provisioned in UAE North. That deployment uses Microsoft's Global Standard type. Microsoft documents Global Standard as processable in any Azure region, so we make no claim that this inference executes in country.

Classification, redaction and prompt injection screening run on an Azure OpenAI deployment in Sweden Central, on Microsoft's Data Zone Standard type. Processing stays inside Microsoft's EU data zone. Text is processed in flight and is not stored there. Site analytics also run in Sweden Central.

Your prompts are not used to train any third-party model. Microsoft's abuse monitoring may store a flagged prompt for review. Where it does, Microsoft stores it in the Azure geography of the deployment that handled it, so a prompt screened in Sweden Central is held in the EU.

The legal basis

DIFC law does not require data to stay in the DIFC or the UAE. It restricts transfer. Articles 26 to 28 of the Data Protection Law, DIFC Law No. 5 of 2020, permit transfer to an adequate jurisdiction or under appropriate safeguards. Sweden and the wider EEA sit on the Commissioner's adequacy list, so the EU data zone lane relies on Article 26 adequacy. Onward transfers use DIFC standard contractual clauses.

Our sub-processor register names every processor, its purpose, its region and its transfer mechanism. Stripe processes billing in the US and EU. Our customer relationship system runs in the United Kingdom. Both use DIFC standard contractual clauses.

If you are licensed by the UAE Central Bank

Your obligation is different and it is stricter. Article 6.1.6.3 of the Consumer Protection Standards requires you to hold and store all consumer and transaction data within the UAE. Article 6 of the Outsourcing Regulation for Banks, Circular 14/2021, requires your Master System of Record to be maintained in the UAE, requires Central Bank approval and prior written customer consent before confidential data is shared outside the UAE, and requires the Central Bank to keep access to your data.

Our current architecture stores your data in the UAE. It does not process all of it in the UAE. Tell us before you onboard and we will scope a UAE-only deployment against those articles, rather than sell you a claim you cannot take to your regulator.

What this page replaces

This article absorbed a second residency page, "Where your records are stored, and where a prompt is processed", on 29 September 2026. The two answered the same question and disagreed on the part that matters: the older page said no adequacy finding was asserted for any region involved, while this one relies on Article 26 adequacy for the EU data zone lane. Two published pages taking opposite positions on a transfer basis is worse than either position, so the older one was retired rather than left to be found. Its URL redirects here.

What we are still resolving

app.regulation10.ae sits behind Azure Front Door, a global Microsoft service. We are confirming its data position with Microsoft and will publish the answer here.

Microsoft Entra ID, which underpins sign-in, stores directory data in its EMEA geography rather than the UAE. Microsoft documents this, and Dubai Electronic Security Center certification of Azure carries an express exemption for services that depend on it.

This page is current as at 29 September 2026. When an architecture decision changes a processing location, we change this page first.