Governed at the call, evidenced at the call

Where the gateway sits, and what it records.

Regulation10 governs your systems at the point their model calls happen. Today that is an inline gateway you route calls through. Monitoring agents inside your own cloud, Reg10 Sentinel, are on the roadmap, and we say so plainly.

Shipped today.

Inline OpenAI-compatible gateway, live and governing real inference
A decision record for every call: what was asked, decided, and why
Data resident in the UAE, Azure Container Apps in UAE North
On-premises gateway option and dedicated tenancy at the Sovereign tier

A decision record captures

System and workspaceunderwriting · meridian

Decisionallow · redact

Reason, pinnedart5-prohibition · v2

Timestamp08:41:22.108Z

Sealedsha256 9f4c2a…e71b

Deployment shapes, with an honest status.

The status column carries the word, not just a colour, so a roadmap row can never be mistaken for a shipped one.

Deployment shape	Where it runs	Status	Tiers
Inline OpenAI-compatible gateway	Managed, UAE North	Shipped	Enterprise, Sovereign
On-premises gateway	Inside the client boundary	Shipped, Sovereign option	Sovereign
In-client-cloud monitoring (Sentinel)	The customer's own cloud	Roadmap, not built	–
Sidecar / proxy data plane	The client network	Roadmap	–
Self-hosted vs managed data plane	Client choice	Roadmap	–

Whatever the deployment, every governed call leaves a decision record you can hand to an Accredited Certification Body. The runtime gateway is an Enterprise-and-above capability.

Where inference runs, stated plainly.

Not every stage runs in the same region, and a Trust Centre that hid that would not be one. Data at rest is in UAE North. The classify and redact step, the one that screens a prompt before any response is returned, runs on a second Azure OpenAI deployment in Sweden Central, an EU data zone.

Stage	Where it runs	What that means for your data
Regulated artefacts and audit records, at rest	UAE North (data at rest)	Stored at rest in the UAE; the write region is fixed by the deployment region pin and resolved by a runtime residency check, not per request
High-stakes judgement inference	UAE North deployment (Azure OpenAI)	The judgement calls that need the most context run against an Azure OpenAI deployment provisioned in UAE North. The deployment type Microsoft offers there does not guarantee every request is processed in that region, so we state where the deployment sits, not that each request stays in it.
Classify and redact inference, in flight	Sweden Central (EU data zone)	An EU/EEA region on our data-residency adequacy list, chosen to avoid cross-border transfer agreements. Text is processed in flight only and never persisted there.

No prompt or response content is ever persisted outside UAE North; the Sweden Central deployment only ever processes text in flight. Prompts are not used to train third-party models. Sweden Central is also where the aggregate site analytics we run ourselves are processed; nothing that identifies you is sent there. The same disclosure appears in the sub-processor register and in the signed-in application.

Read the sub-processor register

At a glance

The security posture, in four facts.

UAE North

Data at rest for the .ae lane; classify/redact inference: Sweden Central (EU data zone)

Front Door

In front of app.regulation10.ae, with a web application firewall

Frameworks

DIFC Reg 10, ISO 42001, NIST AI RMF

sha256

Every artefact and decision record is sealed with its content hash

WCAG 2.2 AA, measured in both light and dark themes.

Talk through deployment for your network.

Interactive demo Talk to sales