UAE data residency
Your conversations, listings, and lead records sit in Azure UAE North (Dubai datacentre). They do not leave the country. RERA Dubai and ADREC Abu Dhabi data-residency expectations are met by default.
Security & compliance Built so legal & procurement
Built so legal & procurement
can say yes.
Last reviewed · 11 May 2026
Encrypted at rest
Azure SQL, Azure Blob Storage, and Azure AI Search indexes are AES-256 encrypted at rest with Microsoft-managed keys. Customer-managed keys are available on the Pro plan on request.
Encrypted in transit
TLS 1.2 minimum across every public endpoint. The Aisales widget, admin workspace, WhatsApp webhook, and the REST API all enforce HTTPS with Microsoft-managed certificates.
Modern sign-in
Agency admin sign-in is handled by Microsoft Entra External ID for customers. We never see or store your password. Multi-factor is available, and Microsoft federated sign-in is supported.
Hallucination guard
Aisales is constrained to your listings and your permits. The bot is prompted to refuse to invent inventory, RERA / DLD permits, agent contacts, or follow-up commitments your team hasn't made.
Audit log
Every admin action (sign-in, listing edit, lead status change, impersonation) is recorded with actor, timestamp, and tenant context. Available on request to the agency owner.
Data residency in detail
The full operational footprint of Aisales sits inside the UAE:
- Azure SQL Database — UAE North (Dubai). All conversation, lead, listing, and tenant configuration data.
- Azure Blob Storage — UAE North. Listing photos, brochures, floor plans uploaded by your team.
- Azure AI Search — UAE North. Per-tenant indexes for retrieval-augmented generation.
- Azure App Service — West Europe today (App Service quota in UAE North is constrained at the time of writing). No customer data is persisted on App Service instances — they handle request/response only.
- Azure Static Web Apps — Marketing sites (aisales.ae, aigentry.ae) and the admin workspace SPA are served from Microsoft's global edge. They carry no PII.
For agencies who need every component inside UAE North, we offer a Pro-plan deployment with a UAE-North App Service Plan as soon as Microsoft lifts the regional quota.
Regulatory alignment
- RERA Dubai — Aisales attaches the listing's permit number to every quote the bot makes and refuses to discuss properties without one.
- ADREC Abu Dhabi — Same permit-attachment guarantee for Abu Dhabi listings; bilingual conversation supports Arabic-first buyers across Saadiyat, Al Reem, and Yas Island.
- UAE Personal Data Protection Law (PDPL) — Our role as data processor is documented in the Privacy Policy. We sign DPAs with paying agencies on request.
- GDPR-aligned — For EU residents browsing your site, we apply data-subject rights (access, correction, deletion) under the same workflow as UAE PDPL.
Incident response
We notify the agency owner within 24 hours of confirming a security incident that affects their tenant. We publish a written post-mortem within 5 business days for any incident that caused data exposure or more than 4 hours of admin-workspace downtime.
Where we're heading
We are working toward SOC 2 Type I within 12 months of incorporation, and ISO 27001 within 24. Until then, agencies running enterprise procurement can request our Security & Privacy questionnaire response — covers the standard 80 questions Vanta / Drata templates ask.
Contact
Security disclosures & technical contact: it.support@aisales.ae.
DPA requests & procurement questionnaires: info@aisales.ae.