Compliance & Data Residency

This page answers the questions procurement, security and legal teams ask first — who you contract with, where your data lives, who can access it, and what happens to it during and after the work — for every way of working with us: development projects, outstaffing and dedicated teams, AI pods, and our products. Anything here that you need confirmed in a questionnaire or a contract — ask, and we answer in writing.

The short version

Who do we contract with?

Leino Systems Software Design FZCO, a UAE company in Dubai's IFZA free zone — for every service.

Can we sign an NDA first?

Yes — before the first call, on request.

What do we sign?

A master services agreement once, then a statement of work per project or sprint, or an order form per engineer or team. A data processing addendum whenever personal data is involved.

Where does our data live?

In the environment agreed in the contract — your cloud account, a private cloud in your region, your own servers, or a dedicated environment we provision in the region you choose. Never shared with another customer.

Do you keep copies of our data?

No. Our development infrastructure holds our own tooling, not your data; anything outside your environment is deleted at handover.

Is our data used to train AI models?

Never. Not by us, and not by any model provider we use.

Which third parties see our data?

Only the sub-processors named in your contract. On-premises deployments have none. Outstaffed engineers use your providers under your accounts.

Who owns what we build?

You — code, designs, prompts, configuration, documentation. We keep our internal toolkit.

Which regulations are you ready for?

GDPR, UAE PDPL and Qatar PDPPL. Details below.

Can it run inside our infrastructure?

Yes — private cloud in your region or on-premises with no outbound connection.

Contracting entity

Your agreement is with Leino Systems Software Design FZCO, registered in the IFZA free zone, Dubai, United Arab Emirates. Contracts, invoices and governing law sit with this entity for every service.

How we contract

The documents are the same for every service; what changes is the unit of work.

1. NDA — optional, before the first call. Ask for it when you book the call. We sign yours or send ours.

2. Master services agreement (MSA) — signed once. Covers intellectual property, confidentiality, liability, payment terms and the handling of your data across everything we do for you.

3. The unit of work:

• Statement of work (SOW) for a development project or an AI pod sprint — scope and acceptance criteria (for a sprint: what "launched" means), the fixed price, milestones, the named engineers, the deployment environment, the categories of data involved and the sub-processors that apply. A change in scope is a new SOW or a signed change order; a fixed price does not change mid-sprint.

• Order form for outstaffing or a dedicated team — the named engineers, rate, expected hours, duration (short-term 3–6 months, long-term 6–12+ months, or an open retainer), reporting (weekly reports and a ticket system on long-term engagements), replacement terms and notice period.

4. Data processing addendum (DPA) — signed with the MSA whenever personal data is involved. You are the controller, we are the processor; it sets the purposes, the retention period, the sub-processors and the notification duties.

Work starts within 3–5 business days of the signed contract and prepayment. Warranty and support periods for development projects are stated in the SOW (as a guide: 1–2 months for small projects, 3–6 months for medium, an SLA for large).

Deliverables and intellectual property

- You own the deliverables — source code, designs, prompts, model configuration, evaluation sets, infrastructure definitions and documentation. For projects and sprints, ownership transfers on payment of the invoice; for outstaffing and dedicated teams, work product is assigned to you as it is created. Every engineer has signed confidentiality and IP-assignment terms with Leino.

- We keep our internal toolkit — pre-existing and reusable components such as evaluation harnesses, compliance controls (audit logging, PII redaction, access control) and deployment templates. Where toolkit components ship inside your product, you receive a perpetual, non-exclusive licence to use and modify them as part of that product. Your product never depends on us to keep running.

- Open-source components used in a deliverable are listed with their licences at handover.

- Nothing of yours stays with us. Code, data, credentials and access are handed over or deleted at the end of the engagement, and we confirm the deletion in writing on request.

Where your data lives

Development and source code. Our own build and development infrastructure runs in European data centres operated by OVHCloud. Your source code is kept in a repository you own (GitHub, GitLab or equivalent) or in a dedicated repository transferred to you at handover.

Production data. Runs on infrastructure provisioned for your project. You choose the region and the provider; production environments are single-tenant and never shared between customers.

Data used in the work stays in the environment agreed in the contract.

- Development projects and AI pods start on sample or mock data unless the SOW says otherwise. Real data is connected when you decide, only in the environment named in the SOW.

- Real data is processed where it already lives — your cloud account, your private cloud, your servers — or in a dedicated environment we provision in the region you choose. It is not copied to our development infrastructure or to personal devices.

- Outstaffed engineers and dedicated teams work entirely inside your environment, under accounts you issue and your policies. We hold none of your data.

- Access is revoked at handover or at the end of the engagement; any copies outside your environment are deleted, confirmed in writing on request.

Personnel and access

We are a distributed remote team across several countries. The people on your project are named in the SOW or order form; they are the only ones with access to your environment, and that access ends with the engagement.

- Access to production data and source code is limited to authorised personnel on a need-to-know basis.

- Outstaffed engineers and dedicated teams are onboarded under your access policy and your tools, and can be interviewed and reference-checked before they start.

- Engineers use multi-factor authentication and encrypted devices; your data is not stored on personal devices.

- No one in sanctioned jurisdictions has access to production systems or the codebase.

Regulatory readiness

We build and operate to the requirements of GDPR (EU), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the Qatar Personal Data Privacy Protection Law (Law No. 13 of 2016). In practice that means:

- Roles and paperwork. You are the controller, we are the processor; a DPA on request; a record of the processing carried out, provided at handover.

- Data minimisation. Sample data by default; real data only where the product needs it; personal data masked before it reaches a model wherever the design allows.

- Residency and transfers. In-region deployment options for the EU, UAE and Qatar. Where a transfer outside your region is unavoidable, it is named in the SOW with its legal basis (for GDPR, standard contractual clauses).

- Retention and deletion. Set per data type in the SOW; deletion at handover; confirmation in writing on request.

- Incidents. We notify you without undue delay and within the timelines set in your DPA, with the facts we have and what we are doing about them.

- Rights requests. We support access, correction and deletion requests that reach you, within the DPA's timelines.

- Your policies. Outstaffed engineers and dedicated teams follow your data-protection and security policies as part of their onboarding.

For fintech work, the launched product comes with a compliance checklist showing which controls are in place and the evidence for each, written for your compliance owner.

Security

- Encryption in transit (TLS 1.2 or later) and at rest for everything we deploy; secrets kept in a secrets manager, never in code.

- The controls in our toolkit — audit logging, PII redaction, encryption and key management, role-based access control, retention and deletion — are available in every project and pod deployment and switched on by default for fintech work.

- Automated tests and decision checks run on every build and are reported in a form your risk team can read.

- We hold no formal certification such as ISO 27001 or SOC 2 today; we complete vendor security questionnaires and map our controls to those frameworks on request.

Sub-processors and payments

Our delivery and billing chain does not rely on sanctioned vendors, infrastructure or payment rails. Invoices are issued by the UAE entity above.

Products

Our products have their own legal documents, published with the product.

Questions?

We are happy to complete vendor security questionnaires and to put the relevant points into your contract. Reach out and we will respond in writing.