Map the data
Separate storage, indexing, inference, output and retention paths.
Security & trust
Trust begins with a clear data path.
Know what enters the workspace, what may reach an AI model, where professional review happens and which controls must be confirmed before a pilot begins.
Transparency before assurance
Security language should describe the deployment you actually have.
Legal and compliance teams should not have to infer where documents are stored, how AI providers receive content, whether data is used for training or what administrators can audit. Nomoy treats those as scoping questions that require explicit answers.
Define the controls
Agree access, role, audit and provider requirements for the deployment.
State the limits
Publish only certifications and guarantees that are verified and enforceable.
An illustrative data path
Every stage should have an owner and a purpose.
The final architecture may vary by pilot. This diagram shows the questions the deployment needs to answer, not a blanket promise about every configuration.
Nomoy controlled data pathSix visible handoffs. One accountable review trail.
Illustrative sequence01
Matter inputDocuments, instructions and selected sources supplied for the work.
Controlled intake02
WorkspaceStorage, parsing, indexing and access according to the deployment.
Scoped access03
Privacy layerSupported sensitive data can be identified and protected before eligible model use.
Protected handoff04
Selected modelOnly the content needed for the configured AI task should be sent.
Task-limited context05
Evidence checksSources, limitations and output support are organised for inspection.
Reviewable output06
Human reviewA qualified person decides what can be relied on, used or shared.
Accountable decisionIllustrative only · storage and inference locations may differDeployment facts must be confirmed in pilot documentation
The control questions
What a serious pilot should settle before real matters enter.
These are control domains for scoping and verification. They are not certification claims.
Where does each class of data go?
Separate document storage from model processing and document the providers, regions, retention and deletion paths.
- Storage and processing locations
- Data minimisation and retention
- Export and deletion requirements
Who can see and change the matter?
Define organisation, role and matter-level access along with administrator responsibilities.
- User and role model
- Matter access requirements
- Administrative oversight
Which provider receives which content?
Document model configuration, training terms, subprocessors, eligible content and fallback behaviour.
- No shared-training requirement
- Provider and model selection
- Processing-location caveats
What can the organisation reconstruct later?
Agree the activity, output, approval and administrative events that need to be recorded and reviewed.
- Document and workflow events
- Review and approval history
- Administrative and access events
Rampart direction
A privacy layer, not a magic boundary.
The product materials describe Rampart as a layer intended to identify and protect supported sensitive data before eligible content reaches external AI models.
Identify supported sensitive data
Detect configured data types in the content selected for a model-assisted task.
Apply the configured protection
Mask, transform or otherwise protect supported information according to the defined workflow.
Send only eligible content
Limit the model request to the material necessary for the selected task and configuration.
Review the complete system
Treat Rampart as one privacy layer alongside access, provider terms, deployment architecture and human governance—not as a total security guarantee.
No trust claim should outrun the evidence.
This website intentionally does not publish unverified certifications, absolute residency promises, universal encryption claims or a claim that no content ever reaches external infrastructure.
Storage and inference are separatedProvider terms are confirmedCertifications require evidenceSecurity remains layered
Security & trust FAQ
Ask the difficult questions early.
Does Nomoy guarantee that all data stays in the UAE?+
No blanket claim is made. Storage and AI-processing locations may differ. The exact data path, provider and residency requirements must be confirmed for each deployment or pilot.
Does Nomoy use customer documents to train a shared model?+
The intended product position is that customer documents are not used to train a shared model. The enforceable provider terms and deployment configuration should be confirmed during pilot contracting.
Is Nomoy security certified?+
This website does not claim certifications that have not been independently verified and approved for publication.
What is Rampart?+
Rampart is the described privacy-layer direction for identifying and protecting supported sensitive data before eligible content is sent to an external AI model. It is one layer and should not be treated as a complete privacy or security guarantee.
Can an organisation choose the model configuration?+
Model-agnostic configuration is part of the product direction. Available providers, regions and deployment options must be confirmed for the specific pilot.
Trust is deployment-specific
Put the data-flow questions into the pilot scope.
Agree the providers, regions, access model, training terms, audit requirements and professional review path before using real matters.