Products
CheckCompliance essentialsComplyCompliance workstationGovernBoard governanceShieldClient compliance portfolioLedgerBookkeeping and VAT for firmsOnboardClient KYC and CDDScoutCompany setup advisoryLexaraUAE law libraryVerifySanctions and PEP screeningVaultDocument custodyScopeWhat applies to youSolutions
I'm setting up a company in the UAEI run a UAE businessMy company is regulated or a DNFBPI'm a firm serving clientsI'm researching UAE regulationFree tools & guides
UAE free zones directoryFree zone cost calculatorFree zone price indexMainland vs free zoneDIFC vs ADGMBusiness activity lookupIncorporation document checklistLaws libraryRegulatorsUAE Corporate Tax lawUAE AML regulationsVARA regulationsDFSA rulebookADGM FSRA regulationsLexara AcademyBriefings and glossaryCompliance scenariosSample setup reportSecurity & Data Residency
Arakan is built from the ground up for UAE data residency. Not as a configuration option — as the foundation of how the product works. Here's exactly what that means.
Zero-custody architecture preview
Infrastructure
AWS me-central-1 (Dubai)
Primary compute and storage
Arakan-managed document storage runs on AWS me-central-1, Amazon's UAE region, encrypted at rest.
Azure UAE North
Enterprise cloud layer
Azure UAE North provides the enterprise-grade cloud backbone for redundancy and institutional-level SLA compliance, with in-region logic execution for Microsoft-centric organisations.
Moro Hub (Dubai)
Sovereign data anchor
Moro Hub provides sovereign UAE data anchoring — a DESC-compliant, Tier-IV certified facility, 100% solar-powered, operated under UAE government oversight.
e& Enterprise
National institutional spine
National telecom backbone connectivity with federal-grade security ensures the platform operates on UAE-resident infrastructure end-to-end.
Zero-custody architecture
When you connect a document through Arakan, we compute a SHA-256 hash of the file content and extract the metadata needed for compliance analysis. The original document stays in your Google Drive or S3 bucket.
This means we can validate substance evidence, classify document types, and generate a certified compliance record — without ever taking custody of the underlying file. Your data remains under your control at all times.
This architecture directly satisfies the UAE's Article 52 requirements around in-country data retention, because the data never left the country in the first place.
Document upload
You connect your Google Drive or S3. The file reference is registered in Arakan.
Hash & extract
SHA-256 hash is computed. Metadata and structure are extracted for compliance analysis.
Classify & validate
AI classifies the document type (board resolution, payroll record, lease) and validates it against the requirement.
Seal & archive
The finding is sealed into the immutable audit trail. The original file was never moved.
Compliance & audit readiness
Every finding, every document hash, every report version — stored with an immutable timestamp for the full Article 52 retention window.
SHA-256 hashing on every document and finding. Any tampering with the evidence record produces a verifiable hash mismatch.
The platform generates a certified Statement of Standing — a signed executive memo citing the specific Articles that are satisfied.
Every access to your data is logged by user, timestamp, and action. OWNER, ADVISOR, ANALYST, and VIEWER roles enforced at the data layer.
Arakan-managed document storage is in the UAE. AI features send the text they analyse to our AI model providers, which may process it outside the UAE.
You can provision your own private S3 bucket in me-central-1. All your data migrates into your own custody at any time.
Clarity matters more than marketing. These are hard constraints, not marketing claims.
Store your original documents on Arakan servers
Transfer your data to any server outside the UAE
Share your data between organisations without your consent
Use your data to train any AI model
Allow any Arakan team member to access your data without an audit log entry
Retain your data after you close your account
We're happy to walk through the architecture in detail — or provide a written data processing agreement before you sign anything.