Which law are we under, and are we doing the basics?
DIFC, ADGM, mainland UAE and Saudi Arabia each have their own data protection regime. Your licence does not tell you what it expects.
Start withStartup Launch Pack
Startups, scale-ups and investors
Security, data protection and AI governance for Gulf startups, at startup prices
Gulf capital is backing a new generation of startups and AI companies. Their customers, investors and regulators all ask the same questions. We answer them with fixed-fee packages sized for companies that are moving fast.
What Gulf startups get asked for, and when
The same questions arrive at every stage. The difference is who is asking.
Prove it before we sign
Banks, hospitals and government send security and AI questionnaires with short deadlines, and deals stall on them.
Start withAI Trust Passport or fractional CISO
Apply to a sandbox
Fintech, data and AI products testing under DIFC, ADGM, central bank or SDAIA supervision.
Start withSandbox application support
The NCA's controls now reach you
From six staff or SAR 3 million revenue, Saudi private companies fall under the NCA's controls for entities outside critical infrastructure.
Start withSaudi controls gap assessment
The investor's diligence list
Investors increasingly ask about security, data and AI risk. We work for the investor, not the founder, on these.
For investorsInvestor due diligence
Entering the Gulf
Your product is proven elsewhere; your documents were written for somewhere else.
Start withGulf market entry readiness
Fixed fees, published
No day-rate surprises. Every package is fixed before you commit and paid in advance.
01
Startup Launch Pack
The data protection and security baseline for your regime: notices, records, agreements, twelve controls, incident plan and AI use policy.
From AED 9,5002–3 weeks
See the offer02AI Trust Passport
Human-reviewed AI governance evidence your buyers can check, with a Starter tier for early-stage AI companies.
From AED 9,500Starter
See the offer03Fractional CISO and DPO
A named part-time security lead and data protection officer on a monthly retainer you can stop.
From AED 7,500 / month
See the offer04Sandbox application support
The risk, data protection, cyber, AI oversight and exit sections regulators scrutinise hardest.
From AED 12,000
See the offer05Saudi controls gap assessment
Classification and assessment against the NCA's 26 SME or 65 large-entity controls.
From AED 15,000
See the offer06Investor due diligence
Independent cyber and AI governance diligence for VCs, family offices and acquirers.
From AED 12,000 per deal
See the offer07Gulf market entry readiness
For foreign tech and AI companies facing their first Gulf buyer's due diligence.
From AED 42,0006 weeks
See the offerOne company, one lane
We never give an independent opinion on work we helped build. If we have built your baseline or hold your CISO role, we will not also issue your AI Trust Passport or diligence you for an investor, and we will tell the investor why. That is what makes the opinions we do give worth having.
For accelerators, incubators and startup hubs
We work with Gulf startup programmes on member pricing, monthly office hours, and a practical workshop on getting through a first enterprise security questionnaire, in English or Arabic. If you run a programme and want this for your cohort, talk to us.
Questions
We are very early. Where should we start?
With a twenty-minute call. Most early companies need the Launch Pack and nothing else for a while, and we will say so.
Do you take equity instead of fees?
No. Fees are fixed and paid in advance, which keeps our opinions independent of your valuation.
Twenty minutes, no preparation, no charge
Tell us what you are building, where you are licensed and who is asking the questions. We will tell you what you need now, and what can wait.