[ AI Governance Gateway ]
Let your team use AI without the risk
ComplAI sits between your people and every large language model — masking sensitive data, enforcing your policies, and logging every interaction before it ever reaches a model.
Governed · GCC-native
In active development
Ahead of first enterprise pilots
- Bring your own keys, or use the ComplAI API
- Cloud, private cloud and on-premise on the roadmap
- UAE PDPL policy pack
Governs every model your team uses
- ChatGPT
- Claude
- Gemini
- DeepSeek
- Qwen
- Mistral
- Llama
- Grok
- + more
Built for regulated GCC enterprises
- Banking
- Insurance
- Government
- Healthcare
- Professional Services
[ The Governance Engine ]
One layer. Every safeguard your security team needs.
Each control understands what is happening in every prompt — and acts on it automatically, before data ever leaves your walls.
01
PII Masking
Detects sensitive data in real time and replaces it with typed placeholders before the prompt is sent.
- Emirates ID, IBAN, account numbers
- Phone, email and custom patterns
- Typed placeholders, not blunt redaction
02
Policy Enforcement
No-code hard-block and mask rules that your security team sets and ComplAI enforces on every prompt.
- Confidential keyword blocking
- Starter pack of GCC PII rules
- Effective immediately, no IT ticket
03
Audit Trail
Every interaction logged with user, model, policy, and outcome — structured for regulatory review.
- Tamper-evident retention
- Filter by user, outcome, or policy
- CSV and JSON export
04
Bring Your Own Keys
Customer-owned provider keys, vaulted and cleared after submission. You own the model accounts and the DPAs.
- Keys never stored or rendered back
- Per-group model access control
- Billing covers the governance layer only
05
Usage & Cost Visibility
See who uses which models, what data flows through, and what it costs — by user, model, and provider.
- Live usage dashboard
- Token and cost breakdowns
- Department-level reporting
06
Embedded Where You Work
Governed AI reaches the tools your teams already use, through a tenant-scoped enterprise API.
- Tenant-scoped API keys
- Short-lived embed tokens
- Chat and helpdesk embedding on the roadmap
[ How It Works ]
Your data stays yours. The answer still arrives.
When the sensitive value is the key to the lookup, masking alone would break the workflow. ComplAI tokenizes it, brokers the retrieval inside your boundary, and hands the model only what it needs to reason.
Step 1 / 6
Analyst chat
Your peopleAnalyst
ComplAI · answer
ComplAI gateway · backend
Inside your trust boundaryDetect & tokenize
Sent to external model
prompt: “outstanding balance for CUST_7c41?”
Model tool call · resolved locally
get_account_summary(customer_ref: “CUST_7c41”)
→ resolves to Fatima Al Mansoori · runs as analyst
Core systems retrieval
{ balance: "AED 45,200", last_payment: "2 June", status: "Current" }
minimized · re-tokenized to CUST_7c41
Re-hydrate for analyst
CUST_7c41 → Fatima Al Mansoori
The analyst types a question containing a real name and Emirates ID.
Illustrative interface. Names, identifiers and values are fictional examples. ComplAI supports your path to certification; it does not by itself certify your organization.
[ The Platform ]
Governance that runs in the background
Audit & forensics
A complete record of every AI interaction
Every prompt, outcome, and policy trigger is captured automatically — so when a regulator asks, the evidence is already there.
- Timestamped log of allowed, masked, and blocked events
- Row-level detail with full prompt and metadata
- Filter by user, model, policy, or outcome
Export ready · CSV & JSON
Illustrative interface — example data
No-code policies
You set the rules. ComplAI enforces them.
Build masking and hard-block rules in a self-serve console — no engineering, no redeploy. A new rule takes effect on the very next prompt.
- Starter pack of GCC PII rules on day one
- Custom keyword and pattern rules
- Toggle mask or hard-block per rule
Changes apply instantly — no redeploy
Illustrative interface — example data
Usage & cost
Visibility into AI across the organization
Leadership sees exactly who uses which models, what data flows through, and what it costs — broken down by user, model, and provider.
- Outcome counts for allowed, masked, and blocked
- Daily trend and per-model breakdowns
- Token and cost estimates by provider
—
Allowed
—
Masked
—
Blocked
—
Est. cost · BYOK
Trend against the previous period
Illustrative interface — example data
[ Compliance Frameworks ]
Turn on a standard. Enforce it on every prompt.
Enable the standards your business and your clients require, and ComplAI enforces them on every AI interaction — masking sensitive data, blocking what should not leave, and logging everything as evidence.
Enforce once, map many
Standards overlap. One policy — mask customer PII — can satisfy several regimes at once. Add a second framework and most of the work is already done.
- UAE PDPLAvailable
- GDPRIn Development
- KSA PDPLPlanned
- CBUAEPlanned
- SAMAPlanned
- NCA ECCPlanned
- SDAIAPlanned
- DIFC & ADGMPlanned
- NIST SP 800-53Planned
- + Request a framework
ComplAI enforces information security controls and produces the evidence your auditors ask for. It supports your path to certification; it does not by itself certify your organization, and it does not guarantee compliance.
[ Deployment ]
From kickoff to audit evidence
01
Connect & configure
Bring your own provider keys, choose your region, and apply the GCC starter policy pack. No workflow changes for your team.
02
Go live & govern
Your people access AI through ComplAI from day one. Every prompt is masked, enforced, and logged automatically.
03
Prove the value
Export a full audit trail with usage insight — the evidence you need to scale the rollout with confidence.
[ Security, Compliance & Privacy ]
Built to strict security and residency standards
Designed so your data stays protected and your IT function can sign off on the rollout.
Encrypted in transit and at rest
Encryption across data stores, backups, and audit logs.
GCC data residency
UAE region first, with KSA added as you need it. Prompt content is not transferred across borders.
Keys never stored
Provider keys are vaulted, cleared after submission, and never rendered back.
Secure development lifecycle
Dependency scanning and security review built into the build pipeline.
[ Get Started ]
Govern AI. Don’t ban it.
Talk to us about an early pilot on your own policies, with a full audit trail to prove the value.
- Bring your own keys
- GCC data residency
- Policy-driven governance
[ About ComplAI ]
An independent company, building in the open
ComplAI is an independent company building enterprise AI governance for organizations in the GCC. The platform is in active development ahead of its first enterprise pilots.
If you are weighing how to let your people use AI without losing control of your data, we would like to hear what you are working with.
Get in touch
Tell us a little about your organization and we will come back to you.