What “UAE data residency” actually means
Residency, sovereignty, privacy and regulatory compliance are four different questions. Conflating them is how vague claims get made. Here is what each one means for Enclave42, and where UAE residency specifically applies.
Four different questions
- Data residency — where data and workload processing are physically located.
- Data sovereignty — jurisdiction and control considerations associated with that data and infrastructure.
- Privacy & security — the technical controls protecting data and workloads while they’re processed.
- Regulatory compliance — a separate legal determination, one that cannot be inferred solely from residency or from attestation.
None of these implies the others.
Where does Enclave42 process your data?
On Explore, Build and Business, workloads run in attested Intel TDX enclaves whose physical location is not guaranteed. On the Sovereign plan, inference is executed on UAE-resident infrastructure, guaranteed in your contract — provisioned per customer.
What attestation proves — and what it doesn’t
Attestation proves that a specific runtime instance was genuinely executing inside an attested Intel TDX trust domain on an attested NVIDIA GPU, and that the encryption key offered to you belongs to that instance. It does not, by itself, establish where that instance is physically located, and it is not a regulatory compliance determination.
Read the full attestation verification guide · What our security model protects
What the Sovereign compliance pack includes
The Sovereign plan adds signed, timestamped attestation reports you can archive and hand to an auditor, plus a compliance pack: a Data Processing Agreement, a processing register template, and an AI impact assessment template. These are inputs to your own compliance process, not a certification of compliance by Enclave42.