CasEngine AI: how your data is protected.
Your firm's data is stored in the UAE, AI requests are handled only by Microsoft Azure, and nothing you submit is used to train a model. Each point below is a binding commitment in our Terms and Conditions (v3.0.1) and Privacy Policy (v3.0.1), not a marketing claim.
Five commitments, in the contract.
Stored in the UAE. Your database, documents, search index, backups and AI conversation history are held in Microsoft Azure UAE North and are not moved out of the UAE (Privacy 8.1, Terms 18.9).
AI runs only on Microsoft Azure. AI requests go to Azure OpenAI Service, Azure AI Search and Azure AI Document Intelligence, under our own enterprise Azure subscription, and to no other AI provider (Terms 18.6).
Never used to train models. Neither Code Engines nor Microsoft uses your prompts or results to train or improve any model, and they are not shared with OpenAI (Terms 18.7).
Off until you switch it on. AI is disabled by default. Only your administrator can enable it, after accepting the AI disclosure, and can switch it off at any time (Terms 18.2).
Stated plainly where processing can leave the UAE. Today an AI request may be processed in another Azure region. We put that in the contract rather than leave you to find it out later (Terms 18.9, 19.5).
Stored in the UAE, processed on Azure.
Where your data is stored and where an AI request is processed are two separate questions, and we answer both (Privacy 8.4). Storage is fixed in the UAE. Processing happens in UAE North whenever Microsoft has capacity there; otherwise Microsoft's global deployment may serve the request from another Azure region.
A request carries only the extracts needed for the task; the result comes back and is saved in your UAE database. Under Microsoft's terms, using another region changes only where processing happens: Azure's data protection and compliance commitments still apply.
What is promised, and by whom.
Two layers of contract protect your data: our agreement with your firm, and Microsoft's enterprise terms with us. Microsoft's are its published enterprise terms for Azure, the same for every Azure customer.
| Commitment | Given by | Where it is written |
|---|---|---|
| Content is processed only to provide the service; never sold, used for advertising or for our own purposes | Code Engines | (Terms 19.3) |
| Prompts and results are not used to train any model and are not available to OpenAI or to other customers | Code Engines and Microsoft | (Terms 18.7) Microsoft data privacy terms |
| The models are stateless: no prompt or result is stored in the model | Microsoft | Microsoft data privacy terms |
| With Global processing, only the place of processing changes; data at rest, including the abuse-monitoring store, stays in the geography of our Azure resource, which is UAE North, and Azure's compliance commitments still apply | Microsoft | Microsoft data privacy terms |
| Processing is governed by Microsoft's Data Protection Addendum, with standard contractual clauses for any transfer | Microsoft | (Terms 19.4A, 19.5) Microsoft DPA |
| 30 days' notice before a core sub-processor is added or replaced, with a right to object and terminate | Code Engines | (Terms 19.4B) |
| Notice of a security breach within 72 hours | Code Engines | (Terms 19.9) |
| Security documentation and a questionnaire once a year; an audit right for DIFC and ADGM firms, or where your regulator requires it | Code Engines | (Terms 19.10) |
| Your database, files and search index are deleted after termination, confirmed in writing on request | Code Engines | (Terms 19.11A, 19.13) |
Abuse monitoring, stated plainly. Microsoft screens AI requests automatically for misuse of the service. Under its standard terms it may keep prompts and results for up to 30 days, stored in the UAE because our Azure resource is in UAE North, and authorised Microsoft staff may review a request only if it has been flagged, using secured workstations and just-in-time approval. That content is never used for training. Microsoft can approve enterprise customers for zero-retention abuse monitoring, which removes the storage and human review entirely. Until we hold that approval, (Terms 18.8A) discloses the standard position, and we will update it once approval is granted.
Safeguards inside CasEngine.
The platform itself limits what is sent, who can see it and who can switch AI on.
Your firm is walled off.
Each firm has its own database and its own search index, both held in UAE North. No user of one firm can reach another firm's content (Terms 19.6).
Encrypted throughout.
Content is encrypted in transit and at rest (Terms 19.6).
Only what the task needs.
A request sends the extracts needed to answer it, typically passages from your own matter documents, not your whole file.
Document reading stays in the UAE.
Text extraction from PDFs and scans, including Arabic, runs against the UAE North regional endpoint.
Deleted means excluded.
Records a user deletes are excluded from search and from AI features (Terms 19.11).
Our staff do not read your AI content.
We look at prompts or results only when you refer us to them in a support request or defect report, or where the law requires (Terms 18.8).
Support access is approved, timed and logged.
It needs your approval and a one-time passcode, expires, and is recorded in an audit log your administrator can see (Terms 19.7).
Infrastructure access is restricted.
A short named list of staff, each on multi-factor authentication, under an information security management system aligned to ISO/IEC 27001 (Terms 19.7A).
Spending cannot run away.
AI draws on prepaid credits and stops when the balance runs out (Terms 18.2).
Your firm's choices.
Your firm decides whether AI is used at all, and the decision can be changed at any time.
| Option | Where your data is stored | Where AI processing happens | Available |
|---|---|---|---|
| AI switched off | UAE North | No AI processing; nothing is sent to Azure OpenAI | Now, the default for every account (Terms 18.2, 18.8B) |
| Standard AI | UAE North | Microsoft Azure: UAE North where capacity allows, otherwise another Azure region | Now, once your administrator enables it (Terms 18.9) |
| UAE-only AI | UAE North | UAE regions only; a request that cannot be served in the UAE fails rather than travel, and is not charged | When Microsoft provides UAE capacity for it (Terms 18.9A) |
Switching AI off leaves the rest of CasEngine untouched. If your regulator or a client requires consent before AI is used on a matter, that decision stays with your firm (Terms 18.5).
Questions firms ask.
Only in four cases, all listed in Privacy 8.2: AI requests served by Azure capacity outside the UAE; an integration your firm switches on (SharePoint, DocuSign and others, all off by default); an external AI assistant your firm connects, whose provider works under your own agreement with it, not ours (Privacy 7.2A); and application error reports sent to Sentry, which carry a user identifier, IP address, the page in use and technical details of the error.
No prompt or result is stored in the model. The only storage is Microsoft's abuse-monitoring store described above, which Microsoft keeps in the UAE, where our Azure resource is, not in the region that did the processing.
OpenAI cannot: Azure models do not connect to any OpenAI service. Microsoft staff can see a request only if its abuse screening flags it, and zero-retention approval from Microsoft would remove that too.
UAE Federal Decree-Law No. 45 of 2021 (PDPL), and where they apply to you the DIFC Data Protection Law 2020, the ADGM Data Protection Regulations 2021 and the Saudi PDPL (Terms 19.2). Firms in the DIFC, the ADGM or Saudi Arabia can ask us for the transfer clauses their law requires (Terms 19.5A).
Where is the full wording? The Terms and Conditions (Sections 18 and 19), the Privacy Policy (Sections 6 to 8) and the sub-processor list. These documents govern if anything on this page differs from them. How the platform itself separates each firm's data and controls access is on the security page.
- CasEngine Terms and Conditions v3.0.1, Privacy Policy v3.0.1 and Sub-processors v1.0
- Microsoft, Data, privacy, and security for Foundry Models sold by Azure, updated May 2026
- Microsoft, Products and Services Data Protection Addendum
Bring us your firm's data questions
If your risk committee or a client needs this in writing, or wants the transfer clauses its law requires, we will answer directly.