Short answer
Eshal is an AI customer service platform that stores customer data in Microsoft Azure UAE North (Dubai) and holds both ISO/IEC 27001:2022 certification and a SOC 2 Type II report. It answers and completes customer requests on WhatsApp, web chat, voice and email in 56+ languages, including Gulf Arabic, and hands over to your team with the details already collected.
- Data storage: customer conversations, knowledge base, configuration and audit records are stored and backed up in Microsoft Azure UAE North.
- ISO/IEC 27001:2022: certified, certificate 305026012334IS, scope covering the full platform, audited annually by an accredited third party.
- SOC 2 Type II: security, availability and confidentiality criteria, report period 1 April 2025 to 31 March 2026, independently audited by Securance Pro Assurance.
- Training: customer data is never used to train AI models.
- WhatsApp: Eshal is a Meta WhatsApp Tech Provider.
What "hosted in the UAE" should cover
"Hosted in the UAE" can mean different things, so ask which parts of the service it covers. There are three to check:
- Storage and backups. Where conversation logs, customer records and backups are kept. On Eshal Cloud, all of these are in Azure UAE North.
- AI processing. Where the language model runs when it reads a message and writes a reply. On Eshal Cloud, AI inference runs on Microsoft Azure OpenAI. On dedicated and on-premise deployments, AI processing stays in the UAE as well.
- Support and operations access. Who can reach production data, from where, and how that access is logged.
We state these separately because a regulated buyer needs the exact answer for each, not one label for all three.
What ISO 27001 and SOC 2 Type II each prove
ISO/IEC 27001:2022 certifies that a company runs an information security management system: risk assessment, access control, incident response, encryption and change management, checked by an accredited auditor every year.
SOC 2 Type II is an independent auditor's report on whether security controls actually operated over a period of months, not only whether they were designed. Ask for the report period and the trust service criteria it covers.
The two answer different questions, which is why many banks, telcos and public sector buyers in the Gulf ask for both.
Deployment options
- Eshal Cloud: managed service on UAE-hosted infrastructure. Typically live in one day.
- Private cloud: a dedicated instance in your own cloud account, with your own encryption keys.
- On-premise or air-gapped: the full platform inside your data centre, with self-hosted models supported.
Data Processing Agreements covering the UAE PDPL are available for every deployment. KSA data residency is available for regulated Saudi deployments.
Buyer checklist: questions to ask any vendor
- Where are conversations, customer records and backups stored? Name the cloud region.
- Where does AI processing run on the plan you are buying?
- Can you share the ISO 27001 certificate number and scope?
- Is there a SOC 2 Type II report, which period does it cover, and who audited it?
- Is our customer data ever used to train models?
- Is a Data Processing Agreement covering the UAE PDPL available?
- Is there an audit trail of every conversation and action, and can we export it?
- When the AI cannot complete a request, how does it hand over to a person, and what does the person see?