the certification client Sovereign AI Gateway — Study Guide
**Session date:** 6 August 2026
**Scope:** Multi-provider AI routing under UAE data residency, plus an internal teacher-facing AI interface.
**Reading convention used throughout:** items marked **[V]** are verified against a source retrieved this session, with the source named. Items marked **[I]** are inference or judgement and have not been independently confirmed. Items marked **[?]** are open and must be checked before anything is built on them.
---
1. The problem as stated
Dependence on a single AI provider (Claude) is an unwanted consequence of data residency constraints. The objective is a tier that uses Claude, Gemini, GPT and DeepSeek each where it is strongest, to reduce cost as computation volume grows, without breaching UAE data sovereignty — with a redaction layer in the path.
2. The reframe that unlocks it
The dependency is not on a vendor. It is on the assumption that the model must see identifiable data.
Once identifiers are removed at the boundary, the question "which country does inference happen in" stops being a legal question and becomes a commercial one. Provider choice then becomes a price decision, which is what was wanted in the first place. **[I]**
Everything downstream follows from this single move.
---
3. Verified findings on where inference can legally happen
Azure OpenAI, UAE North
**The trap:** deployment type, not region name, determines residency. Data at rest stays in the designated Azure geography for all deployment types, but global deployment types may be processed in any supported region. **[V]** — Microsoft Learn, *Region availability for Foundry Models sold by Azure*.
Practical rule: **Standard or Provisioned deployment types only.** A Global or DataZone deployment created in UAE North looks identical in the portal and voids the residency claim.
Core42 Compass (G42, Abu Dhabi)
Underlying infrastructure: 86,000+ GPUs across sovereign data centres. **[V]** — Core42 / e& partnership coverage.
**Status: not proceeding.** Cost is out of range for the certification client. Retained here as the reference architecture and as a fallback if the estate ever needs a vendor-attested sovereign path.
Google / Gemini
Additionally, Vertex/Gemini global endpoints do not support data residency requirements. **[V]** — Google Cloud generative AI locations documentation.
**Conclusion: Gemini can never hold personal data in this estate.** It is a de-identified-traffic model only. This is a hard boundary, not a preference.
Claude in the Middle East
But global routing sends requests to supported commercial regions worldwide and is explicitly for workloads with no data residency constraint. **[V]** — AWS Bedrock regional availability documentation.
**Availability from the UAE is not residency in the UAE.** These are different claims and the announcement wording invites conflating them.
Bedrock does offer regional endpoints that resolve to a single specified region for data-residency purposes, at a 10% premium over global. **[V]** — Claude Platform docs, *Claude in Amazon Bedrock*.
**[?] Open:** whether `me-central-1` is offered as an in-region-only regional endpoint for any Claude model. Must be confirmed in the Bedrock model-region compatibility table before Claude is considered for the identified-data pool. Until confirmed, that pool is Azure OpenAI only.
DeepSeek
The weights are open, and DeepSeek R1 is available as a managed model on both Azure AI Foundry and Amazon Bedrock. **[V]** — Microsoft Azure Blog; AWS News Blog.
**Rule: the model is fine, the vendor's own endpoint is not.** Route DeepSeek through a hyperscaler, never direct.
---
4. The redaction layer — the distinction that decides whether it works
This is the part most likely to be got wrong, because both modes look the same in code.
| | Reversible tokenisation | Irreversible stripping |
|---|---|---|
| What it is | Name → token, map retained | Identifiers dropped, no map |
| Legal status | **Pseudonymisation.** Still personal data while the controller holds the key. Risk reduced, transfer not eliminated. | **Anonymisation.** Outside the scope of the regime. |
| Where it may go | In-country pools only | Anywhere |
**Design rule:** two modes, chosen by destination.
- Reversible for in-country traffic, rehydrated on return.
- Irreversible for anything crossing the border.
- **If a task needs the name back *and* needs to leave the UAE, it does not leave the UAE.** No exceptions, because the exception is where the whole architecture leaks.
This is consistent with the existing standing finding that the AI layer requires PII redaction middleware before inference is compliant regardless of hosting region.
---
5. The three pools
Classification is by **data class**, not by model preference or by task.
| Pool | Data class | Destination | Notes |
|---|---|---|---|
| **S** | Identifiers present | Azure OpenAI UAE North, Standard/Provisioned only | Smallest volume. Highest control. |
| **A** | De-identified | Any provider, chosen on price | Claude, GPT, Gemini, DeepSeek via hyperscaler |
| **N** | No personal data ever existed | Cheapest capable model | Lesson generation, framework Q&A, translation of published text, Arabic drafting |
Pool N is expected to be the large majority of volume. **[I]** — worth measuring rather than assuming, once the cost ledger is running.
Enforcement is structural, not procedural
It is then not a *policy* that personal data cannot reach a cheap foreign model — it is mechanically impossible. That distinction is what makes it defensible to a board or an inspector, and it is the reason to do it this way rather than with a routing rule inside application code.
---
6. Building the gateway rather than buying Compass
What Compass actually sells, decomposed
| Component | Can the certification client build it? |
|---|---|
| OpenAI-compatible gateway fronting many models | **Yes.** LiteLLM, free, self-hosted. |
| Sovereign GPU fleet so open-weight models run in-country | **No.** This is the bill. |
| SOC 2 Type II, SLA, a vendor to hold accountable | **No** — and not required here. |
Why the part that cannot be built is also not needed
A sovereign GPU fleet exists to run open-weight models inside the country. But if the redaction layer is real, the only traffic that must stay in-country is the slice carrying identifiers — and Azure OpenAI UAE North already serves that slice pay-per-token, with no GPU commitment. Everything de-identified can go wherever is cheapest.
**Compass's core asset solves a problem this design routes around.** **[I]**
On certification: SOC 2 is third-party attestation. Neither KHDA nor PDPL requires it. What is required is a documented control set — which already exists as the 60-control Education Sector Control Register.
Components to build
- **LiteLLM proxy** — Container App, UAE North, OpenAI-compatible surface
- **Redaction / rehydration service** — Container App, or a LiteLLM pre/post hook
- **Existing Postgres** — token map (Pool S only, short TTL), request audit log, cost ledger
- **`the certification client-secrets-uae`** — all provider keys; nothing in environment variables
Fixed infrastructure cost is near zero on Container Apps consumption pricing. Spend is per-token only.
What is being given up, stated plainly
Blocker
---
7. The teacher-facing layer
Roughly 291 teachers across both schools. The question was whether this can replace per-seat enterprise licensing. It can, and it is assembly rather than construction.
Stack
- MIT-licensed, self-hosted, with SAML, OIDC, LDAP and RBAC included at no additional cost. **[V]** — LibreChat comparative documentation.
- Tracks token usage per user, with a balance/credit system. **[V]**
- Custom endpoints feature accepts any OpenAI-compatible backend. **[V]** — LibreChat custom endpoints documentation.
LibreChat sees **one** endpoint. The gateway does routing, redaction and pool enforcement. Teachers never touch a provider, never see a key, and cannot select a destination.
Authentication through Entra ID on school email addresses. No new passwords, and deprovisioning on a teacher's last day becomes a single action — which is a control-register item, not a convenience.
Cost control, in order of impact
1. **Conversation history depth.** A chat client resends the whole history every turn, so a 20-turn conversation costs roughly ten times a 2-turn one for the same final answer. Cap depth and enable auto-summarisation. **This outweighs model choice.** Cost scales with conversation length far more than with headcount.
2. **Cheap model as default.** Frontier models gated by role to HODs — absent from the dropdown for everyone else, not merely discouraged.
3. **Two budget layers** — per-user in LibreChat, per-key in LiteLLM. Two, because one will eventually be misconfigured.
4. **Prompt caching** on the shared system prompt.
5. **Cap `max_tokens`; disable file upload at launch.**
Do not ship a blank chat box
Ship eight to ten task presets instead. Candidates:
- Lesson plan against FBISE (the school) or Edexcel (the school)
- Differentiation for a named ability spread
- Rubric from a learning objective
- Marking feedback
- Parent email
- Arabic / Islamic Education content routed for subject-lead review before use
A blank box produces unpredictable token spend, unpredictable output quality, and maximum exposure. Presets produce short cacheable prompts, consistent quality, and a record of what teachers actually used AI for — which is self-evaluation evidence.
Two things to settle before it opens
**Teachers will paste student names into the box.** That is the real risk, not the hosting. The redaction layer must be in the path for this interface, and the default endpoint must be the in-country pool.
**LibreChat stores conversations in MongoDB.** That store becomes a personal-data store the moment a teacher pastes a name. It must sit in UAE North (Cosmos DB for MongoDB, or a Mongo container with a persistent volume), with a defined retention period rather than indefinite storage.
Same trade as the gateway
---
8. Cost: what actually moves the number
Provider arbitrage is the smallest of the available levers. In order of impact:
1. **Prompt caching** — the same framework text and lesson context is resent constantly.
2. **Batch endpoints** — corpus processing, certificate runs, report analysis. None of it is real-time.
3. **Task-tier routing** — small model for extraction, classification and grading; frontier model only for generation and judgement.
4. **Retrieval instead of stuffing** — stop sending 130 pages of framework into context.
5. **Conversation history caps** (teacher UI specifically).
6. **Then** multi-provider arbitrage, on top.
Items 1–4 work inside a single provider and will beat four-provider arbitrage on their own. Arbitrage is worth having, but it is the last 20%, not the first.
---
9. Decisions taken this session
- Compass is **not** being purchased. The equivalent gateway is being built in-house.
- Classification is by data class into three pools, enforced by separate virtual keys.
- Redaction operates in two modes, selected by destination.
- Gemini is permanently excluded from any pool touching personal data.
- DeepSeek is used only via a hyperscaler, never via its own API.
- Pool S is Azure OpenAI UAE North only, pending the Bedrock regional-endpoint check.
- The teacher interface is LibreChat with task presets, not a blank chat box.
10. Open items
- **[?]** Bedrock: does `me-central-1` offer an in-region-only regional endpoint for any Claude model?
- **[?]** Azure OpenAI UAE North: which specific models currently have allocatable quota, and what is the request turnaround?
- **[?]** Actual Pool N share of total volume — measure once the cost ledger runs; do not assume.
- **[?]** MongoDB retention period for LibreChat conversations — needs a number, and it needs to be consistent with the board-adopted Digital Learning and Data Protection Policy.
- Preset set for the two curricula — not yet drafted.
11. Build order
1. Azure Policy allowlist edit — `Microsoft.App/containerApps`, `Microsoft.App/managedEnvironments` in `the certification client-prod-uae`
2. LiteLLM proxy as a Container App, UAE North
3. Azure OpenAI UAE North deployment (Standard type), quota request
4. Redaction / rehydration service
5. Virtual keys per pool; cost ledger and audit log to Postgres
6. Cheap-tier and frontier providers registered behind the gateway
7. LibreChat, Entra ID auth, MongoDB in UAE North
8. Presets, budgets, history caps
9. Pilot with HODs before whole-staff release
Nothing at step *n* begins before step *n−1* returns a receipt.