Talk to an expert

AI Security & Governance

Define how AI uses your data and takes action.

An AI project raises specific questions about the information used, the people who can access it, the actions the system may take and who is responsible for what. We work through these questions with you from the scoping stage, because the answers depend on your environment and the project's scope.

Review your security requirementsFree initial consultation

Four questions to settle before you deploy.

  • What information does the system need?

    We list the sources the task needs, and only those. Sensitive information is identified at the start, so we can decide whether to exclude it, mask it or process it in a dedicated environment.

  • Who can access it?

    Access follows your internal rules. The system gets only the rights its task needs, and each user sees only what their own rights allow them to see.

  • Which actions can the system take?

    Looking something up, drafting, changing a record and sending a message are separate permissions. We set them one by one, together with the human approval that applies to each.

  • Who reviews outputs and exceptions?

    Someone on your team owns the system day to day. They approve the planned actions, handle the exceptions passed to them and decide on adjustments, with our support.

  • Some answers come from your internal policies, others from supplier terms, and others from technical configuration. The project settles from the start who decides what.

We map your data's path, from source to deletion.

For every project, we map the path of three sets of data that often get mixed up, and for each we set out the purpose, the storage location, the recipients and the retention period. We also check each provider's terms before choosing it, including data retention and use for training.

Hosting chosen project by project.

  1. Your own infrastructure

    The system and, where needed, the AI model are installed on your premises, so your documents don't leave your servers. The hardware, its capacity and its operation stay with you.

  2. A server managed by Claro

    We handle hosting, updates and backups. The server's location is set in the contract.

  3. A managed cloud service

    Capacity scales with use and setup is simpler. The data is held by the cloud provider, in the region chosen.

The hosting choice depends on how sensitive your data is, the quality you need, the volume to process and your capacity to run a server. Your own infrastructure gives you the most control, but it asks for more resources and maintenance on your side. As for the AI model, we aren't tied to any provider, so we choose with you, from the models available on the market, the one that fits the need, taking into account data location, quality, usage cost and performance.

Every control has an owner.

  • Access and permitted actions

    The system gets only the access its task needs, and every action it can take is on a list you approve. Your IT team grants and removes that access.

    OwnerYour IT team

  • Human approval and exceptions

    Actions that commit your company wait for approval from an authorised person. Incomplete or out-of-scope cases go to a colleague, and your business owner decides who approves what.

    OwnerYour business owner

  • Logs and monitoring

    The system's actions are logged, with the information used and the name of the person who approved. These logs let you understand a decision afterwards, and their retention period is set in the project.

    OwnerOur team

  • Evaluation and change review

    Any change to the instructions, connections or model goes through a separate development environment first, where it's tested against the evaluation cases. You approve changes that alter how the system behaves.

    OwnerYou

  • Incidents and owners

    If an incident occurs, the named owner can pause the system or remove an access straight away. We then analyse the cause with you, following the split of roles set in the contract.

    OwnerThe named owner

We don't control your suppliers' infrastructure, which is why the contract sets out in writing what each party is responsible for: your team, ours and the suppliers chosen.

Written decisions that you review and approve.

  1. Diagram

    Data flows and architecture

    Approved by

    A document shows the sources, processing, storage locations and suppliers involved. You approve it, and it can support your own internal or regulatory steps.

  2. Matrix

    Access and approval rules

    Approved by

    A matrix shows, for each action, who can carry it out, who must approve it and what the system may not do. Your business owner and IT team approve it.

  3. Plan

    Evaluation and monitoring plan

    Approved by

    This plan sets the test cases, the indicators tracked after go-live and how often reviews happen. It also states what triggers an alert or a pause.

  4. Procedure

    Roles and change procedure

    Approved by

    This document names the owners on each side and describes how a change is requested, tested, approved, then released to production.

Depending on scope, a project includes some or all of these documents. They describe your system and your decisions, and they are not a certification.

An example of controls in place.

  • Multi-store retail

    NYS

    In the ERP built for NYS, the AI copilot answers within the logged-in user's permissions, so it doesn't reveal information that user couldn't view themselves. Voiding a sale at the till requires a manager's code and a reason, and every stock or till movement is written to a ledger that can't be altered afterwards.

Morocco's Law 09-08

In Morocco, Law 09-08 governs the processing of personal data.

  • Your company

    As the data controller, your company files the declaration or the authorisation request with the CNDP, the national data protection authority.

  • Claro

    We document the data flows you need to prepare those steps.

  • Your legal adviser

    We recommend having those steps reviewed by them.

A provider based outside Morocco may also come under the rules on transferring data abroad. We don't provide legal advice or certification.

Further reading

FAQ

Frequently asked questions

Can we use confidential documents?

Yes, provided you decide before the project who can view them and where they're processed. For documents that must not leave your company, the system and the AI model can be installed on your infrastructure. For the rest, we choose a provider whose data retention and usage terms we have checked.

How are providers and hosting chosen?

We start from how sensitive the data is, the quality the answers need, the volume and your capacity to run a server. Since we aren't tied to any model provider, we compare the options available and present the one that fits, with its trade-offs in control, usage cost and maintenance.

What can our people approve or stop?

Your teams approve the actions that commit the company, following the agreed list, and can reject any proposal from the system. The named owner can also pause the system or remove an access at any time. How an agent works, from request to approval, is covered on our AI Employees & Agents page.

Who monitors the system after deployment?

The named owner on your team follows day-to-day use and handles exceptions. Technical follow-up, adjustments and change review fall under our Maintenance & Evolution offer, with a written report each month. Questions of organisation and priorities belong to AI Transformation.

Let's discuss your priorities

Let's review your security requirements.

Tell us about the data involved, the access in place and your constraints on hosting or approval. We'll tell you how we'd govern the system and what you'd need to decide on your side.

  • The call lasts thirty minutes, by video.
  • You speak directly with a Claro expert.
  • Afterwards, we email you the next step we recommend.

Free initial consultation