Answers
Direct answers about what Kerah is, what it builds, how an engagement runs, and what it will not do.
Every answer here restates something published elsewhere on this site. Where the honest answer is “no”, “none” or “not yet”, that is the answer given — an evasive answer would be worse than no question at all.
Kerah designs, builds, integrates and evolves bilingual digital systems and responsible AI for organizations across sectors in the United Arab Emirates and the wider Gulf.
Kerah is the public brand of Kerah - F.Z.E, a Free Zone Establishment — Limited Liability licensed in the United Arab Emirates.
More detail:Company and governance
Kerah is registered in the United Arab Emirates at B.C. 1304527, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates.
It works with organizations in the UAE and the wider Gulf.
More detail:Company and governance
Yes. Kerah - F.Z.E holds trade licence 53032, issued by Free Zones Authority of Ajman, United Arab Emirates.
The licence names two activities: Information Technology Consultancy and Computer Systems and Software Designing. Nothing Kerah offers falls outside them.
More detail:Company and governance
Kerah publishes accountability by role rather than by name. This website names no individual, and that is deliberate rather than an omission.
The person accountable for a given engagement is named in a bid response or under a confidentiality agreement, to the people carrying out an assessment. If you are running a procurement process and need named accountability, ask and it is provided that way.
More detail:Trust Center
Yes. Kerah builds bilingual systems, and this entire website is published in both English and Arabic, including the legal documents.
Arabic is treated as a first-class language in the systems Kerah builds — right-to-left layout, Arabic typography and Arabic content quality are delivery requirements, not a translation step at the end.
More detail:Quality, testing and accessibility
Kerah does not publish a team size, a founding date, a client count or a revenue figure. Nothing on this site states one.
That is a deliberate position: this site publishes what can be verified, and states capability — what Kerah can deliver — rather than a history of what it has delivered. Where a procurement process requires those figures, they are supplied directly and on the record.
Kerah designs, builds, integrates and evolves software: discovery and architecture, enterprise systems, digital product engineering, cloud and data integrations, AI and intelligent automation, managed evolution, security and privacy engineering, and quality, testing and accessibility.
The common thread is systems an organization has to account for — where work, money and decisions need to be traceable afterwards.
More detail:All services
No. Kerah does not operate, host or manage a client's systems as a service. It does not resell infrastructure, capacity or third-party licences, and it does not act as a managed infrastructure provider or a security operations centre.
Kerah designs, builds, integrates and evolves. The client, or a provider the client chooses, runs the result. This is a limit set by what the trade licence permits, and it is stated the same way in the website terms.
More detail:The vendor boundary
Kerah does not offer standalone data processing as a service. It may act as a processor, or as a subprocessor, where contracted design, integration or support work requires it — that is a description of the work rather than a service line, and where it happens it is governed by a data processing agreement.
Which role Kerah holds is decided by what it actually does in a given engagement, not by the label. In most engagement work it is a processor; for the enquiries and business contacts this website handles, it is the controller.
More detail:Privacy notice
Yes, and it is published rather than negotiated case by case. Kerah publishes a set of boundaries that hold in every engagement — limits on what a system Kerah builds may decide or do on its own, and on where Kerah will not act in place of someone holding a licence, permission or duty that Kerah does not hold.
They are limits on the work, not a disclaimer. They are the same in every sector.
More detail:The vendor boundary
Kerah builds for organizations across sectors. The site names the sectors it has material about — what changes between them, and what a system has to account for in each — rather than claiming a client base in any of them.
Some sector rules do change the work: where a client holds a licence, a permission or a duty that Kerah does not, there are things Kerah will not do on their behalf. Those limits are published.
More detail:Sectors
No. Kerah builds software. It does not raise funds, solicit donations, hold or move donor money, or act for a licensed charity in any fundraising capacity.
Where Kerah builds a system that records or reports on donations, the licensed organization remains the one raising and holding the funds.
More detail:The vendor boundary
No. Kerah holds no security or quality certification today, and does not claim or imply one anywhere on this site.
Where a procurement process requires evidence, Kerah provides an assurance pack directly — including completed responses to your own security questionnaire — rather than pointing at a certificate it does not hold.
More detail:Trust Center
Kerah builds for organizations across sectors, including public-sector bodies, within the two activities its trade licence names.
Whether a particular public-sector engagement requires a supplier registration, an onshore presence or another approval is a matter for that authority's own rules, and Kerah does not claim to hold any registration it has not obtained.
More detail:Company and governance
Send an enquiry describing the problem, the constraints and the decision process. You get a reply from a person — not an automated acknowledgement — within two business days.
That is followed by a short call about the problem rather than a pitch, and an honest answer on whether Kerah is the right choice. If it is not, Kerah says so.
More detail:Start a project
Through seven stages: qualify, discover, approve the blueprint, mobilize, build in demonstrable increments, accept and launch, then operate and evolve.
The blueprint is an approval point on purpose. It is where the scope, the phasing and the price become something you can approve, stage, re-price or stop — before the build starts.
More detail:How we work
A signed master services agreement and the statement of work executed under it. "Signed" includes signed electronically, by people authorised to sign for each side.
Nothing on this website commits Kerah to carrying out work, and material sent before those documents are signed is sent subject to contract. Where the signed documents and the website terms differ, the signed documents prevail.
More detail:Website terms
Ownership of engagement output is set in the signed agreement for that engagement, not by this website.
This site deliberately does not state a default position on it, because doing so could contradict the agreement a client actually signs. Ask during qualification and it is answered directly.
More detail:Website terms
Please do not. The enquiry form is a general business route, not a secure channel, and sending one does not create a confidentiality agreement.
If you need to share confidential material to describe the problem properly, say so first and ask for an agreement. That said, duties the law itself imposes — on personal information, on trade secrets, and on confidential material received while discussing possible work — apply whether or not anything is signed.
More detail:Website terms
An enquiry gets a reply from a person within two business days. A security report is acknowledged within five business days.
Those are commitments about answering a person. Kerah publishes no availability figure, no restoration target and no service-level commitment anywhere on this site — those belong in a contract's service schedule, not on a public page.
More detail:Start a project
Yes, where AI can reduce repetitive work or improve access to information — with the boundaries, the evaluation and the human oversight defined before anything is built, rather than reviewed afterwards.
Kerah's position is that an AI system in an accountable organization has to be reconstructable: you need to be able to establish later what it was given, what it did and who authorised the result.
More detail:Responsible AI
Not the ones that matter. Kerah publishes a list of acts a system it builds will not perform autonomously — including releasing or transferring money, granting or withdrawing a person's entitlement, overriding a control or approval limit, making an employment or credit decision, submitting a regulatory filing, and any action on which a person's safety depends.
A system may recommend, rank, reconcile, draft and flag in every one of those areas, and an agent may carry out the steps leading up to one. The act itself requires a person holding the relevant authority, and the system records who exercised it.
More detail:Responsible AI
No. Neither Kerah nor any subprocessor uses a client's data, prompts, documents, images, metadata or model outputs to train, fine-tune or improve a general-purpose or shared model.
This applies to every engagement by default and is written into the AI governance schedule. It is not conditional on a setting, a tier or a configuration choice.
More detail:Responsible AI
That is the requirement Kerah designs to. A system is expected to preserve the input and the source records it was drawn from, so a result can be reconstructed rather than merely trusted.
A sequence of steps nobody can replay is not traceable simply because each step was logged. That distinction is the point of the traceability record.
More detail:Responsible AI
There has to be a route to a person. Kerah's position is that an outcome affecting someone must be appealable to a human who can actually change it, and that the route is designed in rather than added after a complaint.
More detail:Responsible AI
Security and privacy engineering is treated as part of delivery rather than a review at the end: threat modelling, access design, data protection and incident readiness are decided at the start of an engagement.
Kerah publishes no company-wide security claim it cannot evidence, and holds no certification. What it can provide is an assurance pack and completed answers to your own security questionnaire.
More detail:Security
Report it privately to the security address published on this site, with enough detail to reproduce it. Reports are acknowledged within five business days.
Reporting a weakness does not authorise you to test for one. Unless Kerah has authorised you in writing — naming the asset, the methods and the period — please report only what you noticed through ordinary use. Provider infrastructure and any system built for a client are never in scope.
More detail:Acceptable use policy
There is no bug bounty programme, and no payment is offered for a report.
Kerah will not bring a contractual or civil claim against a researcher who reports in good faith within the published limits. That is a commitment about what Kerah will do; it is not immunity from the criminal law and does not bind the police, a regulator, a client or the providers this site runs on.
More detail:Acceptable use policy
This website is not hosted in the United Arab Emirates. It is served from a global edge network, so a request is answered by whichever location is closest to the visitor.
An enquiry then travels through a delivery provider and into a mailbox hosted by an email provider. Kerah makes no residency claim about this website. Residency commitments for a client platform are a separate matter, set in that engagement's contract.
More detail:Privacy notice
Three providers handle information for this website: a content delivery network that serves the site and keeps request logs, a provider that transmits an enquiry to Kerah's mailbox, and the email provider hosting that mailbox. All three are named in the privacy notice.
Beyond those, Kerah does not transfer personal information to anyone, except where the law requires it, where it is necessary for a legal claim, or in the narrow circumstances described in the clause on abuse and security reports.
More detail:Privacy notice
Ninety days from the day it arrives. If it becomes a live piece of work it stops being an enquiry and is kept under the agreement covering that work instead.
Deleting something from a live system does not always remove it from a backup at the same moment; a backup copy ages out on its own schedule.
More detail:Privacy notice
Kerah OS is a Kerah product, published on its own site and under its own terms. It is one product rather than the company: Kerah is a software company, and Kerah OS is something it builds.
This website covers Kerah the company. Anything published about the product belongs on the product's own site, including its own privacy notice.
More detail:Products
This website publishes no availability date, price, plan or sign-up route for any Kerah product, because none has been supplied and verified.
If you want to know where a product stands, ask directly and you get the current answer rather than a page that may have gone stale.
More detail:Products
Both, and they are kept separate on purpose. Kerah builds systems for clients under contract, and it builds its own products.
A client engagement is governed by its own signed agreement. A product is governed by the terms published with that product. Neither set of terms reaches the other.
More detail:Products
No. There is no analytics provider enabled, no advertising or behavioural tracker, no profiling and no cross-site identifier of any kind. That is also why there is no consent banner: asking permission for something that does not happen would be theatre.
The site embeds no third-party script, tracker, advertisement, chat widget or embedded content, and loads no font, stylesheet or image from a third-party host. An automated test asserts that loading a page makes no external request before any change can be released.
More detail:Cookie notice
It sets no measurement, advertising or tracking cookie. The only cookie is a preview-access cookie, which exists solely while the site is unpublished and is set only for a browser that has been given a preview link.
The cookie notice lists it in full — what it stores, what sets it and how long it lasts.
More detail:Cookie notice
Accessibility is treated as a delivery requirement rather than an afterthought, in what Kerah builds and on this site: semantic structure, keyboard operability, visible focus, contrast checked against the palette, and state never carried by colour alone.
Motion respects a reduced-motion preference, and content is never hidden behind an animation — the resting state is the visible one.
More detail:Accessibility
Yes. Every page has an Arabic counterpart at the same address under /ar, including the privacy notice, the website terms, the cookie notice and the acceptable use policy.
The Arabic legal text has not yet been reviewed by UAE-qualified counsel or a certified legal translator, and which language version prevails on a conflict has not been decided. Both facts are stated on the documents themselves.
Ask it directly. You get a reply from a person, not an automated acknowledgement.