Your data stays yours.
By construction.
Operational data does not leave client-controlled infrastructure without explicit instruction. Models are trained per tenant in isolation. There is no cross-customer training corpus, no benchmarking pool and no secondary use of operational records.
- 01
Tenant isolation
Data, models and compute are isolated per tenant. Cross-tenant access is structurally impossible — not a permission setting.
- 02
No cross-customer training
Models are trained on your data only. We do not maintain a benchmarking corpus, and your records are not used to improve another tenant’s system.
- 03
Explainable decisions
Every automated decision can be reproduced from the recorded inputs, the active model version and the constraint set. Reproducible, explainable, contestable.
- 04
One counterparty
The contract is directly between the client and Three [Online] Services FZE. No introducers, no subcontracted execution, no white-label resellers in the chain.
The platform reads from the client’s systems of record and writes back into them. Where the client requires it, the data plane is deployed inside the client’s cloud account, with credentials and keys held by the client.
Egress is closed by default. Outbound calls are restricted to a documented allow-list. Every read, every write and every model inference is logged in an append-only ledger that mirrors the client’s retention policy.
- data residency
- client-controlled
- egress
- none, by default
- isolation
- per-tenant · per-cluster
- audit retention
- matches client policy
- 01
Inputs
Every signal that informed a decision — roster state, demand sample, constraint snapshot — is captured with the timestamp at which it was read.
- 02
Model version
Each decision records the exact model and policy version that produced it. Rolling back a decision rolls back the artifact, not a guess.
- 03
Override trail
Operator overrides are written to the same ledger as automated decisions, with the operator identity, the reason code and the prior recommendation.
- 04
Contestability
Any decision can be replayed from the ledger and contested under the written escalation path defined in the master service agreement.
Reading time is the cheapest part of the engagement. The conversation starts in writing.
Open contact dossier