UAE government entities classify information under the federal Information Assurance Regulation, Dubai entities under the Dubai Electronic Security Center's Information Security Regulation, and Abu Dhabi entities under their own standards. Feedback with contact details or complaint text must be classified and hosted accordingly.
Qmeter runs on a UAE-hosted instance or entirely inside the entity's network, matching the classification the entity has already made.
30 minutes with your IT, security and CX leads. We bring the architecture and requirements in writing; a named person replies within one business day.
Each entity holds its own classification documents; the public frameworks set the direction. In Abu Dhabi, for example, information marked Restricted is hosted on government infrastructure or on public cloud only with approval.
Issued by the Telecommunications and Digital Government Regulatory Authority, mandatory for UAE government entities and for entities designated critical under the national CIIP policy, and recommended for others. It requires an information classification scheme based on value, legal requirements and sensitivity, and controls that follow the classification.
Maintained by the Dubai Electronic Security Center for all Dubai Government entities, risk-based and technology-neutral. Guidance published by law firms notes that cloud providers may not store Dubai government data outside the UAE.
Abu Dhabi entities apply their own information security and data management standards. Published guidance describes information marked Restricted as hosted on Abu Dhabi government infrastructure, or on public cloud only with approval of the digital authority.
Most ratings are anonymous; the parts that are not decide the hosting. This section is written for the IT, information security and procurement teams who review a platform before the service excellence unit can use it.
A one-tap rating with a service and a time carries no personal data. A call-back request, a complaint with a name or an ID number, or a staff name in a case does. The entity's classification applies to the second group.
A UAE-hosted Qmeter instance keeps every record inside the country. On-premise deployment keeps it inside the entity's own network with no inbound vendor access unless granted.
Role-based access, PII masking with audited reveal, retention and deletion rules, audit logs and the integration points are documented for the security review before anything goes live.
Code-drawn diagrams; the detailed architecture is provided in writing on the technical call.
Application, database and survey channels run on infrastructure inside the UAE operated for the entity. Feedback, contact details and cases do not leave the country. Suitable where the classification allows hosting by a provider within the UAE.
The full platform is installed in the entity's data centre or private cloud, behind its firewall, under its security policy. Kiosks, QR surveys, SMS and web widgets reach it through the entity's own gateways. The vendor has no inbound access unless the entity grants it for a defined task.
These are the points we document on the technical call; nothing is claimed that the entity cannot verify.
Role-based access per centre and per role; single sign-on through the entity's directory where required; every reveal of masked personal data is logged. See security.
PII masking by default, audited reveal, retention periods and deletion workflows set by the entity. Anonymous ratings carry no personal data at all.
API and webhooks for the entity's portal, CRM, case system and SMS gateway, reachable without exposing anything to the internet. See integrations.
Sizing, backup, monitoring and the release process are agreed with the entity's IT operations team and delivered as documents. See isolated networks for the strictest case.
Short, factual answers. For your entity's case, book a technical call.
That depends on the entity's classification. Anonymous ratings carry no personal data. Call-back requests, complaints with names or ID numbers, and staff names in cases are personal or internal information and follow the entity's classification and hosting rules. Qmeter lets the entity host all of it inside the UAE or inside its own network.
Architecture, controls, integration and release process in detail.
→The platform on a network with no internet connection.
→What UAE service centres must collect continuously.
→PII masking, audit trails, retention and deletion workflows.
→Connecting feedback and cases to the entity's own systems.
→The full citizen feedback platform.
→A 30-minute technical call with your IT, security and CX leads. You receive the deployment architecture, controls and requirements in writing. A named person replies within one business day.