Deployment, data and supply chain, settled before the design.
This page sets out how national solutions are deployed, how data is governed, how operations run, how the supply chain is screened and where the use limits sit. During a project, every item is aligned against documents, one by one.
Deployment & data sovereignty
Where the system runs, who owns the data and who holds the keys are settled at design time.
Three deployment models
Cloud, customer premises or a dedicated isolated network, chosen per project. Residency follows the client jurisdiction; cross-region replication needs approval.
Customer-held keys
Keys can be held by the client or in a client-designated key service. Rotation and revocation are rehearsed before launch.
Export & exit
Data dictionaries, export formats and exit assistance go into the contract, so data and configuration leave with the client in full.
Least-privilege access
Production access is authorised by role and ticket. Temporary access expires automatically, and access logs are open to the client.
Security operations position
How monitoring, response and approval run, item by item.
AI execution, human approval
Daily monitoring and response are executed by AI agents. High-impact actions, policy changes and scope expansion keep human approval.
Audit-chain records
Tasks, responses and upgrades are recorded continuously. Clients can read them back on schedule, and re-verification results are issued separately.
Vulnerability & incident response
Discovery, grading, notification and repair times are agreed by grade in the contract. Only deliverable grades are signed.
Disciplined change
Versions, configuration and policy changes are recorded before execution, can roll back on failure and are re-verified against baseline afterwards.
Supply-chain screening
Equipment and components pass screening before they enter a design.
Section 889 line
Equipment and components from Huawei, ZTE, Hytera, Hikvision and Dahua stay out of our own estate, delivered designs and partner supply chains, including rebadged and internal-use items.
Component inventory
Sensitive projects receive a component and version list with traceable sources and maintenance status. Replacements are screened again.
Partner diligence
Primes and local partners undergo ownership and affiliate checks, with sensitive-component supply chains explained separately.
Use & export limits
These four items go into contract terms.
Public-source boundary
Intelligence products handle public-source, non-classified information only. The classified layer belongs to licensed partners.
Personal-surveillance exclusion
No facial-recognition templates are generated, and no mass personal-surveillance function is offered.
Export assessed per deal
Foreign-government work passes EAR, ITAR and destination-law review before solution discussions open.
Purpose-limited data
Client data is used for contract purposes only. It never enters KINGAI acquisition, advertising or model-training material.
- Use limits, data sovereignty and exit terms can be attached to the contract as written.
- Sensitive projects can start under confidentiality and assessment arrangements before data and architecture review.
- Compliance enquiries run through the project channel and are answered item by item against current documents.
Project review & documents
Due diligence should not have to wait: the documents a review asks for are kept ready as one set, delivered at engagement and aligned item by item.
Entity & channel documents
Current entity papers, registration material and contact details are provided for the procurement channel in use, in the version current at the time.
Architecture & data briefing
System architecture, data flows, deployment model and key arrangements are documented for the client security review.
Component & supply-chain inventory
Components, versions and sources are listed, with sensitive-component supply chains explained separately. Replacements are screened again.
Controls & operations records
Access control, change management, audit trails and operating re-verification are documented with sample records, and gaps are remediated with the client.
One complete review set
- Entity registration papers and procurement-channel documents
- System architecture and data-flow diagrams
- Deployment model and key-arrangement statement
- Component and version inventory, with sources and maintenance status
- Access-control and change-management policy documents
- Sample audit-trail and operations re-verification records
- Supply-chain screening statement, including the partner diligence method
Leaving with everything
- Full business-data export, with the data dictionary
- System configuration and policy export
- Architecture, operations and position documents handed over
- Keys transferred, or destruction confirmed
How a review runs
Confidentiality & scope
Confidentiality arrangements first; review scope and document versions confirmed.
Document pack
The current pack delivered in one pass; gaps declared, not hidden.
Questions & gaps
Item-by-item answers; gaps listed with owners and dates.
Remediation & re-check
Gaps closed and re-checked; conclusions filed.
Where to next
National solutions
Five use cases, three foundations and four delivery principles.
MIANGAI active defence
See the compliance position working inside a system, starting with the authority limits on the defence page.
Project enquiry
Send the review checklist directly and get item-by-item document replies.
Send the review checklist directly
Deployment, data, supply chain and use limits are answered item by item against current documents.
