A customer-hosted agentic process platform
Rygor turns the undocumented work of regulated organisations into reviewed, executable processes, and runs them with people, rules and governed AI agents inside the customer's own boundary. Nothing phones home. Nobody outside decides.
01 Why we exist
Every bank, ministry and operator runs on processes that exist only in the heads of the people who perform them: who really approves a new supplier, what happens when an invoice does not match, how an access request is actually granted. Software vendors call this the long tail. We call it the business.
This is also the work that cannot leave the building. It carries customer records, personnel decisions and regulatory exposure. For a decade the industry's answer has been to send it to someone else's cloud, or to hire integrators to encode it in custom software that nobody can later change.
Rygor exists because we believe a third option is overdue: a platform the organisation's own people can use to describe, review and run that work, with AI that is capable enough to help and governed enough to be trusted, installed where the data already lives.
An AI may propose. It never decides.
02 The problems we solve
Each is familiar on its own. Together they mean the organisations with the most to gain from automation are the least able to adopt it.
Operating knowledge sits with a handful of people. When they are away, work stalls; when they leave, it is lost. Documentation projects produce documents, not processes that run.
Consequence: continuity depends on individuals, and every improvement starts from zero.
Authority is implicit, inconsistent and invisible to audit. Approvals are slow where they should be fast and fast where they should be careful, and the record of who decided rarely survives the next reorganisation.
Consequence: risk is carried by people who cannot see it, and auditors reconstruct decisions after the fact.
Every adjustment to a process becomes a project: scoping, custom code, testing and a wait. The business adapts to the software rather than the other way round, and the people who understand the work are not the people who can change it.
Consequence: processes freeze at the moment they were first automated.
Hosted AI assistants are useful and unusable in the same breath: they cannot be shown the data that matters, and when they act, nobody can demonstrate to a regulator on whose authority.
Consequence: the organisations under the strictest obligations are shut out of the largest productivity shift in a generation.
03 Our value proposition
Rygor is designed to let an operations owner turn how their team actually works into a reviewed, executable process, and run it to an evidenced outcome, without a byte of data or a single model call leaving the customer's boundary.
Guided discovery in Arabic or English captures how work really happens, keeps disagreement visible instead of averaging it away, and produces a process the team can read, question and rehearse before anything goes live.
Each case advances step by step. Every approval is a recorded decision by a named person. Every uncertain external effect is held and reconciled, never blindly retried. Agents begin supervised and earn autonomy only by explicit grant.
A signed evidence pack records who decided, on what basis and under which version of the process. It is designed to be verified offline, years later, without access to the platform.
We write "designed to" deliberately. Rygor is an early engineering build. What runs today, and what is not yet verified, is set out plainly under Where we stand.
04 How it works
Each step is framed first as what the business sees, then as what the platform is designed to guarantee.
Questions in Arabic or English about the work as it is done, not as the manual says. "I don't know" is an acceptable answer. Where two people disagree, both accounts are kept.
Every statement is attributed: a person's account, a written rule or an AI proposal. Readiness is described in named states, never as a percentage.
Steps, who decides at each one, what evidence is required and what happens when something does not fit. Approvers see exactly what they are being asked to stand behind.
Nothing becomes executable until a named person approves it. The approved version is immutable; later changes create a new version rather than editing history.
The team walks real-looking cases through the process and corrects what the conversation got wrong, in the same workspace they will later use for live work.
Rehearsal never touches a connected system. Change-impact rehearsal shows what a revision would do to the cases already in flight before it is published.
A task inbox, case pages, evidence views and dashboards generated from the process itself. Participants see only the task in front of them, in their language.
Each case is pinned to the version it started on. Upgrades never silently alter work in progress, and every version stays replayable.
Rules decide the routine. Agents read documents, draft and propose. People approve what matters. Connected systems carry out admitted actions. Agents begin in draft or supervised mode.
Authority sits outside the model. A model output is a proposal or evidence, never an action. Automatic execution requires a separate, revocable grant and is suspended when corrections exceed a limit.
A case that cannot confirm an external effect is held and shown to the right operator, with what is known and what is not. Nothing is sent twice because a screen timed out.
A timeout is not proof that a write failed. Recorded, applied and verified are three different states, and an uncertain effect becomes an owned reconciliation, never a blind retry.
A signed evidence pack per case: who decided, on what basis, under which version, with which documents. Process intelligence across cases shows waiting, rework and where practice drifts from the process.
The pack is designed to be verified offline by an auditor who has no access to Rygor at all.
05 Why us
Our edge is not a feature. It is a set of positions on trade-offs that most of the category has made the other way.
Let the model call tools directly, then add guardrails and hope they hold.
A model's output is a proposal or evidence, never an action. Every consequential step passes through the same command boundary that people use, with the same permission check, whoever asked for it.
"On-premises" means the runtime is local while design, AI or updates quietly depend on a vendor's cloud.
Discovery, review, run, recovery and evidence are designed to work with no outbound connection, operated by the customer's own IT, with signed offline updates. Hosted models are an explicit customer choice, never a dependency.
Arabic is a translation layer added to an English product after the fact.
Modern Standard Arabic, English and mixed-language work, right-to-left layout and Hijri dates are part of the design from discovery to evidence. Quality is measured, not assumed; see our status.
A timeout is treated as a failure and the action is retried until something succeeds.
A timeout is not proof that a write failed. The case is held, the target system is reconciled, and recorded, applied and verified are kept as three distinct facts.
The audit trail lives inside the vendor's system and is readable only while you remain a customer.
Signed evidence packs are designed to be verified by anyone holding the verifier, offline, long after the case closed.
Positions we will not trade for growth.
06 Why now
The window belongs to whoever makes governed, on-premises process AI usable by the business itself, not only by engineers.
Across the Gulf and Egypt, personal-data regimes have moved from statute to enforcement. Saudi Arabia's law has been fully enforceable since September 2024; Egypt issued its executive regulations in late 2025 with a compliance deadline in autumn 2026. Residency and sovereign control are now board questions, not IT preferences.1 2
The European Union's AI Act brings obligations for high-risk uses, with the agreed timeline for stand-alone systems now reported at December 2027, and supervisors in our region are watching closely. Whoever deploys agents in regulated work will be asked to show how authority was exercised.3
Open-weight language models that run on a single server have reached a level where guided discovery, document reading and process insight no longer require a hosted service. The economics of keeping AI on premises have changed.4
07 Who we serve
Public-sector bodies, banks and telecom operators in the United Arab Emirates, Saudi Arabia and Egypt, and the growing organisations around them. Our entry point is one operational team: a process owner, available IT and a reason to move.
Knows how the work is really done and is tired of explaining it to projects.
Their moment: publishing a process their own team described, without a line of code.
Signs their name to decisions and wants to see exactly what they are standing behind.
Their moment: a focused inbox where each approval shows the evidence and the rule that brought it there.
Installs, connects identity, approves connections, backs up and restores. Owns the machine.
Their moment: a compact installation they can operate alone, with signed updates and a restore they have rehearsed.
Has to say yes or no to AI touching regulated work.
Their moment: seeing that authority is enforced outside the model, at every read, search, export and action.
08 Our standards
A platform that asks regulated organisations to trust it with their most sensitive work must be built with the same discipline it promises them.
Plans, built behaviour and measured results are kept distinct.Nothing is described as working because a document says so. This website follows the same rule.
A failed check stays recorded as failed.We do not weaken a test to pass it, hide a failure or add a retry that makes a problem disappear from view.
Every change is traced to a requirement and reviewed twice.Impact on data, permissions, cases in flight, recovery and AI behaviour is inspected before code is merged.
Upgrades are proven against live work before they are admitted.Open cases are replayed under the new code, and a single failure stops the upgrade.
We say what we have not done.Status, limits and open questions are published, below and in the investor brief.
All figures are from the development profile on synthetic data. None is an acceptance, certification or performance result.
09 Where we stand
Rygor is an early engineering build with a complete product design. It has no customers yet and makes no claim of certification, compliance or measured performance.
Three conversations, in this order.
One operational team with one process, willing to shape the product in exchange for early access and influence. Not an implementation partner.
Inside a customer boundary, on the customer's hardware, with acceptance criteria agreed in advance. Our goal is early 2027; that is an aim, not a commitment.
With investors who understand regulated markets and are comfortable with evidence over narrative.
The governed, customer-hosted segment is under-served because it is hard, and hard is where durable positions are built.
A customer-hosted licence with maintained releases and offline updates. No usage metering, no data in our hands, no dependency on our uptime.
The Gulf and Egypt combine mandated data residency, Arabic-first work and large public and financial sectors with budgets for sovereign technology.
Evidence-first engineering, in which nothing is claimed that is not measured, is exactly what a regulated customer buys.
One design partner, one pilot inside a customer boundary, measured bilingual quality and independent acceptance of the requirements.
