Cloud Softway and Lisan AI: Building a sovereign AI platform on AWS

In the past, Lisan AI operated its training, inference, and model-hosting workloads across multiple cloud providers, creating gaps in governance, security visibility, and operational control. The company processed highly sensitive business communications, meeting transcripts, and proprietary Arabic NLP model assets, but it lacked centralized security information and event management, intrusion detection, personally identifiable information discovery, and a consistent compliance posture.

Lisan AI needed to provide controlled regional data residency within the UAE, strong workload isolation for GPU-intensive training jobs, end-to-end encryption of proprietary model weights and customer data, forensic visibility into all access events, and durable recovery mechanisms for both customer data and proprietary AI intellectual property. These controls help Lisan AI demonstrate the sovereignty posture required to serve enterprise customers handling sensitive Arabic-language communications in regulated sectors across the Middle East.

Cloud Softway, an AWS Digital Sovereignty Competency Partner, built a sovereign-by-design architecture on AWS for enterprise-proven protection and reliability. The architecture enforces compliance through technical controls at every layer instead of simply relying on procedural measures. It features Amazon Elastic Kubernetes Service (Amazon EKS)—a service to build, run, and scale production-ready Kubernetes applications—with segmented node groups separating system, application, and GPU workloads. To achieve data sovereignty for all service-to-service communication, the AWS Partner implemented a zero trust service mesh using Linkerd with mutual TLS encryption—ensuring that data in transit between services is cryptographically protected and exchanged only between authenticated service identities. At the application edge, Cloud Softway deployed Amazon CloudFront to securely deliver content through controlled endpoints with enforced TLS and Application Load Balancer to load balance HTTPS traffic with advanced request routing. The Partner also used AWS WAF to protect web applications by preventing unauthorized actors from reaching application data through malicious requests. Meanwhile, Amazon Route 53 Resolver DNS Firewall blocks outbound DNS resolution to unauthorized external destinations.

Lisan AI stores model artifacts and datasets securely using Amazon Simple Storage Service (Amazon S3), an object storage service, with versioning and life cycle policies. The data layer includes a multi–Availability Zone deployment of Amazon Relational Database Service (Amazon RDS)—a simple-to-manage relational database service—Amazon ElastiCache for serverless, fully managed Redis caching, and Amazon OpenSearch Service, a near real-time retrieval engine for AI, search, and analytics. Lisan AI also uses AWS Key Management Service (AWS KMS), a service to create and control keys. All data at rest is encrypted using customer-managed AWS KMS keys under Lisan AI's sole administrative control.

Lisan AI’s defense-in-depth security stack combines AWS and open source tools to deliver continuous monitoring and automated threat response. Using Amazon Macie, Lisan AI can discover sensitive data using machine learning and pattern matching so that the company can identify and govern content. Using Wazuh, an open source security platform, provides centralized security information and event management capabilities with security analytics across all workloads, while Suricata performs deep packet inspection for network-based intrusion detection. At the Kubernetes layer, Lisan AI enforces data sovereignty boundaries through layered policy controls: Cilium network policies restrict data flows to authorized workloads only, preventing data from traversing paths outside the defined sovereignty perimeter; KubeArmor enforces runtime containment so that processes cannot access data outside their designated scope; and Kyverno admission policies reject any resource configuration that would violate sovereignty constraints. Infrastructure deployment follows a GitOps model using Argo CD, providing a tamper-evident audit trail of every change to the sovereign environment and ensuring that the running state cannot silently deviate from the approved, version-controlled baseline.

Now in production, the platform delivers improvements across performance, security, and governance. The zero trust architecture is implemented with mutual TLS across all service communication, and the comprehensive monitoring stack provides continuous threat detection and automated response. Inference latency dropped from 250 ms to under 50 ms—an 80 percent reduction—supporting near real-time Arabic NLP capabilities for over 250,000 active users. “We went from security blind spots across multiple clouds to sovereignty on AWS—with faster inference, zero trust across every workload, and an auditable foundation for our expansion across the region,” says Noor Alasadi, CEO at Lisan AI.

Critically, the platform achieves compliance visibility with real-time dashboards covering CIS Benchmarks, GDPR requirements, NIST controls, and the UAE Personal Data Protection Law. Achieving centralized governance across all workloads means that Lisan AI can demonstrate its sovereignty posture to enterprise customers with confidence. By consolidating from a multicloud environment into a single sovereign solution on AWS, Lisan AI reduced security risk through proactive detection and gained the operational control needed to protect its proprietary Arabic NLP models and sensitive customer data. Lisan AI is now poised to expand into regulated sectors across the Middle East with an auditable, sovereign foundation.

Cloud Softway is a UAE-based AWS Partner specializing in cloud migration, security, and digital sovereignty solutions.