Direct answers, because this is where most pages in this market go quiet.
Morocco is a party to Convention 108. It joined the Council of Europe's data protection convention and its Additional Protocol as the 55th state party, in force since 1 September 2019. That is a real, checkable legal footing.
It is not EU adequacy. Morocco does not have an adequacy decision, and anyone telling you a Moroccan team gives you European data residency is selling a sentence, not a safeguard. What actually holds up: host in an EU region, sign a DPA with standard contractual clauses, use model providers with zero retention, and keep every account in your name. Where the engineers sit and where the data sits are two separate questions, and only one of them is about us.
Moroccan clients still answer to the CNDP. Obligations under Law 09-08 do not lapse because a process became automated. We build so they stay answerable.
The EU AI Act reaches Morocco. It follows the output: if what your system produces is used in the EU, you are in scope, wherever your company is registered. The Article 50 transparency duties apply from 2 August 2026. The high-risk deadlines have moved since the Act was passed: the AI Omnibus, in force since 27 July 2026, pushed standalone high-risk systems under Annex III to 2 December 2027, and high-risk systems embedded in regulated products under Annex I to 2 August 2028. We tell you which of those your system falls under before we build it, and the controls that go with it are the security floor.
Our own privacy policy and terms are published in full, and the longer arguments behind how we build sit on the blog.