AI Security ·
AI security: the risks that arrive with Copilot and agents — and how to get ahead of them
Generative AI doesn’t create most security problems. It finds the ones you already have — fast, at scale, and in front of your users.
Insights
The FutureRoc blog.
Practical writing on AI security, Moroccan data compliance, and the Microsoft cloud — in plain language, for decision-makers.
Latest articles
Compliance · Morocco ·
Data compliance in Morocco: what Law 09-08, the CNDP, and the DGSSI actually require of your IT
Moroccan data compliance is not GDPR with a different logo. It has its own regulator, its own filings, and its own traps — especially around the cloud.
Cloud · Sovereignty ·
Microsoft, data sovereignty, and Morocco: what is actually on the table today
There is no Azure region on Moroccan soil — so what do “sovereignty” and “residency” really mean for a Moroccan organization on the Microsoft cloud?
Regulation · CNDP ·
The CNDP and Microsoft: how Morocco’s data regulator shapes your cloud — and what remains your job
Microsoft says it works closely with the CNDP. True — and still, the regulator’s file with your name on it is yours to complete. Here’s how the pieces fit.
Compliance · Law 09-08 ·
What does Morocco’s Law 09-08 actually require of your business?
The direct answer: if you process any personal data in Morocco — customers, employees, prospects — you must file with the CNDP before you start, have a lawful basis, secure the data, and treat any foreign hosting as a regulated transfer.
Cloud · Sovereignty ·
Does Microsoft store data in Morocco? What “data residency” really means for Moroccan companies
The direct answer: no — Microsoft operates no Azure region on Moroccan soil, so Moroccan customers are served from regional datacenters abroad. That makes every Microsoft cloud project a Law 09-08 transfer question — with real options.
Regulation · CNDP ·
How do you file a CNDP declaration? Forms, timelines, and the trap most companies miss
The direct answer: download the current form from cndp.ma (F211 normal, F214 simplified), attach proof of the signatory’s authority, and file — the receipt arrives within 24 hours. Sensitive data needs prior authorization instead, and foreign hosting needs its own separate transfer request.
Working with us ·
What we need from every customer: the checklist that makes your engagement fast
The speed of a data, AI, or security engagement is set in week one — by how quickly these ten things land on the table. Here they are, in advance.
Want these problems handled, not just explained?
Book a discovery call and we’ll turn any of these topics into a plan for your organization.