SME digitisation
A single operating system for small and medium businesses: leads, clients, projects, finance and communication in one place.
Government & public sector · MSE-07
A platform built to be trusted by public institutions.
This brief explains what the ecosystem offers the public, how it is controlled, what it commits to, and how an institution can work with it. Nothing is live yet; the platform is specified and partly built as source.
Public value
Where the ecosystem contributes to public goals.
Technology exports and skilled employment
Engineering based in Pakistan, serving international markets and building skilled jobs.
Skills, education and entrepreneurship
Courses, cohorts and practical guidance for founders and professionals.
Trusted, responsible AI
AI is disclosed, works only within the user's permissions, needs human approval for high-risk actions and is audited. Customer data is not used to train third-party models without explicit agreement.
Inclusion and accessibility
English, Urdu (including Roman Urdu), Arabic and Portuguese, with right-to-left support, designed to WCAG 2.2 AA.
Secure communication for organisations
Business messaging with retention rules, legal hold and optional end-to-end encryption.
The request path
Every request passes through seven layers, top to bottom.
- 1. ActorsCitizens, customers, staff, partners and officials
- 2. ApplicationsWebsite, client portal, Momin OS, mobile
- 3. GatewayAuthentication, rate limits, request checks
- 4. FoundationIdentity, organisations, access, audit, events
- 5. Business services33 services, each owning its own data
- 6. Data and eventsIsolated per tenant, recorded as events
- 7. Licensed providersPayments, messaging, hosting — never unlicensed
Controls
| Control | What it means |
|---|---|
| Purpose and consent | Data is collected for a stated purpose; consent is recorded with its version. |
| Tenant isolation | Each organisation's data is kept apart from every other organisation's. |
| Deny-by-default authorisation | Nothing is permitted unless a role explicitly grants it. |
| AI boundary | Data is filtered by the user's permissions before any model sees it. |
| Human approval | High-risk and business actions need a person to confirm. |
| Audit | Significant actions are recorded and can be inspected. |
| Money safety | The platform never holds funds; payments run through licensed providers. |
RuleNo AI agent may approve a contract, make a payment or delete a customer. The platform makes no autonomous decisions on employment, credit or legal matters.
Your data, on request
How a data-subject request is handled.
- 1A citizen asks for their data, or for it to be erased
- 2The platform verifies their identity
- 3It finds every record linked to them
- 4Staff review any legal holds
- 5The data is exported or erased, and the action is recorded
- 6The citizen receives confirmation
- 7A regulator can inspect the audit record
This flow works in this demo: sign in and open the Privacy Centre in the client portal to download your data or ask for erasure. Demo data stays in your browser.
Compliance commitments
| Commitment | Detail | Document |
|---|---|---|
| Compliance with local law | Operate under the law of each market served. | MSE-42 |
| Data protection | Privacy by design, data-subject rights, breach handling. | MSE-18, MSE-45 |
| Data residency | Host data where the law or the customer requires. | — |
| Security | Security programme and controls. | MSE-12, MSE-117 |
| Lawful payments | Licensed payment providers only; no customer funds held. | — |
| Taxation | Register and account for taxes in each market. | — |
| Responsible AI | Disclosed, permission-bound, human-approved, audited. | MSE-41, MSE-136 |
| Lawful content | Content rules and takedown handling. | MSE-40 |
| Honest representation | Say what is specified, built and live — nothing more. | — |
This summary is not legal or tax advice.
Data sovereignty options
In-country hosting
Data held in the country where required.
Dedicated tenant
A separate environment for one institution.
Customer-controlled retention
The institution sets how long records are kept.
Restricted AI
AI features limited or switched off for sensitive data.
EU data is hosted in the EU. Transfers outside the EU rely on Standard Contractual Clauses with a transfer impact assessment.
Proposed collaboration
| Area | What it could involve |
|---|---|
| SME digitisation programmes | Giving small businesses one operating system and training. |
| Incubators and startup programmes | Tools and guidance for founders in cohorts. |
| Skills and education | Courses and cohorts on business, technology and AI. |
| Public-sector pilots | A measured pilot after staging certification. |
| Digital-economy and AI initiatives | Responsible AI practice aligned with national policy. |
| Export promotion | Supporting technology exports from the engineering base. |
| Research and data | Shared learning under agreed data safeguards. |
How we engage
- Step 1
Introduction
A first conversation about goals and fit.
- Step 2
Discovery meeting
Understand the programme, constraints and data involved.
- Step 3
Tailored proposal
Scoped to the institution (MSE-60).
- Step 4
MoU
Roles, responsibilities and safeguards agreed (MSE-61).
- Step 5
Measured pilot
Only after staging certification, with agreed measures.
- Step 6
Scale-up
Widened only on the evidence of the pilot.
Key pointPublic data will not be placed on a system that is not certified in staging.
Country briefs
Shareable with government and advisers.
Talk to us about a programme.
Request the Government & Public-Sector Brief or a country brief, or arrange an introduction.