Accredited certifications, and data that never leaves the Kingdom

Inside the Kingdom of Saudi Arabia, in the city of Dammam, on Google Cloud under a contract with CNTXT. Your data is subject to the Kingdom's sovereignty and laws.

Yes, at rest and in transit, using Google Cloud's built-in encryption capabilities and standard industry protocols, with Perfect Forward Secrecy applied to the communication channels.

No. Your data and documents are not used to train our models. Training is limited to questions from trial accounts, with any personal or sensitive data excluded, and any personal information in the data is removed automatically before any processing.

That depends on your organisation's settings. Your files are read and our local models draft the answer inside the Kingdom, and the original values stay in local storage. Two points cross the border: drafting the final answer through an international language model, and international file reading (Google's Gemini), which is on by default and can be turned off by your organisation in Settings. The legal guardian, which redacts your personal and confidential data before it crosses, is off by default and is enabled by your organisation in Settings. Any transfer is carried out under the regulation on transferring data outside the Kingdom, with a signed data processing agreement with each party.

A layer inside the Kingdom that redacts your personal and confidential data before it moves any further through processing. The original values stay in local storage inside the Kingdom, and anything downstream sees only a redacted copy. When the answer comes back, the system restores your confidential data into it from that local storage, so you read a complete answer without your data ever having left. Redaction is off by default; your organisation enables it in Settings and configures it to its own policy.

Yes, the platform holds the ISO/IEC 27001:2022 certification for information security management. It also complies with the relevant requirements of the National Cybersecurity Authority, the controls of the National Data Management Office, and the Personal Data Protection Law.

Yes. Processing is based on your explicit consent and on legitimate interests specified in the privacy policy, and the law guarantees you the right to be informed, to access, to correct, to destroy, to withdraw consent, to file a complaint and to claim compensation.

No. Each user sees only their own conversations and files. A private folder is visible only to its owner, and for a shared folder the owner controls who can access it.

Access to personal data is limited to the employees who need it to carry out their duties, and requires the approval of the authorised owner under an internally approved formal procedure, with the principle of least privilege applied and central management of privileged access.

Unless you request its deletion, your data is kept for the whole subscription period and five years after it, so you can reactivate your account if you renew. After that period it is destroyed in a secure manner that leaves it neither viewable nor recoverable.