Home
Security and compliance

Where your customers' chats stay, and who can see them

We keep your data on our servers in data centres inside Saudi Arabia (Riyadh). Conversations are processed by a cloud AI provider, and we name it for you in the contract. If you need conversations to stay in-house, the Professional and Enterprise plans can run on your own server.

Servers in Saudi ArabiaOracle Cloud Infrastructure®, Riyadh
Database: PostgreSQL®Also in Saudi Arabia

Oracle is a registered trademark of Oracle and/or its affiliates. The names Postgres and PostgreSQL and the Slonik Logo are trademarks or registered trademarks of the PostgreSQL Community Association of Canada, and used with their permission.

Why this now matters

The Personal Data Protection Law is in force, and the grace period has ended

The Saudi Personal Data Protection Law has been in force since 14 September 2023, and the compliance grace period ended on 14 September 2024, and it restricts transferring residents' data outside the Kingdom. The committees of the Saudi Data and Artificial Intelligence Authority (SDAIA) issue fines and suspension orders.

With managed hosting, we process conversations at a cloud AI provider outside Saudi Arabia, so we name it for you in the contract before go-live. That way you know where your customers’ data is processed and can decide with full information.

The difference between the two options

Managed operation (all plans): We run the agent and keep your data on our servers in Saudi Arabia, and the conversation text is processed by a cloud AI provider we name for you in the contract.
On your server (Professional and Enterprise): The AI runs on your side, and text chats never leave your server. Reading documents and images needs a cloud provider you choose, or it can be turned off. The server needs a GPU, and its cost is on you.

Guarantees

What we commit to

Runs on your server

On Professional and Enterprise, the AI runs on your own server, so text conversations stay with you and we keep no copy of them. The one limit: reading documents and images currently needs a cloud provider of your choice, or it can be switched off.

It says it's an automated agent

It tells every customer it’s an automated agent in its first message, and answers truthfully whenever asked. In the same line, it offers to transfer the customer to a staff member. This is fixed in the system itself, so it doesn’t depend on the AI’s judgment. This follows SDAIA’s guidance on generative AI.

Protection against manipulation attempts

The system checks every message before replying, and blocks messages that ask the agent to ignore your instructions, claim to come from you, or try to find out its internal settings.

A text log of every chat

Every reply and every action the agent takes is logged with its time in plain text files you can open with any program, for your internal review or a regulator’s request. On your server, the log stays with you. With managed hosting, we hand over your complete files whenever you ask.

Decisions the system controls

Anything involving money or legal obligations is governed by fixed rules in the system. The AI only understands the request and writes the reply.

Who carries out each decision
Decision	Executed by	Why
Price calculation	System	A quote is a financial commitment, and the calculation needs a fixed rule.
Project type classification	The AI, checked by the system	The AI classifies, and the system rejects any classification that contradicts the conversation.
Customer name and number on the document	System	The name and number are written exactly as the customer typed them in the conversation.
Sending the contract	You	The contract is a legal commitment, so it only reaches the customer after you approve it on WhatsApp.
Disclosing that it is automated	System	A regulatory obligation, so it's fixed in the system.
Transfer to a staff member	System	The customer is handed to you when a request is outside the agent's permissions, a discount goes above the cap you set, there's a complaint, the customer asks to talk to a person, or a question has no answer in your knowledge.

Behind this table are protection rules fixed in the system, verified by automated checks.

Security questions

On our servers in Saudi Arabia, and we hand over your files in full whenever you ask. Replies are written by an AI provider we name for you in the contract. If you want conversations to stay entirely with you, we run the agent on your own server on Professional or Enterprise, and reading images and documents still goes through a cloud provider.

No. We do not use your conversations to train any model. We use the paid service of our AI provider, and its terms bar it from using conversations to improve its products.

The system checks every message before replying and refuses the known tricks: someone telling the agent to ignore your instructions, pretending to be you, or trying to find out its internal instructions.