Trust centre
Sub-processors
- GitHub, Inc. — United StatesOutside KSA
- Google LLC — United StatesOutside KSA
- Zenlayer (center3 and IMMIX data centres, Riyadh) — Riyadh, SAIn-Kingdom
- notify-hub (Bin Askar) — Frankfurt, GermanyOutside KSA
- payments-hub (Bin Askar) with DineroPay — Frankfurt, Germany (payments-hub); DineroPay per its own termsOutside KSA
Shared responsibility
| Data centres and physical security | CST-registered cloud provider |
| Network and DDoS protection | Platform |
| Kubernetes and OS patching | Platform |
| Tenant isolation (network, quotas, sandbox) | Platform |
| TLS certificates | Platform |
| Encryption of secrets and backups | Platform |
| Daily database backups | Platform |
| Testing restores | Customer (with platform tooling) |
| Application code and dependencies | Customer |
| Content of secrets and variables | Customer |
| Team access and two-factor | Shared |
| Data classification | Customer |
| Breach notice to SDAIA (72 hours) | Customer as controller; platform notifies the customer without delay |
| Audit trail (append-only) | Platform |
Data processing agreement
DRAFT — pending legal review- Parties and roles: The customer is the controller; the platform is a processor acting only on documented instructions, under the PDPL and its Implementing Regulations.
- Data location: Customer data is stored and processed only in Saudi Arabia; the region lock prevents placing any resource outside it. The signed residency report lists every item and where it lives.
- Sub-processors: Listed below. Customers get 30 days' notice before a new one is added, and may object.
- Security: Encryption in transit and at rest, tenant isolation, two-factor authentication, append-only audit trail, penetration test every 6 months.
- Incidents: The platform notifies the customer without undue delay and within 24 hours, so the customer can notify SDAIA within 72 hours.
- Data subject rights: The platform assists the customer in answering access, correction and deletion requests.
- End of service: The customer can export its data; it is then irreversibly deleted, with a deletion certificate.
- Audit: The customer and its regulators (including SAMA for entities it supervises) have review and audit rights.
Certifications
Infrastructure: inherited from the cloud providers (CST Class C, Tier III, ISO 27001). Platform: external penetration test, then ISO 27001, 27017, 27018, SOC 2 and an ECC-2 / CCC-2 control mapping attested by a KSA audit firm — per the roadmap.