Arabic data and AI agents, protected on your servers.

Where DLP stops, Protecto starts: masking PII, PHI, PCI and custom entities in Arabic and English, including agent-to-agent calls, on your servers.

Agent-to-agent callIllustrative

Claims agent sends

اشتكى العميل أحمد الخطيب، رقم 9871023456، من تأخر التحويل.

Protectodetect · tokenize · check policy

Summary agent receives

اشتكى العميل [PERSON_9e2]، رقم [ID_5b2]، من تأخر التحويل.

Inside your network · on your servers

Trusted by regulated enterprises & agentic platforms

Case study result

Bank Muscat, Arabic and English data

Read the case study →

99%

Recall

96%

Precision

4 weeks

To a working proof

The problem

Your DLP was not built for Arabic, or for AI agents.

A bank’s service team connects an AI agent to the CRM. The agent pulls a complaint written in Arabic and hands it to a second agent over an API. Nobody sent an email or uploaded a file, so the DLP never looked.

The need

Your team wants AI

Claims, complaints, and call notes are where AI saves the most time. They are full of names, national IDs, and account numbers in Arabic and English, and agents pass them from tool to tool.

The challenge

The data stays on your servers

Security and compliance want customer data inside your network, and Jordan’s law bars sending it to a recipient abroad whose protection is weaker (Art. 15). Cloud DLP and outside AI services are off the table.

The gap

DLP masking fails in Arabic

DLP rules were written around English patterns. Arabic names, mixed Arabic and English text, and IDs typed in Arabic digits can slip through. What DLP does catch gets blanked out, so the model loses who is who.

The risk

DLP cannot see agent-to-agent calls

Agents pass customer data to each other through API and MCP calls. There is no email or file for DLP to inspect, so it cannot detect the data, monitor who passed what, or block the call.

How it works

Every agent-to-agent call passes one checkpoint.

A claims agent hands a complaint to a summary agent. Protecto sits between them, inside your network, and decides what each call can carry.

Real timeProtects live agent-to-agent API calls, MCP tool calls, RAG, logs, and ETL, not just batch jobs.

Claims agent sends

اشتكى العميل أحمد الخطيب، رقم 9871023456، من تأخر التحويل إلى JO94CBJO0010000000000131000302.

Real values in the call

Protecto checkpointInside your network

DetectArabic, English, and mixed text
TokenizeFormat-preserving tokens
Check policyPass, mask, or block
LogEvery call, on your servers

Summary agent receives

اشتكى العميل [PERSON_9e2]، رقم [ID_5b2]، من تأخر التحويل إلى [IBAN_4c7].

Tokens only

Three outcomes for every call

Pass

A clean call goes straight through

summarize_ticket(id=4821)

No sensitive data in the call, so nothing changes and nothing slows down.

Mask

A sensitive call is tokenized

PERSON, ID, IBAN → tokens

Real values become format-preserving tokens, and the call continues.

Block

A call that breaks policy stops

send_email(to=external) + IBAN

The call is stopped before the data moves, and the decision is logged.

Each decision is written to an audit log on your servers, so you can show which agent passed what, and what happened to it.

OptionalOutside your network

An external model hosted by its provider, only if your reviewers approve it. It receives tokens only. Tokens are still personal data, so Article 15 applies to this path. Not used in an air-gapped setup.

OpenAI

Anthropic

Google

xAIand more

Choose your isolation

On-premises

Runs on your servers, in your data center.

Private cloud

Runs in your cloud account, in the region you choose.

Air-gapped

No outside link. The model runs inside the same boundary.

Connect it to your agents

API or proxy

Call Protecto before the model, or route agent traffic through it.

MCP and tool calls

Protecto sits in the path of tool calls, so agents keep their workflows.

Start with one flow

One agent flow, one Arabic data sample. Add flows as reviewers sign off.

Control inside your network

Same record, different viewers. Each sees only what policy allows.

Many people and tools touch AI data, even in a closed network. Protecto keeps real values out of the model, the vector store, and the logs, and releases them only to the people your policy names. That supports the duty to protect data and to stop identifying people once the purpose is met (Arts. 7 and 8). Controllers that handle financial or sensitive data must also appoint a Data Protection Officer (Art. 11), and the audit log gives that role its evidence.

protecto-vault · inside your networkIllustrative

$ agent: summarize complaint #4821

mcp tool call · crm.lookup(customer)

detect PERSON أحمد الخطيب → [PERSON_9e2]

detect ID 9871023456 → [ID_5b2]

detect PHONE +962 79 123 4567 → [PHONE_8d1]

model ← "Customer [PERSON_9e2], ID [ID_5b2] …"

model → "[PERSON_9e2] reported a failed transfer."

unmask case_handler → أحمد الخطيب

unmask analyst → tokens only

audit every decision logged

Real values stay on your servers

AI model

Always works on tokens

Name [PERSON_9e2]
ID number [ID_5b2]
Phone [PHONE_8d1]

Analyst

Trends and summaries, no identities

Name [PERSON_9e2]
ID number [ID_5b2]
Phone [PHONE_8d1]

Case handler

Needs the name to act on the case

Name أحمد الخطيب
ID number [ID_5b2]
Phone [PHONE_8d1]

Compliance officer

Full view for reviews and requests

Name أحمد الخطيب
ID number 9871023456
Phone +962 79 123 4567

Every unmask is a logged decision, so your team can show who saw which values, and when.

For your reviewers

Six rules that decide where AI can run, and what Protecto does about each.

Fines run JOD 1,000 to 10,000 per violation, doubled for repeats (Art. 22). The Council can also add up to JOD 500 a day, capped at 3% of annual revenue, and suspend or revoke licenses (Art. 21). References are to Personal Data Protection Law No. (24) of 2023.

Rule	Requirement	Protecto solution
Transfers outside the KingdomLaw 24/2023 Arts. 15, 17	Data may not go to a person outside the Kingdom if their protection is weaker than the law's, except in listed cases such as consent after the person is told protection is insufficient. The controller must check the recipient's protection level first. The Council licenses transfers and publishes a list of countries it recognizes as adequate.	Protecto runs inside your network, with token mappings and keys in your own data center. When the model runs there too, nothing is sent outside the Kingdom for those flows. If you choose an external model, it receives tokens only, and Art. 15 applies to that path.
Sharing with recipients, and recordsLaw 24/2023 Art. 14	Sharing data needs consent and a legitimate interest, and the controller keeps records of what was shared and why. Controller, processor, and recipient must have measures to detect and track any breach.	Agent-to-agent calls are detected, monitored, and logged where the data moves. The audit log stays on your servers.
Security measuresLaw 24/2023 Arts. 7(G), 8(B), 13	Technical and organizational measures against unauthorized disclosure, alteration, and processing. Data under processing is confidential.	Runtime masking and policy enforcement across agents, MCP calls, APIs, RAG, agent context, logs and more.
Keeping people unidentifiedLaw 24/2023 Arts. 6(B), 7(E)	Data is not kept once its purpose is met, and processing must not identify the person after the purpose is fulfilled.	Models, vector stores, and agent memory hold tokens, not real identities. Real values return only under policy, to the people you name.
Processors and vendorsLaw 24/2023 Arts. 12, 13	Processors stay within the purpose and duration, erase or return data afterward, and must not enable access to the data or the results of processing except where the law allows.	Detection, token mappings, and audit logs live on your servers. A model or vendor never holds the real values.
Breach noticeLaw 24/2023 Art. 20	For a serious breach likely to cause significant harm, notify affected people within 24 hours and the Unit within 72 hours of discovery.	Real values stay out of models, vector stores, and logs, so there is less to expose. The audit log shows who saw what, which speeds the notice.

Banks and other entities supervised by the Central Bank of Jordan: Art. 6(A)(6) lets them process data without consent where needed for the functions the Central Bank sets, including moving data within and outside the Kingdom. It does not lift the security duties in Art. 8, and Central Bank rules apply on top.

The whitepaper maps every article and every data path, with what may leave the Kingdom and on what footing.

Case study

How Bank Muscat got to a working proof in four weeks.

Financial services

Data residency rules blocked cloud AI. A mix of Arabic and English data made it harder.

Bank Muscat wanted to adopt AI but could not send customer data to top cloud models, and its Arabic, English, and mixed-language text made sensitive data hard to find. With Protecto, sensitive data is masked by default and unmasked only under policy. The team had a working proof of concept in four weeks.

99%

Recall on sensitive data, including Arabic edge cases

96%

Precision, so useful text is not blanked out

4 weeks

From start to a working proof of concept

Bring one use case and one Arabic data sample. We will show it protected, inside your network.

Resources

Go deeper.

Whitepaper

Jordan PDPL for Enterprise AI and Agents

Protect personal data while enabling useful AI workflows under Jordanian requirements. A path-by-path map of what may leave the Kingdom, and on what footing.

Blog

What Is a Data Privacy Vault?

How vault-based tokenization keeps sensitive data out of AI workflows.

Read the post

Guide

How to Ensure Data Privacy with AI

A step-by-step guide to protecting personal data in AI projects.

Read the guide

Industry

Sovereign AI for banks

How banks use leading LLMs while keeping sensitive data inside their boundary.

See the solution

FAQ

Questions security and compliance teams ask first.

Does Jordanian law say personal data must stay in Jordan?

Not as a blanket rule in the text of the law. Article 15 bars sending data to a person outside the Kingdom whose protection is weaker than the law’s, with listed exceptions, such as consent after the person is told protection is insufficient. The controller must check the recipient’s protection level first. The Council issues licenses and permits for transfers and a list of recognized countries (Art. 17). Your sector regulator and your customer contracts may be stricter. Confirm your position with counsel and your regulator.

Why can't our existing DLP do this?

DLP tools were built to watch email, files, endpoints, and web uploads. Agent-to-agent calls are API and MCP payloads moving between software, with no user action to inspect, so many DLP tools never see them. Many also rely on patterns and dictionaries tuned for English, so Arabic names and mixed-language text slip through, and what they do catch gets blanked out. Protecto sits in the data path of those calls, finds the sensitive values, swaps them for tokens that keep their format, logs the decision, and can block a call that breaks policy. Test your current DLP against a sample of your own Arabic records to see the gap.

Can Protecto run with no internet connection?

Yes. Air-gapped is one of the ways to deploy Protecto, alongside on-premises and private cloud. In an air-gapped setup the AI model has to run inside the same boundary, so you host it yourself, for example with Ollama. Nothing in the flow needs an outside connection.

How hard is it to add Protecto to our existing apps?

Protecto is an API product. Your team calls the API before the model, or routes model traffic through Protecto as a proxy, and your existing app logic stays as it is. There is no new interface to roll out. Start with one AI flow and one data sample, then add more flows as reviewers sign off.

If everything stays in our network, why mask the data at all?

Because data spreads inside a network too. A model, a vector store, an agent’s memory, and the logs can each end up holding real names and ID numbers, and many teams and tools can read them. Protecto swaps sensitive values for tokens at the start, so each person and tool sees only what your policy allows. That supports the duties to protect data and to avoid identifying people once the purpose is met (Arts. 7 and 8).

Does Protecto work on Arabic text and Jordanian identifiers?

Protecto detects 50+ entity types out of the box and supports custom entities, so you can add identifiers specific to your business.

What types of sensitive data does Protecto detect?

Protecto detects 50+ entity types out of the box, covering personal data (PII), health data (PHI), and payment card data (PCI). If your data includes identifiers that are not covered by default, you can add custom entities. Detection works in Arabic, English, French, German, Spanish, Dutch, and Japanese, with more languages on request.

Will masking make the AI's answers worse?

Basic redaction can, because a blank placeholder tells the model nothing. Protecto uses consistent, format-preserving tokens, so the same person maps to the same token and the model can still tell who is who. Test it on your own data before relying on any figure.

Is tokenized data still personal data?

Tokenization is pseudonymization, not anonymization. Whoever holds the token mapping can reverse a token, so treat tokenized data as personal data unless counsel advises otherwise. In a self-hosted setup, the token mappings, the keys, and the model all stay inside your own data center, so nothing leaves the Kingdom for those flows. If you choose the optional external model, the tokens it receives are still personal data, so that path stays under Article 15. Confirm your position with counsel.

Test it against your DLP, on your Arabic data.

Bring one agent flow and a sample of your Arabic records. We will run them through Protecto on your own servers and show what your DLP missed, what Protecto masks, and what it blocks.