اشتكى العميل خالد الدوسري، رقم 1098765432، من تأخر المطالبة.
اشتكى العميل [PERSON_9e2]، رقم [ID_5b2]، من تأخر المطالبة.
OllamaRuns open models locally
DeepSeekOpen weights, self-hosted
Moonshot AIOpen weights, self-hosted
OpenAI
Anthropic
Google
xAIand more| Rule | Requirement | Protecto solution |
|---|---|---|
| Transfers outside the KingdomPDPL Art. 29 Transfer Regulation Arts. 2, 4, 7 | Transfers abroad need a permitted purpose, adequate protection, and only the minimum data. Exempted transfers need approved safeguards and a written risk assessment. | Protecto runs inside your network, with token mappings and keys in your own data center. When the model runs there too, nothing is transferred, so Art. 29 is never triggered for those flows. |
| Cloud hosting for financial institutionsSAMA Cyber Security Framework 3.4.3 | SAMA member organizations should, in principle, use only cloud services located in Saudi Arabia, and need explicit SAMA approval to host abroad. The cloud requirement does not apply to private cloud (internal cloud). | Protecto deploys in your private cloud or data center, or air-gapped, so the AI layer stays on infrastructure you control. SAMA cloud and outsourcing rules for AI |
| Records of processingPDPL Art. 31 Implementing Regulation Art. 33 | Written records kept for the processing period plus five years, including transfers outside the Kingdom, their legal basis, and the recipients. | An audit log of every decision gives your team the evidence behind each entry. The log stays on your servers. |
| Processors and vendorsPDPL Art. 8 Implementing Regulation Art. 17 | Processor contracts must state the purpose, data categories, breach notice, whether the processor is subject to foreign laws, and any subcontractors. | Detection, token mappings, and audit logs live on your servers. The model never holds the real values. |
| Security controlsPDPL Art. 19 Implementing Regulation Art. 23 | Technical and organizational measures, including during transfer. Adopt NCA controls, or recognized best practice if you are not bound by them. | Runtime masking and policy enforcement across prompts, MCP calls, APIs, RAG, agent context, logs and more. |
| Minimum dataPDPL Art. 11(3) Implementing Regulation Art. 19 | Process only the data you need for the purpose, and keep data maps of what you hold and where it goes. | Inside your network, vector stores, logs, and agent memory still touch the data. Protecto shows each person and tool only what policy allows. |
Yes. Air-gapped is one of the ways to deploy Protecto, alongside on-premises and private cloud. In an air-gapped setup the AI model has to run inside the same boundary, so you host it yourself, for example with Ollama. Nothing in the flow needs an outside connection.
Protecto is an API product. Your team calls the API before the model, or routes model traffic through Protecto as a proxy, and your existing app logic stays as it is. There is no new interface to roll out. Start with one AI flow and one data sample, then add more flows as reviewers sign off.
Because data spreads inside a network too. A model, a vector store, an agent memory, and the logs can each end up holding real names and ID numbers, and many teams and tools can read them. Protecto swaps sensitive values for tokens at the start, so each person and tool sees only what your policy allows. That also supports the minimum-data principle in the PDPL (Article 11 and Implementing Regulation Article 19).
Not as a blanket rule under the PDPL. Article 29 allows transfers abroad for set purposes, as long as the transfer does not harm national security or vital interests, protection abroad is adequate, and only the minimum data is sent. Exempted transfers also need approved safeguards and a written risk assessment under the Transfer Regulation. Sector rules can be stricter. The SAMA Cyber Security Framework says that, in principle, only cloud services located in Saudi Arabia should be used, and hosting abroad needs explicit SAMA approval. That cloud requirement does not apply to a private cloud (internal cloud). The Implementing Regulation (Article 23) also tells controllers to adopt NCA security controls. Confirm your position with counsel and your sector regulator. For banks and other SAMA-regulated firms, see PDPL and SAMA rules for AI vendors.
Protecto detects 50+ entity types out of the box and supports custom entities, so you can add identifiers specific to your business.
Protecto detects 50+ entity types out of the box, covering personal data (PII), health data (PHI), and payment card data (PCI). If your data includes identifiers that are not covered by default, you can add custom entities. Detection works in Arabic, English, French, German, Spanish, Dutch, and Japanese, with more languages on request.
Basic redaction can, because a blank placeholder tells the model nothing. Protecto uses consistent, format-preserving tokens, so the same person maps to the same token and the model can still tell who is who. Test it on your own data before relying on any figure.
Tokenization is pseudonymization. Under Article 9 of the Implementing Regulation, data stops being personal data only if re-identification is impossible, and whoever holds the token mapping can reverse a token. So tokenized data is still personal data. In a self-hosted setup, the token mappings, the keys, and the model all stay inside your own data center, so nothing is transferred outside the Kingdom and Article 29 is not triggered for those flows. If you choose the optional external model, the tokens it receives are still personal data, so that path stays under Article 29 and the Transfer Regulation. Confirm your position with counsel.
A path-by-path map of what may leave the Kingdom, and on what footing.
By submitting you agree to Protecto’s privacy policy.
