They find names, IDs and account numbers in Arabic, English and mixed text, swap them for tokens inside the bank, and test recall on their own data before going live.
SOC 2 Type II · ISO 27001 · Runs in your bank’s cloud
One call note, checked
Banks protect Arabic customer data in AI the same way they protect English data: sensitive values are found and replaced before any prompt, file or document reaches a model. The difference is detection. Tools built for English miss much of what Arabic bank text contains.
Names in Arabic, in Latin letters and in Arabizi, national IDs, IBANs and phone numbers, including values written in Arabic digits or run into the next word, in Gulf dialect as well as Modern Standard Arabic.
The model gets consistent tokens, so it still knows which customer is which. Real values and the token map stay on the bank’s servers.
On-premises, in a private cloud in the country, or air-gapped with a model you host.
Ask any tool for recall and precision on a sample of your complaints, call notes and chat messages, not on a vendor’s test set.
Staff whose role allows it see real names in the answer; others see tokens. For employee chat, see how a bank lets employees use ChatGPT or Gemini safely.
Bank Muscat masked customer data in mixed Arabic and English text before it reached Gemini, with Protecto running in the bank’s own environment
Recall on sensitive data in mixed Arabic and English, including transliterated names (Bank Muscat)
Precision, so useful text is not masked by mistake (Bank Muscat)
RARI score after masking, our accuracy metric (Bank Muscat)
A bank’s complaints team wants an AI model to summarize call-center notes and draft replies. Agents type the notes fast, in Arabic and English.
Here is one note, written after a call about a late fee. Before it goes to the model, the bank’s DLP rules and an English-first PII detector each check it. Switch the views to see what each one leaves readable, and what the model receives with Protecto in the path.
What stays readable with Protecto: the late fee, the salary date and the request to move the installment. The model needs those to write a useful reply.
What the agent typed (fictional)
العميل سالم الحارثي اتصل يشتكي من رسوم تأخير على حسابه SA44 2000 0001 2345 6789 1234
رقم الهوية١٠٨٧٦٥٤٣٢١، جواله 0552147790
Salem says his salary comes on the 25th and he wants to move the installment.
In English: Customer Salem Al Harthy called to complain about a late fee on his account. ID number in Arabic digits, run into the label. Mobile number. Then one line in English.
After pattern rules (DLP, regex). Wavy line: still readable to the model
العميل سالم الحارثي اتصل يشتكي من رسوم تأخير على حسابه [REDACTED]
رقم الهوية١٠٨٧٦٥٤٣٢١، جواله [REDACTED]
Salem says his salary comes on the 25th and he wants to move the installment.
After an English-first PII detector. Wavy line: still readable to the model
العميل سالم الحارثي اتصل يشتكي من رسوم تأخير على حسابه SA44 2000 0001 2345 6789 1234
رقم الهوية١٠٨٧٦٥٤٣٢١، جواله [PHONE]
[PERSON] says his salary comes on the 25th and he wants to move the installment.
What the model receives with Protecto in the path
العميل <PERSON>Rq4Ty8 Nm2</PERSON> اتصل يشتكي من رسوم تأخير على حسابه <IBAN>SA81 7730 4418 2096 5512 0473</IBAN>
رقم الهوية <NATIONAL_ID>k2P8mQ1x0Z</NATIONAL_ID>، جواله <PHONE>0558830164</PHONE>
<PERSON>Rq4Ty8 Nm2</PERSON> says his salary comes on the 25th and he wants to move the installment.
The same customer on WhatsApp, in Arabizi
salam, ana Salem al7arthi, el 7esab ely 3ndkom 7atto 3alay rasoom ta2kheer, raqm el hawiya 1087654321
What the model receives
salam, ana <PERSON>Rq4Ty8 Nm2</PERSON>, el 7esab ely 3ndkom 7atto 3alay rasoom ta2kheer, raqm el hawiya <NATIONAL_ID>k2P8mQ1x0Z</NATIONAL_ID>
In English: Hello, I'm Salem Al Harthy, the account you hold put late fees on me, ID number 1087654321. Arabizi writes Arabic in Latin letters, with digits for sounds English lacks: 7 stands for ح and 3 for ع.
Marked values identify the customer. The fee, the salary date and the request do not.
Pattern rules match fixed formats in Western digits. Names and Arabic digits pass straight through.
The tool reads the English line well and the Arabic lines poorly.
The IBAN is a custom entity the bank added. When the reply comes back, the complaints agent sees the real name. Example tokens are illustrative.
Example tokens are illustrative.
Five values in the note identify the customer. Pattern rules and English-first tools each catch two.
| In the note | What it is | DLP and regex rules | English-first PII detector | Protecto |
|---|---|---|---|---|
| سالم الحارثيArabic script | Customer name | No | Basic | Yes (PERSON) |
| SalemLatin letters | Same customer name | No | Yes | Yes, same token as the Arabic name |
| SA44 2000 0001 2345 6789 1234IBAN | Account | Yes, if a Saudi IBAN rule exists | Basic | Yes (IBAN, a custom entity) |
| رقم الهوية١٠٨٧٦٥٤٣٢١Arabic digits, no space | National ID | No | No | Yes (NATIONAL_ID) |
| 0552147790Mobile | Phone number | Yes | Yes | Yes (PHONE) |
Most DLP rules and PII models were built on English text. Arabic bank data fails them in four ordinary ways.
One customer, two scripts. A note says سالم الحارثي in one line and “Salem” in the next, and the Latin spelling varies: Al Harthy, Alharthi, Al-Harthi. A tool that misses one form leaves the customer named. A tool that tokenizes them differently tells the model they are two people.
Two sets of digits. Gulf staff and customers write numbers as 1087654321 or ١٠٨٧٦٥٤٣٢١. Pattern rules written for Western digits do not match the second form.
No spaces where a rule expects them. Fast typing runs a label into a number, as in “رقم الهوية١٠٨٧٦٥٤٣٢١”. Rules that look for a number on its own miss it.
Dialect, code-switching and Arabizi. Call notes and chat messages mix Gulf dialect, Modern Standard Arabic and English in one sentence. Many customers write Arabic in Latin letters with digits for letters, so الحارثي becomes “al7arthi”. A tool trained on English sees noise, and a tool trained on formal Arabic sees nothing it knows.
A miss puts a customer’s name or ID in a model provider’s logs. Blanket redaction gives the agent a reply it cannot use. That is why banks measure both recall and precision.
The rules differ by country, but each one asks where the data goes and who can read it.
Saudi Arabia. The SAMA Cyber Security Framework says member organizations should, in principle, use cloud services located in the Kingdom. The PDPL allows transfers abroad only on set conditions and with the minimum data. See Saudi PDPL and AI and PDPL and SAMA rules for AI vendors.
Oman. The PDPL requires consent for cross-border transfers unless the data is anonymized, and an assessment the regulator can ask to see. See Oman PDPL and AI.
UAE. The Central Bank’s February 2026 guidance note on AI covers data privacy, security and third-party AI providers for licensed financial institutions.
Tokens help with all three, but tokenized data is still personal data, because the bank can reverse it. Keeping Protecto, the token map and the keys inside the bank is what keeps the real values in-country.
Not legal advice. Summaries as of November 2026. Confirm your position with counsel and your regulator.
Five common approaches, scored on Arabic bank text.
| Approach | Arabic-script names | Same name in Latin letters | Arabizi and Gulf dialect | Arabic digits and fused values | Model still gets useful text | Runs inside the bank | Measured on bank data |
|---|---|---|---|---|---|---|---|
| DLP and regex rules | No | No | No | Basic | No. Matches are stopped or blanked | Yes | No |
| English-first PII detectors | Basic | Yes | No | Basic | Basic. Generic placeholders such as [PERSON] | Yes, if self-hosted | No |
| Open-source Arabic PII packs | Basic. Name detection is optional or new | Basic | Basic | Yes, for the ID formats they ship | Yes, with tokenization you build and run | Yes | No. Synthetic or self-reported tests |
| Host the model in the bank, no masking | Not available | Not available | Not available | Not available | Yes | Yes | Not available |
| Protecto | Yes | Yes, one token per customer | Yes | Yes | Yes. Consistent tokens; 85% RARI score at Bank Muscat | Yes. On-premises, private cloud or air-gapped | Yes. 99% recall, 96% precision at Bank Muscat |
Hosting the model inside the bank decides where data goes, not who can read it. Real names still land in prompts, logs and vector stores that many teams can open.
Protecto sits between your bank’s apps and the model. It finds customer values in any script, swaps them for tokens, and logs every decision.
Protecto’s agentic detection and classification engine labels names, national IDs, account numbers, cards and phone numbers across 50+ entity types, in Arabic or Western digits, in Gulf dialect or Modern Standard Arabic, in prompts, uploads, call notes and documents.
IBANs, Iqama numbers, internal customer IDs and branch codes become custom entities, added in days.
The same value gets the same token every time, in Arabic, Latin letters or Arabizi, so the model can follow one customer through a conversation.
Deploy on-premises, in your private cloud, or air-gapped. Token mappings, keys and logs stay on your servers.
People your policy allows see real values in the answer; everyone else sees tokens. Every reveal is logged, and Protecto reports how each policy was enforced.
Test it before you sign: bring 200 to 500 real notes and chat messages, with names in both scripts, some Arabizi, and IDs in both digit forms. Ask every vendor for recall and precision on that set.
They can spot some of it, but asking the model to find PII means the model has already received it. Banks detect and mask before the prompt leaves their environment, so the provider never holds the real values.
The method is the same. Detection is harder, because Arabic bank text mixes two scripts, two sets of digits, dialect and English in one note. Test detection on your own Arabic data, not a vendor’s sample.
National IDs and bank account numbers are built-in entity types, in Arabic or Western digits. IBANs, Iqama numbers and internal customer IDs are added as custom entities, in days.
Yes. Protecto detects names and identifiers in Arabizi (Arabic written in Latin letters and digits), in Gulf dialect and in Modern Standard Arabic, including messages that switch to English mid-sentence.
Yes. Tokenization is pseudonymization: the bank can reverse it with the token map. That is why the map and keys should stay inside the bank, and why sending tokens abroad still follows your country’s transfer rules.
Blank redaction can make them worse, because the model loses who is who. Protecto uses consistent tokens, and Bank Muscat scored 85% on RARI, our accuracy metric, after masking. Measure it on your own prompts.
Yes. Protecto supports all types of banks, including retail, corporate, Islamic and state-owned banks. The approach is the same: detect customer values in Arabic and English, tokenize them inside the bank, and reveal real values only by policy.
English, Arabic, French, German, Spanish, Dutch and Japanese. Other languages are tested on request, on the customer’s own data.
Bring a sample of call notes or complaints. We will show what Protecto finds in both scripts, what the model receives, and what stays in your bank.
