Security status, stated as it stands
Remote Pro Ai protects client code and data with 5-gate vetted engineers, an NDA before any data moves and IP assignment on payment. Each status links to its evidence.
Remote Pro Ai protects client code and data with engineers who pass 5 vetting gates and background checks, a mutual NDA before any data is shared, IP assignment on payment and contractual residency, with client code and data kept in your own environment until our hosting regions (Riyadh, Frankfurt and Virginia, all planned) are contracted. Security evidence sits in the Trust Center behind a click-through NDA.
Certificates appear only when held, with issuer, scope and validity. Frameworks we map to are labelled as alignment, not certification.
| Item | Status |
|---|---|
| ISO/IEC 27001:2022 | in progress (Q2 2027) |
| SOC 2 Type II | planned (2027) |
| NCA ECC-2:2024 · SAMA CSF | Control mapping in preparation |
| PDPL (Saudi Arabia) · UAE PDPL | Control mapping in preparation; DPA published |
| NESA / UAE IA | Control mapping in preparation |
| GDPR · NIS2 · DORA | Control mapping in preparation; DPA published |
| Professional indemnity and cyber insurance | Certificates on request under NDA |
Issued certificates link to the certification body’s public register for independent checking.
People, access, contracts and response. The 4 areas your security team will ask about first.
Every specialist passes 5 gates before joining a client team, and every gate is validated by a person, not only by software.
at least 4 verified years, stack and domain match; model-ranked, recruiter-reviewed.
a live technical assessment with a senior engineer from the relevant practice.
a work sample in a realistic codebase, reviewed against the practice’s quality bar.
an interview in English, Arabic or both, testing clarity, documentation habits and time-zone overlap.
identity, employment history, education, references and lawful background checks.
Public funnel, per 100 applicants (2026 company profile): 31 pass the screen · 9 pass the technical and practical gates combined · 5 pass the communication interview · 3.4 clear background and reference checks. The funnel on the vetting process page reports gates 2 and 3 separately, as rolling 90-day pass rates.
Checks cover identity verification, employment and education history, professional references, sanctions screening and criminal-record checks where local law permits. Engineers consent before any check. Clients see a completion flag on the engineer’s verifiable credential; the details stay with the screening provider and our trust team.
A mutual NDA is accepted before any client data or engineer identity is shared. Every engineer signs confidentiality and IP-assignment terms with Remote Pro Ai, and all work product is assigned to the client on payment. Pre-existing tools we bring are licensed to you for use with the deliverables. Source-code escrow is available on managed delivery at our cost.
We notify affected clients within 24 hours of confirming a personal-data breach involving their data, with a named incident lead and a written follow-up. Platform status and incident history will be public on our status page from the platform launch.
The residency pattern and region are recorded in every statement of work. Engineers reach your systems; your data does not leave them.
| Pattern | Where your data lives | Typical use |
|---|---|---|
| A · Your environment | Your VDI or cloud tenancy; nothing on Remote Pro Ai systems | Banks, government, health |
| B · Your cloud region | Your KSA, UAE, EU, UK or US region; zero-trust access with full logging | Telecom, fintech, SaaS |
| C · Isolated enclave | A segregated Remote Pro Ai environment under documented controls | Teams without a suitable tenancy |
Saudi Arabia
Saudi standard contractual clauses and a transfer risk assessment under the PDPL. We make no adequacy claims.
UAE
UAE PDPL terms, with DIFC or ADGM annexes where those regimes apply.
EU
GDPR standard contractual clauses (Module 2) with a transfer impact assessment.
UK
the UK International Data Transfer Addendum.
Verify your work email, accept the NDA and read the documents in minutes, without waiting for a sales call.
Enter your name, company and work email in the Trust Center.
Confirm the one-time code sent to your work email.
Accept the click-through mutual NDA, or upload your own for review within 2 working days.
From the platform launch, verified business domains are approved instantly; free-mail addresses are reviewed manually.
From the platform launch, documents open in a watermarked viewer; download links expire after 7 days, and every access is logged.
Purpose, region and DPA status for each one, with 30 days’ notice before we add another.
A subprocessor is a third party that processes personal data on our behalf. We use them only for defined purposes: cloud hosting for Client OS, e-signature, payments, business verification, background screening, customer communications and, after opt-in, analytics. The full list sits in the Trust Center subprocessor register.
Update log pattern (Trust Center updates feed):
Upload a security questionnaire and receive draft answers with sources, reviewed by our security team within 24 hours once the live platform opens.
The RFP agent is an AI assistant that answers security and vendor-risk questionnaires using only documents in the Trust Center. Each answer cites its source and carries a confidence score. Our security team reviews every answer before export, and you receive the file in its original format with a signed attestation.
20 minutes with a solutions architect. No sales script.
Not yet. ISO/IEC 27001 certification is in progress, with a target of Q2 2027, and a SOC 2 Type II report is planned for 2027. We show a certificate only when it is held, with issuer, scope and validity, and link to the certification body’s register. Framework alignment such as NCA ECC-2:2024 or SAMA CSF is labelled as control mapping, not certification.
Wherever your statement of work says. Most clients choose Pattern A, where engineers work inside your own environment, or Pattern B, your cloud region in Saudi Arabia, the UAE, the EU, the UK or the US. Our own hosting regions for Client OS (Riyadh, Frankfurt and Virginia) are planned for the platform launch and not contracted yet.
You do. All work product is assigned to the client on payment of the relevant invoice, and every engineer has signed confidentiality and IP-assignment terms with Remote Pro Ai beforehand. Pre-existing tools we bring are licensed to you for use with the deliverables, and escrow is available on managed delivery.
Yes. Gate 5 of our vetting covers identity, employment and education history, references, sanctions screening and criminal-record checks where local law permits. Engineers consent first. You see a completion flag on their verifiable credential; the check details stay with the screening provider and our trust team.
Neither exists yet: the SOC 2 Type II report is planned for 2027 and an independent penetration test is planned before the platform launch. Both are listed in the Trust Center document register with their real status, where you can request them, and we share each one under NDA once it is issued. If your company requires its own NDA, our legal team reviews it within 2 working days.
Yes. Upload it to the RFP agent in the Trust Center. It drafts answers from our published documents with a source and confidence score for each, and, once the live platform opens, our security team reviews every answer within 24 hours. You receive the questionnaire back in its original format with a signed attestation.
Your team can be working within 4 working days of signature.
Build your squad online
No card needed · 72 h free hold
20 minutes with a solutions architect
No sales script.