Trust Center
Compliance status and framework mappings
Remote Pro Ai shows the real status of every certification it works toward: ISO/IEC 27001 in progress, SOC 2 Type II planned. Mappings are never shown as certificates.
In short
Remote Pro Ai publishes the exact compliance status of every certification it works toward and maps its controls to 6 regional frameworks. ISO/IEC 27001:2022 certification is in progress (target Q2 2027) and SOC 2 Type II is planned for 2027. Mappings cover NCA ECC-2:2024, SAMA CSF, Saudi PDPL, UAE PDPL, GDPR and NESA / UAE IA.
ISO/IEC 27001:2022
ISO/IEC 27001:2022
in progress (certification target Q2 2027)- Scope: the delivery platform (Client OS and Talent OS), client data handling and specialist onboarding.
- Validity: certification body, certificate number and dates appear here once issued, with a QR link to IAF CertSearch.
We never show a badge for a certificate we don't hold.
SOC 2 Type II
SOC 2 Type II
planned for 2027When the report is issued, this card shows the observation period, the auditing firm and the trust services criteria covered. The full report will then be shared under NDA.
We never show a badge for a certificate we don't hold.
NCA ECC-2:2024 alignment
For Saudi government and critical-infrastructure clients, we map our controls to the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC-2:2024) and the mapping document is in preparation; it is shared under NDA once issued. In-Kingdom delivery and on-site engineers are available today; in-Kingdom hosting in Riyadh is planned.
Data protection posture
- Saudi PDPL: processor obligations, in-Kingdom residency in your own environment or cloud region today (our Riyadh hosting is planned), data-subject requests acknowledged within 2 working days.
- UAE PDPL (Federal Decree-Law No. 45 of 2021): processing records, UAE residency on request, breach notification.
- GDPR / UK GDPR: DPA with EU standard contractual clauses and DPIA templates.
Financial-sector and UAE government mappings
Banks and fintechs regulated by SAMA receive a control mapping to the SAMA Cyber Security Framework. UAE government and critical-sector clients receive a mapping to NESA / UAE IA. Both mappings are in preparation and are shared under NDA once issued.
Compliance roadmap, with honest status
| Standard | Status | Target |
|---|---|---|
| ISO/IEC 27001:2022 | in progress (Q2 2027) | Q2 2027 |
| SOC 2 Type II | planned (2027) | 2027, after ISO/IEC 27001 |
Only programmes that are under way or scheduled are listed here. A certificate moves to Issued only when the certification body issues it.
Security status, stated as it stands
| Item | Status |
|---|---|
| ISO/IEC 27001:2022 | in progress (Q2 2027) |
| SOC 2 Type II | planned (2027) |
| NCA ECC-2:2024 · SAMA CSF | Control mapping in preparation |
| PDPL (Saudi Arabia) · UAE PDPL | Control mapping in preparation; DPA published |
| NESA / UAE IA | Control mapping in preparation |
| GDPR · NIS2 · DORA | Control mapping in preparation; DPA published |
| Professional indemnity and cyber insurance | Certificates on request under NDA |
Regulation, explained for outsourcing buyers
| Region | Regulation | Authority | Why it matters when you outsource |
|---|---|---|---|
| Saudi Arabia | PDPL | SDAIA | Processor contracts and transfers of personal data outside the Kingdom |
| Saudi Arabia | NCA ECC-2:2024 | National Cybersecurity Authority | Cybersecurity controls that extend to third parties |
| Saudi Arabia | ZATCA e-invoicing (Phase 2) | Zakat, Tax and Customs Authority | Integration requirements for invoicing systems you build and invoices you receive |
| Saudi Arabia | Saudization (Nitaqat) | Ministry of Human Resources and Social Development | Saudi workforce quotas for on-site roles and Build-Operate-Transfer centres |
| UAE | UAE PDPL | UAE Data Office | Processor duties and cross-border transfers |
| UAE | UAE e-invoicing | Ministry of Finance and Federal Tax Authority | Peppol-based e-invoicing for systems you build and invoices you receive |
| UAE | DIFC Data Protection Law | DIFC Commissioner of Data Protection | Processor contracts and transfers for firms in the DIFC |
| European Union | GDPR | National supervisory authorities | Processor terms, standard contractual clauses and transfer impact assessments |
| European Union | EU AI Act | European Commission and national authorities | Duties for providers and deployers of AI systems |
Frequently asked questions
The table on this page is the single source of truth. ISO/IEC 27001 certification is in progress (target Q2 2027) and SOC 2 Type II is planned for 2027. Anything in progress or planned is labelled that way. We never display a badge for a certificate we don't hold, and issued certificates link to IAF CertSearch for independent checking.
Yes. A control-by-control mapping to NCA ECC-2:2024 is in preparation and is shared under NDA once issued, so your security team can review it before any contract is signed. In-Kingdom delivery and on-site engineers are available today; in-Kingdom hosting in Riyadh is planned for the platform launch.
Our DPA sets out processor obligations, including EU standard contractual clauses where GDPR applies. You choose where data lives, and data-subject requests for export, correction or deletion are raised by email today, and in Client OS settings from the platform launch, with acknowledgement within 2 working days.
Yes, once it is issued: the SAMA CSF mapping is in preparation. Request it from the document register and we share it under NDA as soon as it is ready. Banks often pair it with our risk profile and the RFP agent, which drafts answers to their own questionnaire with cited sources.
We update this page and post the change on the Trust Center updates feed the same day. Subscribers get an email, and clients see the change in their Client OS procurement pack, where expiry and renewal alerts also run. Issued certificates always show their validity dates.