Trust Center
Security architecture
Every specialist reaches your systems through identity, not network location: SSO with phishing-resistant MFA, managed devices with disk encryption and EDR, least-privilege roles reviewed every 90 days, and session logging you can export.
Zero-trust access to your work
- Identity: SSO and MFA on every account; no shared credentials
- Devices: managed laptops, encrypted disks, screen lock, remote wipe
- Access: least privilege, joiner-mover-leaver within 1 working day, quarterly access reviews
- Monitoring: hash-chained audit log of platform actions, exportable on request
Three environment patterns: A, B, C
| Pattern | Where the work happens | Who holds the data | Typical buyer |
|---|---|---|---|
| A · Your environment | Your tenant, your VDI or your repositories | You, entirely | Government, banks, critical infrastructure |
| B · Managed workspace | Remote Pro Ai managed devices and a client-dedicated workspace | Shared under the DPA; client data stays in the client-chosen region | Enterprises and scale-ups |
| C · Remote Pro Ai platform | Client OS and Talent OS for roster, timesheets and invoices only | Remote Pro Ai as processor; no production client data | Self-serve and reservation lanes |
Pattern A is the default for regulated Saudi work; patterns can be mixed per squad.
Data zones, designed for in-region hosting
- Zone 1 · Client production data: never leaves your environment under pattern A; under pattern B it stays in the region you choose
- Zone 2 · Delivery metadata (roster, timesheets, sprint summaries, invoices): UAE or EU region at your choice; designed for in-region hosting in Saudi Arabia through a Saudi cloud region on request
- Zone 3 · Specialist and candidate data: processed under the Talent Network Terms, with consent records
Regions are stated as designed for in-region hosting; a region moves to live only when a client contract names it.
Control map: NCA ECC-2:2024 · PDPL · GDPR
| Control area | NCA ECC-2:2024 | Saudi PDPL | GDPR | State |
|---|---|---|---|---|
| Identity and access | 2-2 | Art. 19 security | Art. 32 | in place |
| Device and endpoint protection | 2-3, 2-6 | Art. 19 security | Art. 32 | in place |
| Data localisation and transfer | 2-7, 4-2 | Art. 29 transfers | Ch. V | per pattern |
| Logging and monitoring | 2-12 | Art. 20 breach | Art. 33 | in place |
| Incident response and notification | 2-13 | Art. 20 (72 h to SDAIA) | Art. 33 (72 h) | in place |
| Third-party and cloud | 4-1, 4-2 | Art. 8 processors | Art. 28 | in place |
The full control-by-control mapping document is in preparation and shared under NDA once issued; the article references above are indicative, not legal advice.
Control map: SAMA Cyber Security Framework
| SAMA CSF domain | Related control areas | State |
|---|---|---|
| Cyber security leadership and governance | Governance Office (Cairo HQ) · security and conduct policy summaries (published) | Mapping in preparation |
| Cyber security risk management and compliance | ISO/IEC 27001:2022 programme (in progress) · vendor risk profile (published) | Mapping in preparation |
| Cyber security operations and technology | Identity and access · Device and endpoint protection · Logging and monitoring · Incident response and notification | Mapping in preparation |
| Third-party cyber security | Third-party and cloud · sub-processor list (published) | Mapping in preparation |
Banks and fintechs regulated by SAMA receive the domain-by-domain mapping under NDA once it is issued. Until then, this table shows which of our control areas each domain draws on; the state of each control area is in the control map above.
PDPL statement
| Obligation | Saudi PDPL | How we meet it | State |
|---|---|---|---|
| Processor obligations | Art. 8 processors | Our published DPA sets the processor duties and the sub-processor terms | DPA published |
| Security of processing | Art. 19 security | Identity and access · Device and endpoint protection (control map above) | in place |
| Breach notification | Art. 20 (72 h to SDAIA) | Incident response and notification (control map above) | in place |
| Cross-border transfer | Art. 29 transfers | Pattern A keeps client production data in your environment; in-Kingdom residency in your own environment or cloud region today | per pattern |
| Data-subject requests | Data-subject rights | Acknowledged within 2 working days | in place |
| Hosting in Riyadh by Remote Pro Ai | Data localisation | Designed for in-region hosting | planned |
This statement summarises our Saudi PDPL posture exactly as the Trust Center states it. The article references are indicative, not legal advice; our DPA is published in full in English and Arabic.
Frequently asked questions
Yes under pattern A, where all work happens in your environment. Delivery metadata in Client OS is designed for in-region hosting through a Saudi cloud region on request; the region is confirmed in your contract.
An external penetration test of the platform is planned before it reaches general availability. The summary will be available under NDA in the Questionnaires section; no report is shown as issued until it exists.