Start from your situation
Each need has one service that owns it, so you never buy the same work twice.
We don't know which use cases are worth building, or what data and budget they need.
AI Strategy & Readiness AssessmentOur board asks which requirements apply to us, and where the evidence is.
AI Governance & Regulatory ReadinessStaff paste sensitive data into public AI tools.
Generative AI Data ProtectionOur data must not leave our control.
Private & Sovereign AI PlatformsOur applications call models with shared keys, and no policy, record or cost limit.
Secure AI Gateway & GuardrailsStaff can't find answers in our policies, contracts and procedures.
Enterprise Knowledge AI & Document IntelligenceWe want AI to take actions in our systems, under our control.
AI Agents & Workflow AutomationWe need evidence that the assistant or agent is safe before it goes live.
AI Security Assessment & Red TeamingThe pilot worked. Who runs the platform, watches it and keeps its cost in check?
Managed AI Platforms & LLMOps
Eight services, one journey
The services follow the same five journey stages we use for infrastructure and cybersecurity.
01 · Assess & Prioritise
- AI Strategy & Readiness Assessment
Find the AI use cases worth building: readiness and data assessment, prioritised use cases, a target architecture and a roadmap with budget considerations.
- AI Strategy & Readiness Assessment
02 · Govern & Plan
- AI Governance & Regulatory Readiness
AI policies, a system inventory, risk classification, human oversight and evidence mapped to the Saudi requirements that apply to you.
- AI Governance & Regulatory Readiness
03 · Build & Secure
- Private & Sovereign AI Platforms
AI platforms on infrastructure you control: locally deployed models, isolation and integration, with every external dependency documented.
- Secure AI Gateway & Guardrails
One governed path to approved models: identity-based access, prompt and output policies, sensitive-data redaction, audit logs, and usage and cost limits.
- Enterprise Knowledge AI & Document Intelligence
Arabic and English assistants that answer from your own documents with their sources and existing permissions, plus document extraction.
- AI Agents & Workflow Automation
Agents that act in your systems only within set limits: least-privilege access, human approval for sensitive actions and a full audit trail.
- Private & Sovereign AI Platforms
04 · Test & Validate
- AI Security Assessment & Red Teaming
Authorised testing of assistants, agents and AI applications for prompt injection, data exposure, cross-user access and tool misuse, with retesting.
- AI Security Assessment & Red Teaming
05 · Operate & Improve
- Managed AI Platforms & LLMOps
Running AI platforms after go-live: monitoring, evaluation on every change, controlled updates, backup and recovery, and capacity and cost reporting.
- Managed AI Platforms & LLMOps
Where the AI runs
Private, resident, sovereign and air-gapped are not interchangeable. These are our definitions, and every design uses them.
- Private hosting
- What it meansA dedicated environment for your organisation alone, on your premises or with a hosting provider you choose. Private describes who uses it, not where it is.
- What can remain outsideWhatever the design still calls outside the environment, such as a model provider's API, licence checks, telemetry or updates. All of them are listed in the design.
- Saudi data residency
- What it meansData is stored and processed in data centres inside the Kingdom: documents, prompts, embeddings, logs and backups.
- What can remain outsideServices outside the Kingdom can remain, such as a model provider, remote support or telemetry. We name each one and the data it would receive.
- Sovereign
- What it meansResidency, with encryption keys, administration and change control held by your organisation or a party you approve inside the Kingdom.
- What can remain outsideOnly the dependencies you approve in writing. Anything that could move data or control outside is removed or documented as an accepted exception.
- Air-gapped
- What it meansNo network path to the internet or to outside services. Models run locally, and updates arrive on controlled media after they are checked.
- What can remain outsideNone at run time. The trade-offs are slower updates, a choice limited to models you can run locally, and more operational effort.
We state which option a design meets and list what remains outside it. Whether a design satisfies a particular regulation is a conclusion your organisation and its regulator reach; we provide the evidence.
What we write down about your data before anything is built
Each kind of data gets a record of where it lives and who can read it, so you know where your prompts and documents go before go-live, not after.
- Prompts and answers
- Where they are processed, whether they are stored and for how long, and whether any provider may use them for training under the terms and settings in force.
- Documents
- The systems they come from, any copies made of them, and who can retrieve them through the assistant.
- Embeddings and indexes
- Where the vector index sits and how it is protected. It is derived from your documents and is handled at their classification.
- Logs and audit records
- What is logged, how long it is kept, who can read it, and whether it is sent to your SIEM.
- Backups
- Where they are kept, how they are encrypted, who holds the keys, and the result of the last restore test.
- Telemetry and support access
- What leaves the environment for monitoring or vendor support; anything not needed is switched off.
How an engagement grows
Any step can be the last. We move to the next one only after the current step has been measured against criteria agreed with you.
01
Discovery
A readiness and data assessment, use cases ranked by value, effort and risk, a target architecture, and acceptance criteria for a proof of concept.
02
Proof of concept
A limited scope on your data, measured against acceptance criteria agreed in advance: answer quality and grounding, access isolation, unsafe-action prevention, performance and cost.
03
Production
A build on the chosen deployment option, security testing before go-live, and handover with runbooks and documentation.
04
Managed operation
If you need it: monitoring, evaluation, controlled updates, backup and recovery, with scope, responsibilities and support hours set in the contract.
Why DataSec for AI
Built on infrastructure we already deliver
We design and run data centres, servers and networks for our clients, so the platform we propose sits on what we know how to operate.
Security from the first design
The team that assesses, tests and monitors cybersecurity takes part in every design, and each system is tested before it goes live.
Arabic and English, with Saudi requirements in view
We measure answer quality in Arabic and English on your own tasks, and map each design to the requirements that apply to your organisation, and only those.
Frequently asked questions
Where should we start if we are not sure about the use case?
Start with a readiness assessment. We rank use cases by value, effort, risk and data readiness, and set for each one the deployment option it needs and the acceptance criteria for a proof of concept. If the use case is already clear and the data is ready, you can go straight to a limited proof of concept.
Where do our prompts, documents and embeddings go, and does anyone train on them?
That depends on the deployment option you choose, and we write it down before anything is built. On a private or sovereign platform, prompts, documents, embeddings, logs and backups stay on systems you control and nothing is sent to a model provider. With a commercial model behind the gateway, prompts and answers pass to that provider under its enterprise terms; we switch on the settings that stop training on your data where the provider offers them, log every call and redact what must not leave. We do not use client data to train any model, and we show you the configuration rather than ask you to trust a statement.
Can you promise the assistant will never be wrong or leak data?
No, and you should not trust anyone who does. What we do: ground answers in retrieved sources and show them, measure the grounded-answer rate on an evaluation set agreed with you, test the system for prompt injection, data exposure and cross-user access before go-live and after major changes, and keep human review for high-impact uses. The proof-of-concept acceptance criteria state the measured thresholds, so good enough is a number you agreed, not an adjective.
What does a proof of concept prove, and what does it not?
It proves that one defined use case works on your data against criteria agreed in advance: answer quality and grounding, access isolation, unsafe-action prevention, performance and cost. It does not prove behaviour at full user scale or across every data source, so the report states what is still needed before production.
Can you work with the AI tools and models we already use?
In most cases, yes. The governed gateway can sit in front of the model providers you use today, your existing systems can be tested within what their providers' terms allow, and the AI inventory in governance covers the AI features built into software you already use. If a provider's terms do not suit your data, we say so and propose an alternative.
Who owns the data, configurations and deliverables, and what happens if we change provider?
Your data is always yours. The configurations, documentation and deliverables we produce for you are handed over as set in the contract, and we design platforms in open formats where possible so models, indexes and configuration can move to another provider. The handover pack includes runbooks, the list of external dependencies and the exit steps.
Contact
Let's talk about what you need
We answer enquiries through the form, WhatsApp, a call or email.
Unified number
9200 33782For existing clients, general and service enquiries, and careers. Reachable from within Saudi Arabia.
Mobile (calls and WhatsApp)
+966 59 750 4669Direct line by call or WhatsApp for current and new clients: a quick quote, a question about our services, or anything that needs us right away.
Email
info@datasec.sa