Data residency
Your assessment data stays in Saudi Arabia
Residency is a design decision, not a deployment detail. BazGrid runs in the Kingdom and handles personal data in line with the Saudi Personal Data Protection Law (PDPL).
Readiness assessment — not regulatory certification
Hosted in Saudi Arabia
Your assessments, evidence, results and account data are stored and processed in the Kingdom on in-Kingdom cloud infrastructure. Backups stay in the Kingdom too.
In-Kingdom AI inference
AI assistance — evidence analysis, guidance and document drafting — runs on in-Kingdom infrastructure. Sensitive content is not sent to offshore model endpoints.
PDPL-aligned handling
We process personal data under the PDPL: lawful bases for processing, data-subject rights (access, correction, deletion, restriction, portability), consent for marketing, and documented retention.
Audit trails and tenant isolation
Tenant isolation is enforced by authorization policy, tenant-scoped data access and PostgreSQL row-level security. Every sensitive action is recorded in the same transaction as the change it describes, and audit rows never contain evidence content, prompts or secrets.
Retention you can defend
- Uploaded evidence is destroyed 30 days after expert validation, unless the law requires longer retention.
- AI help threads are retained for 90 days.
- Security and audit logs are retained for 12 months.
- Enquiries and leads are kept for 24 months, or until marketing consent is withdrawn.
- Backups rotate on a 35-day cycle.
Processors and transfers
Hosting, database, storage, email delivery and AI inference run on KSA-region cloud infrastructure. Identity providers process sign-in only when you choose federated sign-in. Assessment answers, evidence, reports, scoring, AI processing, application databases, logs, backups and caches remain in Saudi Arabia. For payments, TAP Financial JSC and its disclosed payment-processing partners may process minimum payment data outside the Kingdom under the applicable Saudi merchant agreement and privacy notice (https://www.tap.company/en-sa/privacy). BazGrid sends payer email, a fixed BazGrid name label, SAR amount, merchant identity, opaque order/idempotency references and return/webhook URLs. Card details are entered on TAP hosted checkout, which may also collect IP address and device information. Assessment content and tax/company documents are excluded from the charge payload.
Residency questions
Where exactly is my data stored?
In Saudi Arabia. Assessments, evidence, results, backups and application account records stay in the Kingdom, and AI inference runs in-Kingdom. Minimum payment data and hosted checkout processing are subject to the TAP exception described above.
Does BazGrid comply with PDPL?
BazGrid is designed around PDPL requirements: lawful processing, data-subject rights, retention limits and breach-aware operations. Compliance is a shared responsibility with your organisation, and we provide a data-processing addendum on request.
How is my evidence protected?
Evidence is uploaded to tenant-isolated storage, scanned for malware, encrypted in transit and at rest, and destroyed 30 days after expert validation unless the law requires longer retention.
Assess readiness without leaving the Kingdom
Start the free self-assessment, or talk to us about your residency and PDPL requirements.