Data Processing Agreement — Summary
Last updated: 27 September 2026
This is a public summary of the Data Processing Agreement (DPA) subscribed businesses sign as part of contracting. The signed full version is the binding reference — request it at ai@sautnajdi.ai.
Roles
The subscribed business is the data controller (it determines the purposes of processing); Saut Najdi is a data processor acting on the business's documented instructions and the PDPL.
Processing commitments
• Processing strictly to operate the service, per the business's instructions.
• Permanent storage in the Gulf region (Doha), with full disclosure of sub-processors and their locations in a list provided on request and attached to this agreement, and notice before any change to them.
• Technical and organisational measures: tenant isolation enforced at the database level, roles and permissions, an append-only audit log, and short-lived signed access links.
• Recording retention follows the plan terms confirmed at activation: 90 days for Essential, 180 for Growth, 365 for Expansion, and by contract for Enterprise; automatic deletion at the end of the agreed period, and execution of the business's instructions for its data at termination.
• Notification of any personal-data incident within statutory timelines.
• Assistance with data-subject requests (access, correction, destruction).