Short answer
Eshal offers KSA data residency for regulated Saudi deployments, and can also run on-premise or air-gapped inside your own environment. It answers and completes customer requests in Gulf Arabic on WhatsApp, web chat and email, holds ISO/IEC 27001:2022 certification and a SOC 2 Type II report, and stops regulated actions for your team's approval.
Where the data lives
There are three ways to deploy Eshal for a Saudi organisation:
- KSA data residency: available for regulated Saudi deployments, so customer data stays in the Kingdom.
- On-premise or air-gapped: the full platform runs inside your own environment, with self-hosted models supported. Many Saudi government deployments require this.
- Eshal Cloud: the managed service, with customer data stored and backed up in Microsoft Azure UAE North. Suitable when Saudi residency is not required.
Infrastructure residency certificates are provided for government and regulated procurement.
Saudi PDPL and SAMA
Saudi PDPL: data processing terms covering Saudi data subjects are available and reviewed with your compliance team before go-live.
SAMA: Eshal is working towards SAMA alignment. Today it provides human approval gates on regulated financial actions and a full audit trail of every action.
We state SAMA status plainly because a bank's risk team needs the current position, not a promise.
Control over regulated actions
- Approval gates: irreversible or regulated actions stop and wait for a person on your team.
- Your rules: you define exactly what the AI may and may not do, and anything outside those rules is handed to a person with the full history.
- Audit trail: every interaction and action is logged with who, what and why, ready for a regulator or internal auditor.
- Training: customer data is never used to train AI models.
Gulf Arabic, as Saudi customers write it
Saudi customers write in Gulf Arabic, not textbook Arabic, and often mix in English. Eshal works in Gulf Arabic first, with Egyptian Arabic and English for expatriate customers, and detects the language from how the customer writes. Sector terms such as Iqama and Absher are set in your instructions and knowledge base.
Questions for any vendor
- Can customer data stay inside the Kingdom, and in which deployment?
- Can the platform run on-premise or air-gapped if required?
- Are Saudi PDPL processing terms available?
- What is the current SAMA position, stated plainly?
- Which actions can be held for human approval, and who sets them?
- Is every action logged, and can we export the log?
- Does it understand Gulf Arabic mixed with English, in a live test with your own examples?