Security, Privacy & Data Processing

Security

• Encryption in transit: all communication with the platform is over HTTPS/TLS.
• Encryption at rest: sensitive data (Iqama/ID numbers and documents) is encrypted with AES-256.
• Company data isolation: a multi-tenant architecture keeps each company's data separate — no user reaches another company's data.
• Role-based access: permissions are scoped by company and role, with administrative access restricted.
• Server-level security headers: HSTS, framing protection, and defenses against common injection attacks.

Privacy

We collect only the data needed to deliver the service: your company, employees, documents, and government-obligation deadlines.

• Your data is yours: we do not sell your data or share it with third parties for marketing.
• Deletion on request: you can request deletion of your company account and its data at any time.
• PDPL alignment: we follow the principles of the personal-data-protection laws in Saudi Arabia and the UAE.

Data processing

• No training on your data: customer data is not used to train public AI models. It is processed only to serve you.
• Document reading: when you use document reading, the image is processed only to extract data and for no other purpose.
• Monitoring, not filing: Dira monitors, alerts and prepares — it does not file government transactions on your behalf.