A short, plain-language summary of where your workspace's data lives, who can see it, and the legal posture around it. The full detail is on the /trust page; this is the abbreviated user-facing version.
What data the platform holds
For every workspace:
- People records — names, contact details, CV files (if uploaded), assessment history, growth plans.
- User records — login emails, hashed passwords, role, last sign-in.
- Workspace metadata — display name, slug, taxonomy selection, settings.
- AI-generated content — JD bodies, narratives, recommendation rankings.
- Audit logs — who did what, when.
Where it physically lives
In the current release, the production database is hosted within the Kingdom of Saudi Arabia on sovereign-cloud infrastructure. AI calls are processed by a language model hosted in-Kingdom, all under the controls of the National Cybersecurity Authority (NCA). Object storage for CV PDFs and avatar images uses in-Kingdom managed cloud storage.
The data residency posture is fully within the Kingdom of Saudi Arabia, aligned with the Personal Data Protection Law (PDPL) and the National Cybersecurity Authority (NCA) requirements. There is no cross-border transfer.
The full posture is on the /trust page. Workspaces with a strict data-residency requirement should read that page in full before contracting.
Who can see it inside Jadiroon
- Engineering and platform staff — limited operational access for incident response, with audit logging.
- Customer success — visibility into your workspace metadata (name, sector, account health) but not into individual records, growth plans, or assessment results.
- Sales and marketing — no access to workspace data.
- The LLM provider — sees only the prompts the platform sends it; does not retain content for training under our contractual zero-retention agreement.
Who can see it inside your workspace
The RBAC matrix defines this. The summary:
- Each staff member sees what their workspace role allows; Workspace Admins see everything.
- Roles scoped to My reporting line, such as Line Managers, see their team's people records and development plans.
- Candidate contact details are masked for roles that don't hold the permission to see them.
- Personal files — CVs, person documents, credential certificates, offer letters and assessment attachments — are stored privately. There is no public link: each file opens only for signed-in users of the same workspace whose role can see the page it belongs to, and for the candidate, employee or trainer it belongs to. Anyone else gets "not found".
- Employees see only their own records.
- Every change, sign-in and export is written to the workspace's Audit log.
No data is visible across workspaces. A person who has accounts in two Jadiroon workspaces has fully isolated data in each.
What we do not do
- We do not sell or rent your workspace's data. Not to anyone, not for any purpose.
- We do not use your workspace data to train models. AI calls are stateless; the model's training is independent of your usage.
- We do not enrich your data with third-party signals (no LinkedIn scraping, no cross-site tracking).
Legal basis
Jadiroon operates under PDPL (Personal Data Protection Law of the Kingdom of Saudi Arabia) and supports the data-subject rights it defines:
- Right to access your data.
- Right to correct your data.
- Right to delete your data.
- Right to data portability.
The mechanics of exercising these rights are on the next pages of this section.
NCA Essential Cybersecurity Controls (ECC-2)
The National Cybersecurity Authority's Essential Cybersecurity Controls (ECC-2) are the gate that government and semi-government procurement reviews after PDPL. The trust centre lays out explicitly what Jadiroon aligns with today — secure account management, encryption at rest and in transit, vulnerability management — and what is on the roadmap, with a third-party audit pledged at first enterprise customer.