Trust Center
Straight answers to every question a Saudi CHRO procurement committee will ask before signing: which AI model, where data is processed, how we uphold the Personal Data Protection Law, and our posture on the National Cybersecurity Authority's ECC-2 controls.
AI Transparency
Every narrative report Jadiroon publishes passes through human review before it reaches the end user. What follows details the model in use, where it runs, the review chain, and the process a data subject follows to understand how their content was produced.
Model in use
A leading large language model, consumed via API.
Where processing happens
All data and processing reside within the Kingdom of Saudi Arabia, on sovereign-cloud infrastructure with documented operational controls.
Transitional — sovereignty migration in flightLanguage-model inference is hosted in-Kingdom under NCA and PDPL controls.
On the roadmapHuman review
An internal content-review team operates under documented SLA controls. Every AI-generated output is reviewed against a documented quality plan before it reaches the end user. No model output is published unreviewed, and the review chain is not dependent on a single individual.
Your rights under PDPL Articles 4 and 21
- Access — On request, we return the data subject's raw responses, generated narratives, the model version used, and the review chain. Target response SLA: 10 working days.Draft · finalized pre-pilot
- Correction — Correcting assessment responses or account data triggers regeneration of the narrative, appended to the record with a version tag. SLA: 5 working days.Draft · finalized pre-pilot
- Deletion — Account deletion removes responses and bound narratives, preserving only a de-identified audit log for regulatory purposes. SLA: 7 working days.Draft · finalized pre-pilot
- Portability — Full export of account data (responses + narratives) in machine-readable JSON. SLA: 5 working days.Draft · finalized pre-pilot
— Reference: Saudi Personal Data Protection Law (Royal Decree M/19, 1443H)
Data retention policy
Assessment responses: retained for the duration of the engagement + 24 months (value revisable with the first enterprise DPO).
Draft · finalized pre-pilotAI-generated narratives: tied to the originating assessment row; deleted with it.
Draft · finalized pre-pilotGeneration audit log: retained 5 years for regulator traceability.
Draft · finalized pre-pilot
— All retention values above are drafts — finalized pre-pilot with the first enterprise DPO.
PDPL Compliance
Saudi Arabia's Personal Data Protection Law took full effect in September 2024. Below is Jadiroon's honest posture — including disclosed gaps.
Data Protection Officer
TBD — to be named before enterprise rollout.
TBD — before enterprise rolloutData-subject rights
Access
Draft · finalized pre-pilotOn request, we return the data subject's raw responses, generated narratives, the model version used, and the review chain. Target response SLA: 10 working days.
Correction
Draft · finalized pre-pilotCorrecting assessment responses or account data triggers regeneration of the narrative, appended to the record with a version tag. SLA: 5 working days.
Deletion
Draft · finalized pre-pilotAccount deletion removes responses and bound narratives, preserving only a de-identified audit log for regulatory purposes. SLA: 7 working days.
Portability
Draft · finalized pre-pilotFull export of account data (responses + narratives) in machine-readable JSON. SLA: 5 working days.
— Reference: Saudi Personal Data Protection Law (Royal Decree M/19, 1443H)
Data residency
All personal data is processed and stored within the Kingdom of Saudi Arabia; there is no cross-border transfer in the current release.
Transitional — sovereignty migration in flightIn-Kingdom data residency is a permanent posture, not a transitional phase.
On the roadmapNCA ECC-2 Posture
The matrix below presents our current posture against ECC-2 control domains. The assessment is honest — what is in place, what is on the roadmap, and what does not apply to our platform at this stage.
What Jadiroon aligns with today
In placeThe platform currently aligns with a core subset of the Essential Cybersecurity Controls: secure account management (authentication, access control, password rotation), encryption of data at rest and in transit (TLS between client and servers, provider-managed database encryption), and vulnerability management (managed dependencies, regular open-source library scanning). These are baseline defensive controls, not a complete ECC-2 envelope.
Two-factor sign-in available for every staff account, on by default and mandatory for administrators. The authenticator app is the only saved method, and administrators must set it up; an emailed code is a one-time fallback for a single sign-in.
Personal files (CVs, documents, certificates, offer letters) are stored privately and served only to authorized users. There are no public links.
What is on the roadmap
On the roadmapFormal governance, documented incident management, Jadiroon-owned business continuity, and Saudi-region hosting are tracked on the roadmap. An independent third-party ECC-2 audit is committed to at first enterprise customer signature — not earlier, because an audit without a real customer is theatre.
Cybersecurity Governance
On the roadmapAccess, retention, incident policies exist as drafts; formal roles + governance committee pre-pilot.
Cybersecurity Defense
On the roadmapRuns on managed cloud services with their own controls; IAM + asset/vuln management codified pre-pilot.
Cybersecurity Resilience
On the roadmapProvider-managed BC today; Jadiroon-owned DR runbook + tested RTO/RPO pre-pilot.
Third-Party & Cloud Cybersecurity
On the roadmapThe full stack is hosted within the Kingdom of Saudi Arabia on sovereign-cloud infrastructure; provider controls are documented in our third-party matrix.
Psychometric Technical Manual (draft)
A long-form section covering the validation plan, the current reliability proxy, a DIF-awareness statement, and the intended factor structure — with an explicit acknowledgement that the full field study is deferred until the first pilot.
Validation plan
Full validation (construct validity, predictive validity, test-retest reliability) requires a live Saudi field sample. Current plan: academic partnership with a shortlisted Saudi university plus three enterprise employers in the first pilot, targeting n ≥ 300.
Until this study completes, we issue no predictive-validity claims. Every report carries an explicit notice that scores represent a developmental path, not a conclusive hiring decision.
Current reliability proxy
Draft · finalized pre-pilotCronbach's alpha (α) computed against the v0.2 seed bank: 0.84. This is a draft number computed on engineered seed data designed to exercise the pipeline — not on field responses — so we label it a reliability proxy, pre-pilot.
— The seed bank and responses that produced this figure are documented in our internal v0.2 design record.
DIF-awareness statement
DIF (Differential Item Functioning) is the bias a given item can exhibit against a demographic group (gender, age, sector). It cannot be measured theoretically — it requires real field data.
Our commitment: after every pilot cohort, we screen for DIF across gender, age band, region, and sector. Any item showing significant DIF is reviewed or retired before the next production release.
Intended factor structure
The current bank assumes a six-factor structure matching the six HRSD core competencies. Each item is a priori loaded onto one factor (primary loading).
Confirmatory factor analysis (CFA) to verify this structure on a field sample is included in the validation plan above.