We Carry Your PDPL Compliance. You Run Your Business.
The only system that finds your data, ties it back to the actual person it belongs to, and gives you a living record instead of a PDF. Built for Arabic, hosted on Saudi soil.
Runs fully on-premise · Your data never leaves the Kingdom · Every AI classification is reviewed by a human before it counts
The burden isn't PDPL. It's carrying it alone.
What the market actually says, and what changes when we carry it instead
Nobody's Job
“We know we need someone who understands this, but hiring a full-time privacy specialist takes months we don't have.”
Complete Visibility
Automatic discovery scans every database and file. Complete visibility in hours, not months.
No Certificate Exists
“There's no such thing as a PDPL certificate. What actually stops an auditor's question?”
Always Audit-Ready
Automated evidence library, always export-ready. The audit trail exists before the audit does, instead of being assembled under deadline pressure.
One Person, Excel
“Our DPO manages compliance in Excel. 200+ assets, 50 requests a quarter. One person can't track it all.”
DPO Command Center
DSR tracking, consent, incident response, risk registry. It multiplies your DPO instead of drowning them.
The AI Question Nobody Answers
“Our models aren't available inside the Kingdom. Can we process de-identified data abroad, and how do we document that?”
Full Data Topology
Cross-border transfer assessments, processor DPA tracking, and visual data flow topology.
Which door is yours? 10 seconds.
Do you know where your organization's personal data actually lives?
Is anyone accountable for PDPL compliance today?
Has a regulator or auditor asked you for records?
Five doors, one engine
Wherever you are in getting ready, there's a starting point that fits today, not a platform sale.
Learn
““What material do I even study for PDPL?””
Short, practical answers to the questions people actually ask in compliance groups, ordered the way an auditor asks rather than the way the law is written.
Free
Start readingTemplates
““Who even writes the PDPL policies, IT or the DPO?””
A guided wizard generates your privacy notice, classification policy, and retention policy in minutes, bilingual, built from your own org data.
Free with an account
Build your policiesProof
““There's no such thing as a PDPL certificate.””
A live scan of your real systems produces a signed readiness report: gaps ranked by severity, a 30/60/90-day plan, evidence an auditor can actually inspect.
Free scan, priced report
Run the free scanA Role, Not a Hire
““You're hiring a privacy specialist and waiting 3 months?””
A named expert, plus the platform running behind them: live records, managed requests, incident tracking, and someone who stands with you in front of a regulator. It also covers setting up your personal-data-protection and data-classification domains as your first data office, ready for NDI and NDMO alignment.
Annual retainer
Platform
““Does anyone have PDPL platforms, tools, or vendors?””
For teams who've already worked through the earlier steps and want the full engine: cloud or fully on-premise, including transfer-impact assessment for cross-border AI workloads.
License, from a scoped quote
Why not just buy a tool?
Because a tool assumes you already wrote the policy. We write it, then run it.
Policy, Then Execution
Most classification engines hand you a configuration screen and leave the policy work to you: who classifies what, when, and how to handle old data versus new. We write that policy with you first, then the platform runs it.
“Auto-classify on ingest for new data, a review prompt for anything ambiguous. Policy built together, not configured alone.”
Identity-Aware, Not Just Pattern-Matching
Most discovery tools stop at ‘this looks like a national ID.’ We're built to link a finding toward the identity it belongs to, not just flag the pattern. That's the step a real RoPA needs.
“Identity-aware by design, not a bolt-on regex list.”
Arabic-Native, Not Translated
Built to read Arabic script, Saudi ID and Iqama formats, and IBANs natively, not a global engine with a translation layer bolted on.
“Reads the documents your organization actually produces.”
Human-in-the-Loop by Design
An AI system with no human reviewer cost one company €825M in fines for automated decisions with no oversight. Every classification here is reviewable by an expert before it's final.
“Automation with a name attached to the sign-off.”
Deployed Where Your Data Must Stay
Full on-premise deployment, including air-gapped environments, for organizations where the data cannot leave the network, let alone the Kingdom.
“Ten-day delivery, documented procedure.”
A Living Report, Not a Consultant's PDF
Every readiness report is recalculated from a real scan of your systems, so it doesn't go stale the day the engagement ends the way a one-time consulting deliverable does.
“Re-run the scan any time and the report updates with it.”
What we are, and what we aren't
A documented readiness report, built from a real scan
Not an official SDAIA certificate. None exists yet
A national data catalog capability, in progress
Not available today. Planned, not live
A system that finds, classifies, and tracks your data
Not a substitute for a human decision on scoped remediation work
What Your Compliance Journey Looks Like
Week 1
- Platform connected
- First scan complete
- Shadow Data revealed
Week 4
- 80% of data assets classified
- RoPA & DSR workflows active
Week 12
- Registers, policies & evidence ready for review
- Audit-ready evidence library complete
Ready to see PD-FORT in action?
Start with the truth: a free scan of 100 files and 100 database tables shows your actual position. Once per organization, no strings.
Prefer email? mbeina@cyberx.sa