Trust Center
Trust, security & compliance
How we protect your data and operate the platform inside Saudi Arabia — transparently, without overstatement.
Mahsumah Company is registered in the National Personal Data Protection Register and registered as a Technology Enterprise with the Communications, Space and Technology Commission (CST). Mahsumah Cloud is being developed as a Saudi Managed PaaS with a compliance roadmap toward CST Cloud Computing Registration and ISO/IEC 27001 readiness.
Verified registrations
Real, official registrations held by the company.
National Personal Data Protection Register
Registered controller in the Saudi National Personal Data Protection Register.
CST Technology Enterprise Registration
Registered Technology Enterprise with the Communications, Space and Technology Commission (CST).
What we cover
Security
Encryption on every domain, tenant isolation, RBAC, and audited staff access.
Learn more →Data residency
Customer data is hosted inside Saudi Arabia (Riyadh) and is not moved out of the region.
Backup & recovery
Daily automated backups of platform data with a defined retention window.
Learn more →Incident response
Availability is monitored continuously and the ops team is alerted when an issue is detected.
Learn more →Service levels (SLA)
Availability and support targets, stated as goals — not unproven guarantees.
Learn more →Subprocessors
The third-party vendors we use, what they process, and where.
Learn more →Responsible disclosure
How to report a security vulnerability to us safely.
Learn more →Compliance roadmap
Our registrations today and the certifications we are working toward.
Learn more →Compliance roadmap
DetailsLegal, privacy, SLA, and compliance materials on this site are operational drafts and should be reviewed by qualified Saudi legal counsel before being used as binding contractual terms.