Security & Compliance

1. Where your data actually is

Elbi is not a wrapper around someone else's API. The language model, speech-to-text, text-to-speech and document OCR are all self-hosted on hardware we control inside the Kingdom. A customer message is answered without any part of it leaving that environment.

This is the difference that matters in a PDPL review: there is no OpenAI, Anthropic, Google or Azure key in the system, so there is no cross-border AI processing to justify, and no vendor whose retention policy overrides ours.

2. Encryption

Only encrypted artefacts ever leave the host. The backup routine exits before replication if encryption fails, so plaintext cannot be shipped by accident.

3. Data lifecycle

Retention is a fixed number here, not a judgement call. See the Privacy Policy for the full table; the mechanism is:

• An hourly purge destroys the raw content of closed, analysed conversations.
• A backstop sweep in the same job destroys anything older than 24 hours whether or not the normal path ran. This is the control that matters: an earlier version of this system promised 24 hours and quietly kept messages for ten days when an analysis job failed silently. The backstop exists so a failure elsewhere cannot extend retention.
• A second hourly job does the same for live-agent conversations, which close on their own terms.
• Voice audio is never stored — the temporary file is deleted in a finally block, whether transcription succeeded or failed.
• Uploaded files are never written to disk — they are parsed in memory and discarded at the end of the request.
• Destroyed means overwritten in the database, not flagged hidden.

4. Access control

5. Application security

• Server-enforced consent gate. Chat, menu selections and file uploads are refused unless a consent record exists. The gate is in the API, not only in the browser.
• Identifier redaction runs before storage and before the model sees the text — card numbers, national IDs, emails and phone numbers are stripped at capture.
• Prompt-injection resistance is a deterministic output guard, not an instruction in the prompt. Text telling the assistant to ignore its rules is described, not obeyed, and the system prompt is not disclosed. We learned this the hard way: a politely-worded rule in the prompt loses to the rules already there.
• Fabricated-claim guard. A reply that asserts a commitment on Elbetron's behalf which is not in the approved knowledge base is blocked and logged, and the guard checks against the knowledge base only — an uploaded document cannot launder a false claim into an answer.
• Upload safety. Extension allowlist, size cap, path-traversal sanitisation, page limits on OCR, and malware scanning.
• Rate limiting and abuse blocking at the edge, with automatic banning of repeat offenders.
• Answers are grounded in content you approve, and a relevance check runs before generation so out-of-scope questions are declined rather than guessed at.

6. Infrastructure and network

7. Backup and recovery

Nightly: a database dump, a cache snapshot and the uploads directory, encrypted with a dedicated key, decrypted again and compared before the run is accepted — an unverifiable backup is treated as a failed one.

8. Governance and documentation

The paperwork a Saudi procurement or SDAIA review will ask for already exists and is maintained, not drafted on request:

• Records of Processing Activities (RoPA) — PDPL Article 31, seven processing activities documented with purpose, lawful basis, recipients, transfers, retention and security measures.
• Data Protection Impact Assessment (DPIA) — risks and mitigations, including residual ones we have not solved.
• Breach Notification Runbook — who does what, in what order, within what deadline.
• DPO Decision Memo — the Article 30 assessment and its conclusion, with reasoning.
• Backup / Restore / Key Runbook — including key custody.
• Processor agreements on file — the edge network and the transactional mail relay.

These are internal records. We share them under NDA during procurement.

9. Testing and assurance

Security and behaviour are tested against the running system, repeatably, not asserted:

• A 643-case behavioural catalogue covering prompt injection, prompt disclosure, consent bypass, role escalation, upload abuse and PDPL rights.
• A hallucination and grounding suite scored by an independent judging pass.
• An 828-case retrieval benchmark across real phrasings in both languages, plus a 10,000-case mis-typed-input run.
• Concurrency and capacity runs to establish where the system degrades and confirm it degrades cleanly.
• Automated monitoring including an end-to-end reachability probe every 15 minutes that checks a real visitor can actually get the assistant — not just that the server is up.

10. What we do not claim

Every vendor page lists what it has. This is the part that is usually missing, and it is the part a security reviewer should read first.

If any of the above changes, this page changes with it and the date at the top moves.

11. Reporting a vulnerability

If you believe you have found a security issue in Elbi, tell us before you tell anyone else and we will work with you.

We do not currently run a paid bug bounty. We will credit you if you would like to be credited.