SAMA & Security
SAMA & NCA Alignment
How Sarj is deployed to meet the expectations of Saudi regulators, and what your compliance team can expect from the process.
Banks, insurers, healthcare providers and government entities in the Kingdom answer to regulators who expect every customer interaction to be secure, recorded and explainable. Sarj is deployed to meet SAMA and NCA requirements from day one, so you can go live without building a separate compliance layer around the agent.
The frameworks
SAMA
The Saudi Central Bank's requirements for banks, finance companies and insurers, including expectations on customer protection, outsourcing and cyber security.
NCA
The National Cybersecurity Authority's controls, including the Essential Cybersecurity Controls (ECC) and Cloud Cybersecurity Controls (CCC).
SDAIA
The Saudi Data & AI Authority's frameworks for personal data protection and the responsible use of AI.
What this means in practice
Data stays in the Kingdom
Processing and storage run in-region. See Data Residency & Hosting.
Every interaction is on record
Transcripts and actions are logged so your team can show what was said and done, by whom, and when. See Call Transcripts & Logs.
Collections done respectfully
For debt collection, Sarj is built for SAMA's guidelines on how and when customers may be contacted, and logs every promise to pay.
Working with your compliance team
Your Sarj deployment team works with your compliance and security teams through review and approval. ECC and CCC audit material is available on request.