ISO 27001
Information security controls aligned to the international standard for information security management.
SECURITYHeld in confidence
Your institution’s data remains under its own control.
Lameh keeps confidential financial work private, access-controlled, and traceable, in line with the Kingdom’s Personal Data Protection Law (PDPL) and the requirements of the Saudi Data & AI Authority (SDAIA).
Talk to our team
Lameh operates within the Kingdom’s data regulations and recognized international security standards.
SOC 2 Type 2
Governance and operational controls covering security, availability, and confidentiality.
Saudi PDPL
Personal data is processed in accordance with the Kingdom’s Personal Data Protection Law and its Implementing Regulations.
SDAIA compliance
Data and AI practices follow the regulations, standards, and AI ethics principles issued by the Saudi Data & AI Authority.
Data custody
Storage by data classification
Storage and access policies are set according to each institution’s data classification and governance requirements.
Controlled support access
Lameh staff access a customer environment only with the institution’s approval and for a defined purpose, and each session is logged.
No model training on customer data
Customer data is used only to serve the institution it belongs to. It is not used to train shared AI models.
Security controls
Verified access
Each user and system is verified before access is granted, and access is limited to what the task requires.
Encryption throughout
Documents, statements, source data, and generated outputs are encrypted in transit and at rest.
Regular security review
The platform and its infrastructure are tested and reviewed on a risk-based schedule.
Audit trail
Identity, permissions, data access, and the actions of AI agents are recorded in an audit trail available to the institution.
Ownership remains with the institution
Through enterprise identity and role-based permissions, the institution decides who has access, how long data is retained, and how it is managed across the platform.
Your institution sets the terms on which its data is held.
Data retention
Retention periods are set by the institution to match its internal policies and regulatory requirements.
Data governance
The institution can see who accessed data, which sources were used, and when each action took place.
Encryption management
Sensitive data remains encrypted in transit and at rest, in line with the institution’s policy.
User authentication
Users sign in through the institution’s identity provider, with permissions assigned by role.
“The institutions we serve are trusted with other people’s capital. We hold their data to the standard they hold themselves.”
FAQ
How is data protected?
Data is encrypted in transit and at rest, and access is limited through enterprise identity and role-based permissions.
Is customer data used to train AI models?
No. Customer data remains private to the institution and is not used to train shared models.
How does Lameh address the Saudi Personal Data Protection Law?
Personal data is processed in accordance with the PDPL and its Implementing Regulations, and with the requirements issued by SDAIA.
Who controls access and retention?
The institution does. Its administrators set user access, permissions, and retention periods, and each action is recorded in the audit trail.
A closer look at our controls
Our team will walk your security and compliance officers through Lameh’s controls and documentation.
Request demo