Security and data handling
How we protect the Arabic data you send us, and the questions to ask any Arabic data vendor, including us.
Arabic training and evaluation data is often personal, sensitive or regulated: customer calls, service chats, clinical notes, banking conversations. Here is how we handle it by default, and the questions you should ask any Arabic data vendor, including us.
Our defaults
| Hosting | In-region hosting by default, with on-prem and private-cloud options for mission-critical work. |
| Access | Least-privilege access: contributors see only the items their task needs. |
| Audit | Audit logs and an audit trail on every task. |
| People | Vetted contributors under NDA. Everyone passes dialect and domain screening before touching client data. |
| Quality | Gold-standard calibration, adjudication and rework loops, so errors are caught before delivery. |
| Independence | We do data only. We're model-agnostic and never compete with our clients' models. |
Questions to ask any Arabic data vendor
Use these in your security review. Ask us too; we'd rather answer them up front than after the contract.
- Where exactly will the data be stored and processed? Name the country and the hosting region. For some Saudi regulated buyers, “in the region” is not the same as “in the Kingdom”.
- Where are the annotators when they open your data? Hosting location and access location are different questions.
- Who can access which items, and is every access logged?
- Which subcontractors or subprocessors will touch the data?
- What happens at the end of the project? Return, deletion and written confirmation.
- How, and how fast, will you be told about an incident?
- Are contributors under NDA and screened for the dialect and domain? Unscreened raters are a quality risk as well as a security one.
- Does the vendor build or sell its own models? If it does, ask how your data and evaluations are kept separate.
Regulation
If your data includes personal data covered by Saudi Arabia's Personal Data Protection Law, read our guide to PDPL, data residency and AI training data (also in Arabic). It covers cross-border transfer conditions and what they mean for annotation and evaluation work.
Send us your requirements
Include your security questionnaire or data-protection requirements with your pilot scoping request, or email hello@bayanatlabs.com. See also how a pilot works.