You inherited your client's obligations. Now you have to pass them on.
A regulated client signs you up to their data rules, and those rules do not stop at your firm. Every tool the matter passes through has to take the same flow-down — which is why this question arrives in procurement rather than in a demo.
Four links, and only one of them is yours to choose
The obligation is set at the top and gets stricter as it descends, because every party adds its own protection on the way through.
- 01
The regulator
Sets the floor
Rules binding on the regulated entity
- Customer data stays within the Kingdom
- The entity remains accountable for anyone it appoints
- Access by a third party is auditable
- 02
Your client
Regulated entity
Engagement letter and its data schedule
- Their obligations pass to you unchanged
- No onward transfer without written consent
- Sub-processors named and approved in advance
- Right to audit, and to require deletion
- 03
Your firm
Processor for this purpose
Vendor agreements
- Everything above, again, in every tool that touches the matter
- Evidence you can hand back, not assurances you were given
- 04
Your tools
Where it either holds or breaks
Whatever the vendor's standard terms happen to say
- Nothing — this link either satisfies the chain or ends it
The questionnaire, answered
These are the seven that arrive on every procurement form. 5 are satisfied outright and 2 are conditional — and the conditions are printed here rather than discovered during negotiation.
A vendor answering all seven with an unqualified yes has either not read them or is going to disappoint somebody at contract stage. The two conditional answers below are the ones worth arguing about, so they are the ones with the most words.
-
In-Kingdom processing
Satisfied
“Where is our data processed, and by whom?”
Storage, index, embeddings and the model in one region inside the Kingdom. Named region, not a jurisdiction-shaped statement.
-
Named sub-processors
Satisfied
“List every third party with access, and notify us before adding one.”
Four, all in the Kingdom, named in the security pack with what each touches and thirty days' notice before any change.
-
No training on client data
Satisfied
“Confirm our documents are not used to improve your models.”
Contractual rather than a setting. This is the clause most often given as a policy statement and it needs to be in the agreement.
-
Auditable access
Satisfied
“Can we see every time your staff accessed our matters?”
The access ledger, per firm, including the requests you refused.
-
Deletion on demand
Conditional
“On termination, delete everything within thirty days and certify it.”
Everything clears immediately except the access log, which is retained deliberately and holds identifiers and reasons rather than content. That exception has to be written into the agreement rather than discovered later.
-
Right to audit us
Conditional
“We reserve the right to audit your controls annually.”
Accepted for firms above a threshold, and honestly not practical to grant to every customer individually. Where it is not granted, the alternative offered is the report rather than a refusal.
-
Customer-held encryption keys
Satisfied
“We want to hold the key and revoke it unilaterally.”
Available, with the consequence stated plainly: revoke it and nothing is recoverable, by us or by you.
Where these chains actually break
Rarely at the tool. Usually at the sequence — the schedule was signed before anybody asked where the work would be done.
- The firm signs, then picks the tool
- The data schedule is negotiated with the client months before anybody chooses where the matter will be worked on. By the time the question is asked, the answer is already committed.
- A jurisdiction claim is not a region
- "Data stays in the region" is a sentence about marketing geography. The question is which facility, and whether the index and the logs are in the same one as the documents.
- Sub-processors get added quietly
- A vendor adding a fifth sub-processor without notice breaks a flow-down the firm has already signed. Notice periods matter more than the current list.
- Nobody asks about the logs
- Documents are the obvious asset. Error traces, queues and telemetry carry fragments of the same content and are routinely hosted somewhere else entirely.
What we do not answer for
We can tell you what our link does. The three above it are yours.
- We answer for our link only
- Everything above the fourth row is your client's agreement and your own. We can show you what we satisfy; we cannot tell you whether your engagement letter promised more than it should have.
- Two answers here are conditional
- Deletion carries a documented exception and audit rights are granted above a threshold. Both are on this page rather than in a footnote because they are the ones that surface late and badly.
- Residency is jurisdiction, not secrecy
- Keeping data in the Kingdom decides whose law governs access to it. It does not make it unreachable, and a vendor implying otherwise is selling geography as cryptography.
- Nothing here is a legal opinion
- Whether our arrangement satisfies your specific flow-down is a question for the person who negotiated it. We give you the facts to check against, not the conclusion.
The other outcomes
Cut review time
The first pass on a document set.
Draft in both languages
Arabic and English that agree with each other.
Never miss a limitation
Counted from the trigger event.
Bring research in-house
Stop paying counsel to look things up.
Get juniors productive
The precedent bank a first-year does not have.