Sub-processors

Who processes data for Σigmix.

Σigmix runs in-Kingdom by default. This page lists every third-party sub-processor we use to deliver the platform — who they are, where they process, what they do, and whether the processing stays inside Saudi Arabia.

Version 1.0 · Last updated: 2 July 2026

1What a sub-processor is

A sub-processor is a third-party provider Σigmix engages to process data on its behalf in order to deliver the service — for example the cloud that hosts the platform, the network that delivers email, or an AI provider that runs a model you invoke. Each sub-processor is bound by a written agreement with data-protection obligations consistent with our Data Processing Addendum and the Saudi Personal Data Protection Law (PDPL).

2The current list

Providers marked KSA-resident process inside the Kingdom of Saudi Arabia. Providers marked Off-Kingdom process outside it — several of these are engaged only when a customer opts into the feature that uses them (noted in the Purpose column).

ProviderRegionPurposeCategory

Oracle Cloud Infrastructure (OCI)me-riyadh-1 · Riyadh, Saudi ArabiaPlatform hosting, managed PostgreSQL database, object storage, and KSA-sovereign AI inference (Cohere models served in-Kingdom on OCI).KSA-resident

GroqDammam, Saudi ArabiaKSA-sovereign AI inference — open-model family served from the Dammam region, with residency enforced fail-closed.KSA-resident

In-Kingdom GPU compute — Oracle · Google Cloud (Dammam) · SCCC · HuaweiRiyadh / Dammam, Saudi ArabiaKSA-sovereign AI inference on dedicated GPU servers hosted in-Kingdom across these data centres — customer prompts and outputs stay within Saudi Arabia.KSA-resident

PaymobSaudi ArabiaCard payment processing. Card data is tokenized by the gateway and never stored on Σigmix servers.KSA-resident

QoyodSaudi ArabiaZATCA Phase-2 (Fatoora) e-invoicing and bookkeeping — issues the compliant electronic invoice for every purchase.KSA-resident

TaqnyatSaudi ArabiaSMS delivery — one-time passcodes (OTP) and service SMS to KSA mobile numbers.KSA-resident

Amazon Web Services (SES)eu-central-1 · Frankfurt, EUTransactional and marketing email delivery (recipient address and message content transit the sending region).Off-Kingdom

Microsoft Azure (OpenAI Service)GlobalGlobal AI models (GPT family) — engaged only when a request opts into global models instead of the KSA-sovereign default.Off-Kingdom

Amazon Web Services (Bedrock)GlobalGlobal AI models (Claude, Grok) — engaged only when a request opts into global models.Off-Kingdom

Google (Gemini)GlobalGlobal AI models and image generation — engaged only when a request opts into global models.Off-Kingdom

CloudflareGlobalRealtime video infrastructure for the GLOBAL meetings module only. The KSA-private meetings module does not use it.Off-Kingdom

Meta Platforms (WhatsApp Business)GlobalWhatsApp messaging channel in the Chat module — only when a customer connects and enables WhatsApp.Off-Kingdom

RapidAPIGlobalRetrieval of public (OSINT) competitor-intelligence data for the Competitor Intel module.Off-Kingdom

3Off-Kingdom transfers

Where a sub-processor above processes personal data outside Saudi Arabia, the transfer is made in accordance with the PDPL's data-transfer provisions and rides SDAIA-approved safeguards (including contractual data-protection commitments with each provider). The KSA-sovereign AI tiers, the private meetings module, and web-chat-only tenants are engineered so their workload data does not leave the Kingdom.

4Updates to this list

Versioned on this page. Any addition, removal or material change to a sub-processor is published here with a new version number and date — this page is the authoritative record.
DPA customers. Customers with a signed Data Processing Addendum may object to a new sub-processor as set out in the DPA.

Questions about a provider? Write to dpo@sigmix.sa for data-protection matters or legal@sigmix.sa for contractual ones.

5Contact

Data protection: dpo@sigmix.sa · legal: legal@sigmix.sa · privacy requests: sigmix.ai/privacy-request.