By product
Sovereign AI Workspace13 tools, one login · try free Sovereign AI ServersSealed on-prem appliance Sigmix Guard™PCIe scrubbing & audit firmware Sigmix ZeroSovereign Windows 11 endpoint StocksIQThe AI analyst for the Saudi market Sigmix GrowthPilotCross-platform CAC & budget AI Muraqaba AISeparate product · video AI Sigmix RedAI penetration testing · newBy industry
Banking & FinanceSAMA CSF · on-prem Public SectorNCA ECC-2 · sealed HealthcarePDPL · sealed desktops EducationLighter, adaptive tone EnterpriseCustomer-facing suite · CRMSigmix Guard™
Our PCIe card, running Sigmix-authored firmware — scrubbing & audit, in dedicated silicon.
Explore Sigmix Guard
Sovereignty & compliance
Security postureNCA ECC-2 · SAMA CSF · PDPL · ZATCA Zero-egress architectureDefault-deny · canary-monitored Sigmix Guard™Independent enforcement layerNothing leaves your site
Every request served on-box, sealed from the internet.
See your postureThe evidence, not the adjectives.
Everything your security, risk and procurement teams need to assess Sigmix — the controls we run, the frameworks we map to, who processes what and where, and a plain statement of what we do not claim.
What we claim, and what we don't.
Vendor security pages tend to imply certifications nobody actually holds. Ours is written to survive being quoted back at us in a procurement review, so it is deliberately narrower than it could be.
Regulators assess your organisation, not vendor products.
There is no such thing as a "SAMA-certified" or "NCA-certified" AI platform. Those frameworks certify you. What a vendor can honestly do is build controls that map cleanly onto your obligations, and hand your team the evidence to demonstrate them. That is what this page is for.
So we say "designed to support your obligations under PDPL, SAMA CSF and NCA ECC-2:2024", and we provide the control mapping. We do not say we are certified against them, because we would be describing your accreditation, not ours.
We do say
FIPS-validated crypto modules. Designed to support PDPL, SAMA CSF and NCA ECC-2. Zero egress by architecture on sealed postures.
We don't say
FIPS-certified appliance. SAMA-certified. NCA-certified. Guard is not the certified root of trust — the FIPS-validated TPM is.
Where we're honest about limits
Scene understanding and forecasting are probabilistic. Anything consequential is flagged for human review, never auto-decided.
How our controls line up with your obligations.
The detailed control-by-control mapping is released under NDA as part of the evidence pack. This is the summary.
| Framework | Our position | What we provide |
|---|---|---|
| NCA ECC-2:2024 | Designed to support | Control mapping covering asset protection, access control, cryptography, logging and network segregation. Sealed deployment removes whole classes of control from scope. |
| SAMA CSF | Designed to support | Mapping for data protection, third-party risk, logging and monitoring. Zero-egress posture is the usual answer to the data-transfer questions. |
| PDPL | Aligned by design | Residency, retention limits, right-to-erasure via crypto-shredding, PII scrubbing on the request path, and a tamper-evident access log. |
| ZATCA | Compliant invoicing | Bilingual tax invoices issued natively by the platform, not produced by a bolt-on. |
| Vision 2030 | Aligned | Built in the Kingdom by a MISA-licensed Saudi entity, with in-Kingdom compute and Arabic-first output. |
| FIPS 140 | Validated modules only | The appliance uses FIPS-validated crypto modules, including the TPM 2.0 that signs audit anchors. The appliance itself is not FIPS-certified and we do not claim it is. |
| ISO 27001 | Not held today | Not currently certified. We would rather list this honestly than let a logo imply otherwise. Ask us for our current roadmap position in the briefing. |
What actually runs.
Data protection
- AES-256 at rest with per-tenant keys
- TLS in transit, terminating in-Kingdom for sovereign tenants
- Credentials stored by reference, never in the clear
- Right-to-erasure via crypto-shredding
Isolation
- Tenant isolation enforced in the database itself
- Enforced again at the application layer
- Dedicated in-Kingdom capacity available for regulated clients
- Sealed postures are physically separate by definition
Integrity & audit
- Chained, tamper-evident audit anchors
- TPM 2.0 signs the export; replicates to your SIEM / WORM
- SHA-256 verified model weights
- Every credit and billing movement ledgered and reconcilable
Network posture
- Default-deny networking on sealed deployments
- Continuous canary alerts if the internet becomes reachable
- No remote-access path by design on sealed postures
- Optional maintenance tunnel is customer-controlled and revocable
Build & supply chain
- Automated vulnerability and code-security scanning gates the build
- DigiCert code-signed installers
- Dell Technologies Authorized Partner — genuine, warrantied hardware supply
- Sigmix-authored firmware on a vetted supply chain in Sigmix Guard
- No AGPL or non-commercial-licensed models in production
Identity & access
- Active Directory / SSO integration, included
- Argon2id password hashing
- Capability gates set centrally, with an audit trail of changes
- Face recognition ships disabled behind an explicit admin gate
Who touches your data, and where.
On sealed on-prem and on-device postures the honest answer is "nobody but you" — there is no outbound path for a subprocessor to sit on. The list below applies to the cloud postures.
The evidence pack.
Released under NDA to organisations in an active evaluation. Ask for it in the briefing and we will send the current version rather than a marketing summary.
Control mapping
Control-by-control mapping against NCA ECC-2:2024, SAMA CSF and PDPL.
Architecture & data-flow
Where data sits, what crosses which boundary, and what does not cross at all.
Subprocessor register
The signed, current list with purpose and jurisdiction for each party.
Audit-log specification
Anchor format, signing chain, and how it lands in your SIEM or WORM store.
Model & licence inventory
What models run in each posture and under which licences.
Incident & continuity plan
How we respond, who we notify, and in what timeframe.
Found something? Tell us.
We would rather hear it from you.
If you believe you have found a vulnerability in a Sigmix product or service, report it directly and we will acknowledge it. We ask for reasonable time to remediate before public disclosure, and we will not pursue researchers who act in good faith, avoid privacy violations and do not degrade service.
A Saudi entity, on the record.
Sovereignty claims mean little from a company incorporated somewhere else. These are the registrations your procurement team will ask for.
Send us your security questionnaire.
We would rather answer your standard assessment than have you read ours. Send the questionnaire ahead of the briefing and we will come back with the evidence pack and the control mapping filled in.