THE OFFICE IS THE EDGE · المكتب هو الحافة
For Saudi audit, law & professional firms
Ithbat turns the machines your firm already owns into its private AI — the local twin of the cloud AI your team already loves. Saudi data rules are enforced on every request, automatically, and each one leaves a receipt.
The quiet problem
Not because they're careless — because it works. Ithbat gives your team something just as easy that never puts client data outside your walls.
Read: shadow AI in Saudi firms →Your reality
Somewhere in your firm right now, a manager is pasting a client's trial balance into ChatGPT to save an hour before a deadline. An associate is asking Copilot to summarise a contract that names a client's commercial secrets. Nobody signed off on it. Nobody is tracking it. It's just happening — quietly, every day — because the productivity gain is real and nobody wants to be the one who falls behind.
This is shadow AI: AI use your firm didn't approve, can't see, and can't prove either way.
The danger
Every prompt sent to a public AI tool leaves your walls and is processed on infrastructure you don't own, under terms you never negotiated. If a client ever asked exactly where their file went, "we're not entirely sure" is not an answer a partner can give. This isn't hypothetical — it's a confidentiality breach waiting to surface: a complaint to SOCPA, a PDPL inquiry, or simply a client who finds out and walks. Trust, once broken this way, doesn't come back with an apology.
The trap
Faced with this, firms tend to pick one of two losing moves.
Staff quietly keep using it anyway — you've just lost visibility along with the productivity. Competitors who allow AI move faster, and the people who want modern tools start looking elsewhere.
Let staff use AI and hope nothing sensitive ever gets typed in. You're gambling the one thing you sell — client confidentiality — on individual judgment, with no way to prove otherwise if something goes wrong.
Neither is a policy. Both are a bet — with your clients' data as the stake.
The third option
Ithbat is a private AI gateway that runs on hardware your firm already owns — a spare office machine is enough to start. Every prompt is checked before it goes anywhere: anything touching a client file, a Saudi ID, an IBAN or other sensitive data is automatically kept on your own machines and never even offered to a cloud provider. Ordinary, non-sensitive work can still use frontier AI like Claude or ChatGPT — governed and logged. Either way, a hash-chained, tamper-evident receipt proves exactly what happened, for every single request.
Run nodes on the machines you already own — start with one, enroll more into your fleet.
Deploy ALLaM, SILMA and a growing library of Arabic-first and open models across the fleet in a click — no procurement, no per-use bills.
Any OpenAI-compatible app or agent you point at the gateway inherits policy and evidence.
Why now
Saudi Arabia is investing at national scale in sovereign AI infrastructure and Arabic models — HUMAIN, ALLaM, and NDMO's data-classification mandate signal that regulated firms will increasingly be expected to prove where their data and AI processing go. Ithbat gives a firm that proof today, on machines it already owns — processing locally, the way edge AI works on phones and watches: the device computes rather than sending everything to the cloud. Ithbat does this for the enterprise: your office is the edge.
How it works
Ithbat checks what each one can handle. No procurement, no data center.
Tell Ithbat what your team uses today; it sets up the closest private counterpart your hardware can run. One click.
Every request is checked against Saudi data rules (PDPL · NDMO) before it goes anywhere. Client data is answered inside your walls, automatically.
Your office machines work together as one, so the whole team gets answers at once — not a queue.
Tuned to office hardware so private AI feels natural — and it keeps working even when the internet doesn't.
Each answer leaves a tamper-evident record. Hand clients and reviewers proof that nothing sensitive left the building.
That's the whole idea: the office is the edge.
See it live — right in your browser
This happens to every AI request inside a firm running Ithbat: classification, a Sovereign Fallback Routing decision (stay on-prem, or go to cloud AI), policy enforcement, and a hash-chained, tamper-evident Evidence Trace receipt. The routing decision happens in under a millisecond; the full governance overhead adds only single-digit milliseconds, on the firm's own hardware. Try both sample prompts below.
Nothing you type here is sent anywhere. The scan runs entirely in this browser tab.
SHA-256 receipt computed locally by your browser — illustrative. Real deployments write a hash-chained Evidence Trace record on your machines, whichever way the prompt was routed.
This happens to every AI request inside your firm — with a tamper-evident, hash-chained receipt, on hardware you own.
Confidentiality is architectural — the data never moves — not enclave-based on consumer hardware.
The Ithbat principle
The proof — your sales weapon
Every inference — whether kept on-premise or safely routed to cloud AI — writes a hash-chained, tamper-evident receipt: what was asked, how it was classified, where it was processed, and confirmation that nothing sensitive left the building. This is what you hand a client, a partner, or SOCPA when they ask "how do you know?" — instead of a verbal assurance. And it's what you put in front of a prospect when you're competing for a new mandate against a firm that can only offer promises.
Each receipt's hash incorporates the one before it — alter or delete a record, and the chain no longer verifies. That's what makes this an evidence trail, not just a log file you're asked to trust.
Proof, not promises
Other AI-governance tools document policy. Ithbat sits in the data path and produces the evidence — a live dashboard and a one-click bilingual Client Confidentiality Assurance export mapped to PDPL and NDMO. The cost case writes itself: every sensitive token served on your own hardware is a token you never paid a cloud API for.
Example dashboard — illustrative figures.
Who it's for
If your business runs on a client's confidence that their information stays private, Ithbat is built for you — and the evidence layer turns "we think it's confidential" into something you can hand a client or a regulator.
Client financial records, working papers and engagement files — analysed by AI on your hardware, with per-matter SOCPA-aligned confidentiality evidence.
Contract review and ruling analysis in Arabic, with per-matter client confidentiality evidence. Client files never leave the firm's network.
Client strategy decks, financial models and market intelligence analysed on your own hardware — without exposing a client's competitive position to a third party.
Wealth structures, beneficiary records and investment mandates kept entirely in-house, with proof for every principal who asks how their data is handled.
Takaful, Islamic-finance and AML/KYC workflows with SAMA-aligned, on-prem processing and tamper-evident evidence.
Valuation, listings and lease drafting over national-ID, biometric and tenancy data — kept on-prem under PDPL.
Formal Arabic correspondence and privacy scanning, fully sovereign and offline-capable.
Domain copilots and Saudi-dialect support over operational data that can't leave the enterprise.
The decision
Banning AI or risking it both cost you something (see "the trap," above). Here's how Ithbat compares to the other paths firms actually take:
| What matters | Ithbat | Cloud AI service | AI-governance (GRC) tool |
|---|---|---|---|
| Where sensitive data is processed | Inside your walls, on hardware you own | A third party's shared infrastructure | Wherever your AI already runs — it only documents |
| Enforces the data path | Yes — classifies & blocks at the gateway | No — you send the data to use it | No — it sits outside the data path |
| Per-inference confidentiality evidence | Hash-chained, tamper-evident, per call | Provider logs, not your evidence | Policy attestations, not per-inference proof |
| PDPL / NDMO / SOCPA fit | Designed for compliance — sensitive data never leaves | Ongoing residency & transfer review | Helps you document; the risk still exists |
| Cost | Flat for sensitive work — cloud fees only for prompts you route out, on your key | Per-use, grows with every user | A subscription on top of your AI spend |
| Access to frontier AI (Claude, GPT, etc.) | Yes — governed routing for non-sensitive prompts only | Yes, but ungoverned — every prompt leaves your walls | No — it only documents; not an AI provider |
| Arabic & Saudi-sector AI | Purpose-built Arabic models, on-prem | General models, no Saudi-sector focus | Not an AI provider |
Compliance
Ithbat removes the hardest part of any AI compliance case: the data leaving your control. Because sensitive information never crosses your boundary, the cross-border and third-party-access questions that stall cloud-AI projects simply don't arise — and now you can prove it, inference by inference.
Ithbat provides the controls and the per-inference evidence a compliance review evaluates; formal certification is completed with your own assessor and security team.
Common questions
Sending client financial records to a public AI service like ChatGPT means the data leaves the firm's control and is processed on a third party's infrastructure, which is hard to reconcile with an auditor's professional confidentiality duty and with Saudi PDPL. Ithbat avoids this entirely: it runs AI on hardware inside the firm's own office, so client files never leave the building, and it records per-inference evidence that the data stayed on-premise.
Use an AI system that processes data on-premise instead of in the cloud. Ithbat is an on-premise AI gateway: prompts containing client data are classified and kept on machines the firm owns, never transmitted to an external AI provider, and each inference produces a tamper-evident, hash-chained confidentiality record the firm can show a client or regulator.
Ithbat is built for PDPL alignment by construction. Because sensitive personal data is processed on-premise inside Saudi Arabia and never transferred outside the firm or the Kingdom, the cross-border-transfer and third-party-access questions that usually block cloud AI under PDPL do not arise. Ithbat also classifies data sensitivity before each inference and logs tamper-evident, hash-chained evidence. Formal certification is completed with the firm's own assessor.
For audit and accounting firms that handle confidential client books, the key requirements are: the AI runs on hardware the firm owns, client data never egresses, Arabic-first language quality, and auditable evidence per matter. Ithbat meets these with an OpenAI-compatible on-premise gateway, Arabic-first models, and per-inference confidentiality evidence mapped to PDPL and NDMO, delivered from Saudi Arabia.
Ithbat produces a Client Confidentiality Assurance report: a bilingual (Arabic/English) export showing, per inference, that client data was classified, kept on-premise, and never sent to any external cloud, backed by a SHA-256 hash-chained evidence trail. The firm can hand this report to a client or to SOCPA as objective proof rather than a verbal assurance.
Ithbat runs on hardware the firm already owns, so there are no per-use fees for sensitive work — it runs on your own hardware; only prompts you allow to route to cloud AI incur provider fees, on your own API key. Engagements start with a fixed-scope, six-week paid pilot from SAR 15,000 for one office; annual licensing is scoped to the firm's size after the pilot.
Yes — Ithbat is enterprise edge AI. AI inference for sensitive prompts runs locally on the firm's own machines, with per-inference compliance evidence generated on those same machines, so sensitive content never leaves the premises; non-sensitive prompts reach cloud AI only under explicit policy (Sovereign Fallback Routing), governed and logged either way. Just as edge AI on a phone processes locally rather than sending everything to the cloud, Ithbat processes AI workloads at the enterprise edge — on hardware inside the firm's walls — giving regulated firms the speed and sovereignty of local compute with the compliance evidence that cloud AI cannot produce.
Not safely on its own — anything typed into a public AI tool like ChatGPT is processed on a third party's servers, which is a real risk to client confidentiality, trade secrets and the trust a client places in your firm, regardless of any regulation. Ithbat removes that risk with Sovereign Fallback Routing: it classifies every prompt first, automatically keeping client data, IDs, IBANs and other sensitive text on your own hardware, while ordinary, non-sensitive prompts can still use frontier AI like ChatGPT or Claude — governed, logged, and provably safe either way.
Put a gateway in front of your AI use instead of trusting staff to self-police. Ithbat sits between your team and any AI model: it classifies each prompt, keeps anything involving client files, national IDs, IBANs or financial data on hardware your firm owns, and only lets non-sensitive requests reach cloud AI — with a hash-chained, tamper-evident Evidence Trace receipt for every single request. The result is Arabic-first AI your staff can use daily, without gambling client trust or your professional reputation on it.
Most "sovereign cloud" AI offerings still mean your data leaves your building for someone else's data center, even if that data center is inside the Kingdom. Ithbat is different: it runs on hardware physically inside your own office, so sensitive client data never leaves your walls at all — not even to an in-Kingdom cloud. Only prompts your policy marks as non-sensitive are ever allowed to reach an external AI provider, and every routing decision is logged.
Yes — this is exactly what Ithbat's Sovereign Fallback Routing is built for. Every prompt is classified first; anything touching client files, Saudi IDs, IBANs or other sensitive data is automatically kept on your own machines, while everyday, non-sensitive prompts are still free to use frontier models like Claude for better quality. You get the capability of frontier AI without paying cloud fees for sensitive work that can run locally for free, plus a tamper-evident Evidence Trace receipt proving which path each request took.
It means your firm's own computers do the AI work, right there in your office, instead of sending everything out to a data center. Ithbat turns the machines you already own into private AI — the local twin of the cloud AI your team uses — so sensitive client data is answered inside your walls and never has to leave the building. You get fast, Arabic-first AI that keeps working even when the internet doesn't, and a tamper-evident receipt proving where each request was handled.
Ithbat is an on-premise AI gateway for Saudi audit, accounting and law firms.
With Ithbat, client files never leave the firm's office — AI runs on hardware the firm already owns.
Ithbat's Sovereign Fallback Routing classifies every prompt for Saudi sensitive data (national ID, IBAN, VAT, patient records) before it is processed: sensitive prompts are kept on the firm's own machines, while non-sensitive prompts can safely route to frontier cloud AI (e.g. Claude) — governed and logged.
Ithbat's Evidence Trace records a tamper-evident, hash-chained receipt for every inference and produces a bilingual Client Confidentiality Assurance report mapped to PDPL and NDMO.
Ithbat is Arabic-first and built in Saudi Arabia.
Ithbat engagements start with a paid six-week pilot from SAR 15,000 for one office.
Start here — Client-Data AI Exposure Self-Check
Answer 6 questions — takes 2 minutes. Your risk band shows instantly; leave your work details afterward only if you'd like the tailored result and a sample Client Confidentiality Assurance report emailed to you.
Leave your work details and we'll email your result plus a sample Client Confidentiality Assurance report — the tamper-evident receipt Ithbat produces for every client matter.
Sign up, run one line on a machine you own, and watch sovereign Arabic AI serve a sensitive prompt — evidence included. No credit card. No cloud agreement. Paid pilots from SAR 15,000.