Data security, privacy and PDPL at Nateq

Reviewed by Ahmed Mohamed · Nov 12, 20267 min read1 view

Short answer

Nateq processes your customers' data on your behalf. You're the controller and Nateq is the processor. Data is hosted on AWS in Frankfurt, encrypted, never used to train AI, and covered by our DPA.

Our Data Processing Agreement (DPA) applies to every customer, we publish the list of sub-processors we use, and you get tools to limit access, set retention and answer data requests. This article explains how that works and what it means for Saudi Arabia's Personal Data Protection Law (PDPL) and the GDPR.

Who owns the data

1You own your data: conversations, contacts, knowledge sources and call recordings belong to your business.
2Nateq processes it only to provide the service: to deliver messages, run the AI agent, generate reports and handle billing, following your settings and instructions.
3We don't use your data to train AI models, ours or anyone else's. The AI and speech providers we use work under terms that don't let them train on your data either.

Where your data is stored

1Nateq stores your data on Amazon Web Services (AWS) in eu-central-1 (Frankfurt, Germany). Database backups stay in the same region.
2Some sub-processors process data in transit in the European Union and the United States, for example AI models, voice and email delivery. The sub-processor list shows where each one processes data.
3Data residency in the GCC (for example, in Saudi Arabia) isn't available yet. If your organization needs it, contact us to discuss your requirements.
4For personal data of individuals in Saudi Arabia, the DPA includes SDAIA's Standard Contractual Clauses for transfers outside the Kingdom.

How your data is protected

1Encryption at rest: the database, cache, files and server disks are encrypted. Message bodies are also encrypted per contact, so erasing a contact destroys its key.
2Encryption in transit: TLS on every public endpoint and every call to our providers.
3Private network: the database and cache aren't reachable from the internet, and files are served only through short-lived signed links.
4Workspace isolation: every request is limited to the caller's workspace, and automated tests check this on the endpoints that handle personal data.
5Logging: an access log records who opened conversations, calls, transcripts and files, and who exported contacts. Application logs mask emails, phone numbers and message text.

Data Processing Agreement (DPA)

The DPA sets out how Nateq handles personal data on your behalf, including security measures, sub-processors, breach notification and deletion at the end of the contract.

1Read the DPA: [nateq.io/dpa](https://nateq.io/dpa) (you can also download it as a PDF from that page).
2You don't need to sign anything. The DPA is part of our Terms of Service and applies automatically when you accept them. If your compliance team needs a signed copy, sign the DPA and send it to legal@nateq.io.

Sub-processors

We use a small number of trusted providers to run Nateq, such as cloud hosting, AI models, voice processing, email delivery and payments. The full, current list, with each provider's purpose and location, is here: [nateq.io/subprocessors](https://nateq.io/subprocessors). We give you at least 30 days' notice by email before adding or replacing a sub-processor.

Security controls you can use

ControlWhat it does

Roles and custom permissionsLimit what each team member can view and do

Two-factor authenticationProtect each team member's sign-in with a second step. Set it up in Settings › Account › Security

Single sign-on (SSO)Sign in with Okta, Microsoft Entra ID or Google Workspace, require SSO for members, and sync your directory with SCIM. Available on the Scale plan

Audit logSee who changed what, and when, in Settings › Workspace › Data & Privacy

Retention policiesDelete conversations, messages, emails, call recordings, transcripts and other data automatically after the period you choose, in Settings › Workspace › Data & Privacy

IP allowlist for API keysAccept requests made with an API key only from approved IP addresses. Available on Team and above

Manage multiple brandsKeep each brand's conversations and settings separate. Available on Business and above

Your customers' rights (access, correction, deletion)

Under the PDPL and the GDPR, your customers can ask to access, correct or delete their personal data. In Nateq you can handle these requests yourself:

1Find a contact's data: go to CRM › Contacts and search by name, phone number or email, then open the contact.
2Correct a contact: edit the contact's details on their profile.
3Export their data: on the contact's profile, open Data and privacy › Export their data and confirm your password. Nateq builds a zip with their profile, conversations and messages, emails, call transcripts and recordings, attachments, bookings and CRM notes. The download link works for 7 days.
4Delete a contact and all their data: on the contact's profile, open Data and privacy › Delete all their data, type the contact's email, phone or ID, and confirm your password. Deletion is permanent and covers conversations, messages, emails, call recordings and transcripts, attachments, search, AI memory and logs. Copies in encrypted backups expire within 35 days. You can track each request under Settings › Workspace › Data & Privacy › Erasure requests, and Nateq issues an erasure certificate.

!Records in a connected CRM or helpdesk aren't deleted unless you turn on CRM deletion in Data & Privacy. Otherwise, the request log links to each record so you can delete it there.

Frequently asked questions

Is Nateq PDPL compliant?

Compliance with the PDPL is shared: you're responsible as the controller, and Nateq supports you as the processor. You get a DPA that includes SDAIA's Standard Contractual Clauses, a public sub-processor list, a 24-hour breach notice, access controls, and tools to export or erase a contact's data. If your compliance team needs specific documents or a security questionnaire, contact us.

Is Nateq GDPR compliant?

The same shared model applies. The DPA covers the GDPR and other data protection laws that apply to your processing, such as the UAE's data protection law, and your data is hosted in the EU (Frankfurt). Customer rights requests are handled with the same export and erasure tools.

Can my data be stored in Saudi Arabia or the UAE?

Not yet. Data is currently hosted on AWS in Frankfurt, Germany (eu-central-1). Contact us if in-country hosting is a requirement for you.

Does Nateq use my conversations to train AI?

No. Nateq doesn't use your data to train or fine-tune AI models, its own or anyone else's. Your data is sent to AI providers only to produce your replies, routing, summaries and transcriptions, under terms that don't allow them to train on it.

Who at Nateq can see my data?

Only Nateq staff and contractors who need access to run or support the service, and they're bound by confidentiality. Support access to your workspace is logged and appears in your audit log as Nateq support.

How long do you keep my data?

You decide. Set retention periods for each type of data in Settings › Workspace › Data & Privacy. Every plan includes 90 days, 1 year and keep forever, and other periods are available on Scale or with the compliance add-on. If you don't set one, data is kept until you delete it or your contract ends. After the contract ends, you have 30 days to export your data. Nateq then deletes it from live systems within 30 days, and copies in backups are overwritten within 35 days.

What happens if there's a data breach?

Nateq notifies you without undue delay and no later than 24 hours after becoming aware of a breach affecting your data. That leaves you time to meet your own 72-hour notice to SDAIA under the PDPL.

Did this solve your problem?