KPILoop Trust Center

1. Current compliance status

We are pre-launch and building toward formal certification on a phased plan. Here is where we stand today, without hedging:

• PDPL (Saudi Arabia)In progress

  We are aligning data handling, breach response, and data-subject request workflows with the Saudi Personal Data Protection Law, with internal readiness targeted for Q3 2026.

• GDPRReady

  Our processing notices, lawful basis mapping, and data-subject rights workflows are in place. See our GDPR Notice for full details.

• SOC 2 Type IOn roadmap

  Audit scoping is underway with a Type I report targeted within 6–9 months of revenue stabilizing. SOC 2 Type II will follow after the Type I window closes.

• ISO 27001Post-revenue

  Scoped for a future phase, after Type II. We are not certified today and will not claim otherwise.

• PCI DSSNot applicable

  KPILoop does not accept card payments and never sees or stores cardholder data. Fees are invoiced under each client contract.

2. Certification timeline

Here is the dated schedule we are working to. We publish dates so we can be held to them, not because every milestone is guaranteed — we will update this page if scope or sequencing changes.

1. PDPL readiness (Saudi Arabia)December 2026

   Internal PDPL alignment complete: data handling, breach response, and data-subject request workflows in production. DPO appointed and SDAIA registration filed where required.

2. GDPR DPA and SCCsQ1 2027

   Standard Data Processing Addendum and Standard Contractual Clauses published for EU customers.

3. SOC 2 Type I kickoffQ2 2027

   Audit scoping with a recognized CPA firm via a compliance automation platform. Controls implemented across security, availability, and confidentiality trust services criteria.

4. SOC 2 Type I reportQ3 2027

   Type I report issued and made available under NDA to qualified prospects and customers.

5. Additional Middle East hosting regionsQ4 2027

   Expanding the set of regions a client can choose at contract time.

6. SOC 2 Type II observation windowQ1 2028

   Begin the minimum six-month observation period required for a Type II report. No claim of Type II compliance during this window.

7. SOC 2 Type II reportQ3 2028

   Type II report issued, covering the full observation window. Available under NDA.

8. ISO 27001 readinessQ4 2028

   ISMS scoped, risk assessment complete, Statement of Applicability drafted. Certification audit scheduled for 2029 if business need confirms.

3. Data residency and hosting

Each client's data is held in a dedicated environment, in the hosting region agreed in the client contract.

Customers with hard residency requirements should state them before signing so that the hosting region can be set in the contract.

4. Saudi Arabia — PDPL commitments

KPILoop is a Saudi company serving Saudi customers. We treat the Personal Data Protection Law (PDPL) as a first-class obligation, not an afterthought. Here is exactly where we stand and where we know we have work to do:

• Lawful basis and notice

  We collect personal data on the basis of contract performance (operating your KPI account), legitimate interest (security, fraud prevention, service improvement), and explicit consent (analytics cookies, marketing). Bilingual privacy notices in Arabic and English are published and shared before contracting, not buried after.

• Data-subject rights in Arabic

  Access, correction, deletion, and objection requests are fully supported in Arabic. The in-product DSR flow and the privacy@kpiloop.com inbox both respond in the language the request was filed in. We do not require Arabic speakers to switch to English to exercise their rights.

• Cross-border transfer disclosure

  Each client's data is held in dedicated infrastructure in the region agreed in the contract. Where that region is outside Saudi Arabia, hosting is a cross-border transfer under PDPL and we disclose it in the contract. Customers with residency-bound data should confirm the region before signing — see section 3.

• Breach notification

  We commit to notifying affected customers within 72 hours of confirming a personal data breach that creates a material risk to individuals, with parallel notification to SDAIA where required by PDPL.

• DPO and SDAIA registration

  A data protection officer will be appointed and SDAIA registration filed where required as part of our December 2026 PDPL readiness milestone (see section 2). Until then, privacy@kpiloop.com is the named contact for all PDPL matters.

5. Subprocessors

We use a short, deliberate set of subprocessor categories. Each one is contractually bound to handle personal data only on our instructions and to maintain appropriate security controls.

Named vendors are listed in your Data Processing Agreement. We will notify customers of material changes with at least 30 days' notice prior to onboarding any new subprocessor.

To receive subprocessor change notifications by email, subscribe at privacy@kpiloop.com — we will add you to the notification list and confirm.

6. AI processing and opt-out

KPILoop uses a third-party AI model provider, named in the Data Processing Agreement, for KPI suggestions, performance insights, risk prediction, and review drafting. When you use these features, the relevant KPI or review content is sent to that provider for inference.

We do not use your data to train foundation models. Per-organization opt-out from AI features will be available in the admin console; if you need it sooner, contact us and we will disable AI flows at the organization level.

7. Security controls

Our current security posture includes:

• HTTPS-only delivery with HSTS and a strict Content Security Policy.
• Role-based access control for admin, manager, employee, and executive roles.
• Data-access rules enforced server-side, scoped per organization, with no client-side bypass.
• Encryption at rest and in transit.
• Error monitoring with PII-scrubbing applied before transmission, where enabled.
• Code review on all changes; no direct pushes to production branches.