Saudi Hosted
Frontend Origin
Proposed scope · no badge issued
Open example verification recordWhere the original interface files live. Overseas edge delivery remains separately disclosed.
Independent discussion proposal — not an approved scheme
Saudi Hosted
From a label on a website to a specific, evidenced claim. An independent discussion proposal by Aziz Al Khunizan, separating origin, processing, storage, and the full service.
Prepared for discussion. This is not a government mark or an operating accreditation program. No badges or government partnerships are issued or announced through this page.
Four scopes, not quality levels
Saudi Hosted
Backend Processing
Proposed scope · no badge issued
Open example verification recordWhere required processing happens, including database queries, AI inference, fallbacks, and necessary partners.
Saudi Hosted
Stored Data
Proposed scope · no badge issued
Open example verification recordAll retained copies: interface files, databases, backups, logs, caches, and provider retention.
Saudi Hosted
Full Service
Proposed scope · no badge issued
Open example verification recordEvery applicable function, dependency, retained copy, and operational access inside the declared service boundary.
Concept proposal — not an official government mark. These designs are for discussion, not issued badges. Tool results do not grant a right to display a mark.
Download the artwork — Arabic, English and bilingual (ZIP)From badge to its record
Illustrations of the proposed verification record, not issued records. Choose a badge to reach its scope below. The service is fictional; no evidence has been collected or independently reviewed.
Illustrative example · no badge issued
Frontend Origin
- Service
- fictional.example
- Proposed scope
- Where the original interface files live. Overseas edge delivery remains separately disclosed.
- Status
- Pending review — not issued
- Review date
- Not reviewed
- Validity
- Not assigned — no issuance
- Reviewer and evidence
- No reviewer appointed or evidence supplied
- Limitations
- An example of this scope only; it establishes no component location, security, or compliance. Other scopes require their own evidence.
Under the proposal, hosting or material component changes require reassessment. MCP tools prepare evidence; they do not issue badges.
Back to badgesIllustrative example · no badge issued
Backend Processing
- Service
- fictional.example
- Proposed scope
- Where required processing happens, including database queries, AI inference, fallbacks, and necessary partners.
- Status
- Pending review — not issued
- Review date
- Not reviewed
- Validity
- Not assigned — no issuance
- Reviewer and evidence
- No reviewer appointed or evidence supplied
- Limitations
- An example of this scope only; it establishes no component location, security, or compliance. Other scopes require their own evidence.
Under the proposal, hosting or material component changes require reassessment. MCP tools prepare evidence; they do not issue badges.
Back to badgesIllustrative example · no badge issued
Stored Data
- Service
- fictional.example
- Proposed scope
- All retained copies: interface files, databases, backups, logs, caches, and provider retention.
- Status
- Pending review — not issued
- Review date
- Not reviewed
- Validity
- Not assigned — no issuance
- Reviewer and evidence
- No reviewer appointed or evidence supplied
- Limitations
- An example of this scope only; it establishes no component location, security, or compliance. Other scopes require their own evidence.
Under the proposal, hosting or material component changes require reassessment. MCP tools prepare evidence; they do not issue badges.
Back to badgesIllustrative example · no badge issued
Full Service
- Service
- fictional.example
- Proposed scope
- Every applicable function, dependency, retained copy, and operational access inside the declared service boundary.
- Status
- Pending review — not issued
- Review date
- Not reviewed
- Validity
- Not assigned — no issuance
- Reviewer and evidence
- No reviewer appointed or evidence supplied
- Limitations
- An example of this scope only; it establishes no component location, security, or compliance. Other scopes require their own evidence.
Under the proposal, hosting or material component changes require reassessment. MCP tools prepare evidence; they do not issue badges.
Back to badgesWhat changes across the six cases?
| Case and assumptions | Effect on the proposed scopes |
|---|---|
| A · Local interface, overseas backendLocal origin; APIs and database abroad. Only Frontend Origin could be supported. |
|
| B · Overseas interface, local processingForeign origin; all required backend processing local. The complete website retains its interface files abroad. |
|
| C · API-only, all required functions localAPI-only service. All required compute, copies, logs, dependencies and operational access are local. Frontend is not applicable with a written reason. |
|
| D · One encrypted backup abroadEvery required function is local except an encrypted overseas backup. Encryption does not change its physical location. |
|
| E · Local chat, overseas inferenceLocal interface and chat-history database; required AI inference abroad; provider retention unknown. Storage remains unresolved. |
|
| F · Foreign ownership, local operationA foreign-owned provider; every required component, retained copy and operational access is demonstrably local under the fictional assumptions. This makes no ownership or sovereignty claim. |
|
Why this idea?
The server visible to a visitor does not describe an entire service. Saudi Hosted proposes turning a broad phrase into a declared boundary, service-specific evidence, and an accountable review decision. Its value and user comprehension need testing.
Who could participate?
A claim would belong to a particular service or deployment, with a defined boundary and authorized owner. It would not cover an entire company or all customers of a provider. Nationality, ownership, and model development location do not substitute for processing, copy, and access evidence. Enrollment is not open.
How might verification work?
Identify service and authority → inventory components and flows → collect resource-specific evidence → resolve contradictions → accountable reviewer decision → a record of scope, dates, and limits. The current tools prepare evidence; they do not perform independent verification.
What evidence would help?
Dated resource and environment inventories, deployment and recovery settings, partner processing and retention terms, and support-access controls linked to the service. Domain control does not prove hosting location; signing a record does not independently prove the underlying facts.
Changes affect the claim
A new region, backup, or necessary processor should trigger reconsideration. The concept requires policies for issuance, renewal, suspension, revocation, and appeals while keeping sensitive evidence outside the public record. This is a proposed lifecycle, not a live status service.
AI belongs inside the boundary
Review inference and fallbacks, embeddings, retrieval, moderation, tools, retention, and ongoing training on service data. A foreign-developed model running locally does not automatically mean overseas processing; the actual data journey matters.
Governance still to decide
Program ownership, independent reviewers, conflicts of interest, evidence protection, complaints and appeals, and criteria updates need accountable decisions. No role has been agreed by MCIT, CST, SDAIA, NCA, or DGA through this proposal.
A limited pilot, if agreed
The document discusses 12 weeks, up to 20 low-risk services, and 30 person-weeks. It assumes at most 12 months of validity, 90-day reconfirmation, a five-minute status cache, and a user-comprehension test. These are planning assumptions, not regulations, commitments, this project’s schedule, or measured results.
Risks and decision gates
A label could be mistaken for a security or compliance guarantee, and architectures can change after review. Comprehension testing, clear evidence standards, review capacity, and examination of the name, identity, and existing schemes are needed before any issuance.
Essential questions
Does an overseas component mean the service is unlawful?
No. Proposed scopes do not decide legality. Cross-border transfers have separate conditions, routes, and evidence.
Relevant official texts: Personal Data Protection Law · Regulation on Personal Data Transfer Outside the Kingdom
Are these CST or NCA categories?
No. These scopes describe parts of a location claim. Regulatory categories and applicability remain separate.
Can I use the badge now?
This page provides no issuance process or usage right. Naming, identity, and criteria require separate decisions.