Privacy & security
Privacy & security
Hujah is built for work that depends on professional confidentiality. This page explains precisely what happens to your data from the moment you send it until the answer comes back, and the limits of what we offer.
The journey of your question or document
Every text that may reach the AI — questions, document text from the Word or Chrome add-ins, tool inputs, and excerpts retrieved from your vault — goes through these steps first.
- 1You
The lawyer
You type a question or send a document from Hujah, Word or Chrome.
- 2Our servers
Automatic masking
Numbers and identifiers are replaced with placeholders, and a model running on our servers finds names, organisations and places — plus the known parties of the matter.
- 3Our servers
Second check
An automated re-scan, plus an AI checker that only ever sees the masked text. Nothing is sent if we suspect personal data is left.
- 4Model provider
A zero-retention model
Only providers with a Zero Data Retention policy that don't train on data. They only receive the masked text.
- 5Our servers
Names restored for you
The real values are put back into the answer on our servers, so only members of your firm see them.
If in doubt, we stop
If the second check suspects leftover personal data, nothing is sent. We show you the suspected items so you can edit the text, or confirm "Send anyway" after reviewing them — which is recorded in the audit log.
Public statutes (published laws and regulations) are not masked, because they are public by nature.
Example: what you type, and what reaches the model
What you type
Mohammed Abdullah Alotaibi (ID no. 1012345678) shall pay the amount into account SA03 8000 0000 6080 1016 7519
What reaches the model
‹PERSON_1› (ID no. ‹NID_1›) shall pay the amount into account ‹IBAN_1›
3 items masked before sending
Names: 1 · ID / Iqama numbers: 1 · IBANs: 1
You see this badge with every request in Hujah and in the Word, Chrome and Google Docs add-ins; hover or tap it to see the types masked.
The vault: we store masked text
When you upload a file to the vault, it is read in memory and masked before anything is stored.
Masked text only
Only the masked text and its indexed excerpts are stored, and they are all the AI ever retrieves.
Real values, encrypted and separate
Real names and numbers are stored separately, encrypted with a key specific to your firm (AES-256-GCM), and never sent to the AI. They are searchable through keyed fingerprints, without storing plaintext in the index.
Originals only if you opt in
We don't keep the original file by default. If your firm chooses to keep originals, with explicit consent, they are stored encrypted.
Review and correct
Each file has a list of what was masked: unmask anything that isn't personal (such as a law's name) or add what we missed, and the file is re-masked and re-indexed.
Retention options
Standard
- File text is stored masked and encrypted in your firm's vault
- Delete any file and its index and values at any time
- Never used for training
Zero retention
- Files are parsed in memory and discarded when the session ends
- File contents are never stored in conversations
- Never used for training
Privacy & security
Client documents are a trust — so we mask their personal data before it reaches the AI
We mask personal data automatically on our servers, check the masked text a second time, and don't send anything if we suspect something was left. And we're precise about what is live today and what is still on the roadmap.
Four layers before the AI sees any text
Automatic masking of numbers and identifiers, then a name-detection model running on our own servers, then a second check of the masked text that stops the request if anything looks off, then model providers that don't retain data or train on it.
- Live
Automatic masking on our servers
Before anything is sent, national ID and Iqama numbers, CR numbers, IBANs, phone numbers and emails are replaced with placeholders, and a model running on our servers finds and masks names of people, organisations and places.
- Live
A second check before sending
The masked text is re-scanned automatically and reviewed by an AI checker that only ever sees the masked text. If we suspect leftover personal data, we don't send — we show it to you so you can edit the text or confirm.
- Live
Providers that don't retain or train
Every request is restricted to AI providers with a Zero Data Retention policy that don't use data to train models.
- Live
See what was masked
Every question shows a badge such as "3 items masked before sending", with the types masked, and you can review and correct what was masked in your vault files. Names are then restored into the answer on our servers, so only members of your firm see them.
- Live
A vault that stores masked text
Files are read in memory and only their masked text is stored. The real values are kept separately, encrypted with a key specific to your firm, and are never sent to the AI.
- Live
Encryption, isolation & audit log
TLS in transit, encryption of stored data, isolation of each firm's data, and a record of every action — including every request you chose to send despite a warning.
- Roadmap
In-Kingdom hosting
We plan to host the platform inside the Kingdom once an in-Kingdom cloud region is available to us, and we'll announce it here when it happens.
- Enterprise
Dedicated enterprise deployment
A dedicated environment for your organisation — including in-Kingdom when available — with SSO/SAML, a DPA and an SLA.
We follow SDAIA's AI Ethics Principles: transparency through citation, and human oversight — Hujah suggests, the lawyer decides.
Masking is automated and not perfect, which is why we check twice and show you what was masked. We do not yet hold independent certifications such as ISO 27001 or SOC 2, and we won't claim one before we have it. Anything marked "Roadmap" is not live yet.
Roadmap
Now
Protection today
Automatic masking on our servers, a second check before sending, zero-retention no-training model providers, a vault that stores masked text, encryption and an audit log.
Next
In-Kingdom hosting
Move servers, database and files to an in-Kingdom cloud region when one becomes available to us.
Next
In-Kingdom models
Route processing to in-Kingdom hosted models once they are available at a quality suitable for legal work.
Enterprise
Dedicated deployment
An isolated environment for your organisation — including in-Kingdom when available — with SSO/SAML, a DPA and an SLA.
Limits you should know
- Masking is automated and not perfect: it can miss an unusual name or a number in an unusual format, and it can mask something that isn't personal.
- The second check reduces that risk but doesn't eliminate it. If you choose "Send anyway", the text is sent as is, and that is recorded.
- The facts and context of your matter are sent after personal data is masked, because the answer needs them.
- We do not yet hold independent certifications such as ISO 27001 or SOC 2.
Personal Data Protection Law (PDPL)
We designed our processing around the PDPL and its regulations: we minimise data by masking it before anything is sent, process it for specific purposes, and disclose in our privacy policy any transfer outside the Kingdom and the safeguards applied under Article 29 and the Regulation on Personal Data Transfer.
Your rights under the PDPL
- The right to be informed how your data is processed
- The right to access your data and obtain a copy
- The right to correct your data
- The right to request destruction of your data once it is no longer needed
Report a vulnerability or ask a security question
Email hello@hujahai.com and we'll respond within two business days.
hello@hujahai.com