How NCASEAI earns your trust

How NCASEAI verifies information

Every answer follows the same fixed path. Code runs the path, so no step can be skipped.

1. Plan. Code reads the question and decides which figures, regions and companies it needs.
2. Retrieve. Matching rows are pulled from the evidence ledger, each with its publisher, period and as-of date. At the Standard and Deep levels, the web is searched too.
3. Write. An AI model drafts the sentences. It is not allowed to type a number: a draft that contains a digit it was not given is refused.
4. Insert. Code replaces each placeholder with the ledger row's figure, with its publisher, period and date.
5. Check. A second AI model checks every statement (see second-model verification below).
6. Show. Each figure carries its label. A statement that did not pass is marked. A figure with no source is shown as a gap and named, never estimated.

This is a fixed workflow, not a free-running agent. The steps stream live on screen while it works.

How citations work

• Every figure in a report carries a number, such as [3], that points to a reference on the last page: the publisher's own page or document, with a link you can open.
• A link counts as checked only after a person opened it and found the figure on that page. A link that could not be checked says “Link not checked”.
• In a web research answer, each fact points to the page it came from, in a numbered list of sources. Only web addresses survive; nothing from a web page is run or shown as HTML.
• The as-of date shown is the document's own date, not the day we read it. For a register with no publication date, it is the day the register was read, and the figure says so.

Official, other source, web and estimated data

GASTAT's own site blocks automated access, and NCASEAI does not work around that. Selected GASTAT tables are read through DataSaudi and labelled Other source.

How NCASEAI reads publishers: its connectors identify themselves as NCASEAI-ingest with a link to this page, read each site's robots.txt first, never work around a refusal, and make at most one request every two seconds to a host.

AI models used

Web search (Standard and Deep levels) runs on the Exa engine, through OpenRouter.

• Every model is called through OpenRouter. Each request asks to be routed only to providers with zero-data-retention terms.
• The checking model always comes from a different company than the writing model.
• NCASE staff choose each job's model from an approved list. Customers cannot change it. Models change over time; the table shows the defaults in the current release.
• NCASEAI does not use your content to train AI models.

Second-model verification

• For an answer from the ledger, the second model reads each sentence against the figures it was given. A sentence that does not pass is marked “Not verified”.
• For a web summary or a written report, it checks each figure against the extract of the page cited for it, and marks any it cannot find there: “Not found in the cited source”.
• It fails closed: if the check cannot run or returns nothing, nothing is marked verified. A missing verdict is never a pass.
• The result is on screen: “A second AI found all N figures in the pages cited for them”, or the figures it could not find, marked where they appear.

A check is not a guarantee. It can show that a figure is not in its source; it cannot tell whether the source itself is right. Open the sources before you rely on a figure from the web.

Data privacy

• NCASEAI collects your account details, what you ask and make, the text of files you attach, and technical records used to prevent abuse. The Privacy Policy lists all of it.
• We do not sell your data and we do not use your content to train AI models.
• Page-view analytics run only if you accept them in the cookie choice. There is no advertising and no third-party tracking.
• You can download everything or delete your account yourself, in Settings → Your data. You may also complain to the Saudi Data and AI Authority (SDAIA).

Data retention

These periods are fixed. Retention that you configure yourself is not available today.

Security

• Each organisation's data is kept apart by row-level security in the database. Every table is locked, and automated tests check that one organisation cannot read another's, even by guessing an address.
• Passwords are kept by the sign-in provider in hashed form. NCASEAI never sees them.
• The session cookie is HTTP-only, HTTPS-only in production and expires in two weeks.
• Every page is sent with a content security policy, strict transport security, frame, content-type, referrer and permissions policies.
• Text from the web is shown as text, never run as HTML. Uploaded files are limited in type and size, archives are checked for decompression bombs, and the file itself is not kept.
• Sign-in, questions and downloads are rate-limited, and AI spend is capped per organisation per day.
• API keys of data sources are stored encrypted.

NCASEAI does not hold ISO 27001 or SOC 2 certification, and has no NCA ECC compliance attestation today. It does not claim them.

Where data is processed

As our Privacy Policy says, these providers process your data outside the Kingdom of Saudi Arabia, and we send them only what the service needs. Saudi or GCC data residency is not available.

Enterprise controls

Available today

• Organisation accounts. Each customer organisation has its own workspace: conversations, reports, projects and settings.
• Data isolation between organisations. Row-level security in the database keeps each organisation's data apart, and automated tests check that one organisation cannot read another's.
• Role-based access for NCASE staff. NCASE staff act as owner, admin or analyst, each with only the permissions the role needs. This governs our own team, not your users.
• Model controls. NCASE staff choose each job's AI model from an approved list, and the checking model always comes from a different company than the writing model. Customers cannot choose models.
• Zero-retention AI providers. Every model request is sent with a requirement to route only to providers with zero-data-retention terms. Web search runs through Exa, which keeps queries under its own policy.

Not available today

• Single sign-on (SSO)
• Multi-factor authentication (MFA)
• Roles and permissions for your own users
• Customer-facing audit logs
• Configurable data retention
• Saudi or GCC data residency

If your procurement requires any of these, tell us what you need: it shapes what we build, and we will not claim a control before it exists.

Policies and contact

• Privacy Policy
• Terms
• AI Methodology
• Cookie settings