Saudi-sovereign GRC

Governance, Risk & Compliance, built for the Kingdom.

Imtithal is the GRC platform built for Saudi Arabia — SAMA CSF, NCA ECC and PDPL native, Arabic-first, with every customer's data in its own isolated, encrypted database.

SAMA CSF NCA ECC PDPL ISO 27001-aligned Isolated per-tenant data

Executive Overview

Live
Risk over appetite
29
13 breach plans
Net loss exposure
660K
recovered 760K
Clause coverage
65%
1,677 clauses
Critical action plans
16
30 high · live
AI assistant
Data, isolated & encrypted
Built for Saudi financial services & regulated enterprises SAMA CSFNCA ECCPDPLISO 27001NIST CSF
The platform

One platform, six disciplines

Everything a Saudi risk and compliance team runs — in one clean, connected core.

Risk Management

Registers, appetite, residual scoring and treatment plans linked straight into workflow.

Compliance

Authority documents, control objectives, clause-level mapping and a 27-step control lifecycle.

Audit & Findings

Engagements, findings and remediation tracked to closure with a full evidence trail.

Workflow & Approvals

Maker-checker, separation of duties, timed escalation and manager-chain routing — enforced, not optional.

Evidence & Attestation

A fingerprinted evidence library, requests, attestation campaigns and policy acknowledgement.

AI Assistant

Ask across every module in Arabic or English. Runs in an isolated, encrypted environment — your prompts stay private to your tenant.

How it fits together

One connected compliance lifecycle

Regulations flow into controls, controls into testing, a failed test into an issue, and everything into reporting — with risk feeding remediation and AI assisting at every step. Nothing is a silo.

Workflow-enforced · maker-checker · separation of duties · timed escalation Regulations14 live Controls1,677 clauses Testingscheduled · auto Issuesauto from fail Remediationchampion + reviewer Reportinglive dashboards Evidence libraryfingerprinted · requests Risk registerappetite · residual · treatment ✦ Imtithal AI assists at every step — drafts, summaries, action plans — always human-approved
Workflow-enforced AI-assisted, human-approved Feeds the pipeline (risk & evidence)
Imtithal AI

Ask your GRC anything — watch it answer

The assistant reads across risk, compliance, evidence and workflow, streams a cited answer, and drafts the action — but never acts without your approval.

Imtithal AIreads across every module
streaming
You
Imtithal AI
Isolated by design

Your data is isolated, encrypted, and yours alone

Isolated per-customer database

Every customer's data lives in its own encrypted database on Google Cloud. Isolation isn't a setting — it's the architecture.

A database per customer

Every tenant gets its own isolated database and role. The database server itself refuses cross-tenant access.

AI that stays in your control

The assistant runs in an isolated, encrypted environment, and enterprises can self-host it so prompts never leave their own network.

Isolated tenant databases

One cluster. Isolated tenants.

Shared platform, private data — enforced by the database, not by app code.

grc_freelancer_alifreelancer tenant
🔒 isolated
grc_student_sarastudent sandbox
🔒 isolated
grc_bank_enterprisededicated environment
🔒 dedicated
Who it's for

From your first control to a bank's risk floor

Students

Learn GRC hands-on

A free sandbox with real regulatory content and sample data to build the skills employers want.

Freelancers

Run client GRC solo

The full platform in a single seat — registers, controls, evidence and the AI assistant.

Enterprises

Banks & regulated firms

A dedicated, isolated environment with SSO, the full workflow engine and priority support.

Pricing

Simple, honest pricing

Start small, grow when you're ready. Prices in SAR, VAT included.

Student
Learn the craft in a real sandbox.
SAR 50/ month
Verified edu email · billed monthly
  • 1 seat, sandbox workspace
  • Regulatory library & sample data
  • AI assistant (capped)
  • Multi-user workflow
Get started
Most popular
Freelancer
The full platform, one seat.
SAR 70/ month
billed monthly
  • Everything in Student, plus:
  • Full Risk, Compliance & Evidence
  • Your own isolated database
  • AI assistant, metered
  • Apple Pay & mada
Get started
Enterprise
Dedicated, isolated, and yours.
Custom
Annual contract · invoiced (ZATCA)
  • Dedicated, isolated environment
  • Unlimited seats · SSO / SCIM
  • Full workflow & SoD engine
  • Self-hosted AI option · priority support
Talk to sales
Pay how the Kingdom pays: Apple PaymadaVisa · MastercardZATCA e-invoice
All prices include 15% VAT. Your ZATCA e-invoice breaks it out.
FAQ

Questions, answered

Where is my data stored?+
In its own isolated database, encrypted in transit and at rest on Google Cloud. The database server itself refuses any cross-tenant access, in line with PDPL.
Is my data used to train AI?+
No. The assistant runs in an isolated, encrypted environment and your content is never used for training. Enterprises can self-host the model so prompts never leave their own network.
How do I pay?+
Apple Pay, mada or card for Student and Freelancer plans. Enterprises are invoiced annually with ZATCA-compliant e-invoices.
Do you support Arabic?+
Yes — Imtithal is Arabic-first and fully bilingual. Switch the whole interface between العربية and English at any time.
Which regulations are covered?+
Imtithal is built around SAMA CSF, NCA ECC and PDPL, and maps to frameworks like ISO 27001 and NIST CSF — with clause-level control mapping.

Bring your compliance into one isolated, encrypted platform

Get started in minutes, or talk to us about a dedicated environment for your bank.