Customer story / Insurance
A Saudi insurer launches AI claims summarisation with every prompt processed in-Kingdom
A large insurer in the Kingdom wanted AI summaries of motor and medical claim files. The Saudi PDPL, NCA cloud controls and the insurer's own data classification required personal and restricted data to stay in-Kingdom. YTT Secunet enforces in-Kingdom routing per request and produces the evidence the insurer's cybersecurity function needs.
- Customer
- GCC Sovereign Insurer
- Industry
- Insurance
- Headquarters
- Riyadh, Saudi Arabia
- Gateway
- Sovereign Dedicated
- Policy
- saudi-pdpl-sovereign; uae-pdpl-local
- Zones
- Middle East (GCC)
Results
- 0
- personal or restricted data requests served outside the Kingdom since launch, per receipts
- 9 weeks
- from cybersecurity approval to production for motor claims
- 2
- group entities, Saudi and UAE, on one gateway configuration with separate policies
- -34%
- median handler time to first decision on motor claims, measured by the insurer over the first quarter
Claims handlers at the insurer read long files: police reports, garage estimates, medical invoices and correspondence, in Arabic and English. The operations team estimated that a reliable summary at intake would cut handling time, and a hosted model performed well in early tests. The tests were run on synthetic files because the cybersecurity function would not approve real claim data for any endpoint outside the Kingdom.
The insurer classifies data under NDMO standards and its own policy, and claim files containing national ID numbers, Iqama numbers and health information are classified as restricted. The Saudi PDPL has been enforced since 14 September 2024, and the insurer's legal team did not want to rely on a transfer exception for routine operations. The cybersecurity function also maps cloud services to the NCA Cloud Cybersecurity Controls and wanted evidence of where processing happened, not a contractual statement.
At the same time, the insurer's UAE subsidiary wanted the same feature for its own policyholders, under UAE federal law. The group did not want two separate AI programmes, and it could not allow Saudi data to fail over into the UAE or the reverse.
- 01Integrate
The insurer deployed YTT Secunet Sovereign Dedicated in its in-Kingdom private cloud, with an open-weight model served by vLLM on in-Kingdom GPUs as the default route. Public, non-personal prompts, such as questions against the policy wording library, may use Vertex AI in the Dammam region. The saudi-pdpl-sovereign pack refuses any restricted or personal data on routes outside the Kingdom.
- 02Enforce
The UAE subsidiary uses the same gateway configuration with the uae-pdpl-local pack and UAE endpoints. Each legal entity has its own tenant, and failover rules keep Saudi and UAE traffic in their own countries.
- 03Evidence
Saudi national IDs, Iqama numbers and policy numbers are detected in-path, and the receipt stream is exported to the insurer's SIEM. The cybersecurity function used one quarter of receipts as evidence in its internal NCA controls assessment.
In their words
“Our cybersecurity team approved the project when they saw that restricted data could not leave the Kingdom even if the application asked it to. The receipts went straight into our controls assessment.”
- Sovereign Dedicated (in-Kingdom private cloud)
- vLLM with an open-weight model
- Google Cloud Vertex AI (me-central2) for public prompts
- saudi-pdpl-sovereign and uae-pdpl-local packs
- SIEM receipt export
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.