AI
Security
Last updated: 25 October 2026
This page describes security at the company level: how the oai.sa website is run and how to report a vulnerability to us. The security of the Rushd platform itself is documented separately on the Rushd Security page.
1. The company website
oai.sa is an informational site served over TLS, with its core hosting (compute, database and files) on Saudi-based cloud infrastructure inside the Kingdom. It has no user accounts of its own and holds no case or client data; the Rushd sign-up at oai.sa/rushd/register opens an account on the Rushd platform, which section 2 covers. Apart from that sign-up and the technical details every web request carries (such as IP address and browser type), which our hosting records in its request logs, the personal information that reaches us through the site is what a visitor chooses to send in the contact form, in Blue's Help card on the home page, in the demo request on the Rushd page, in the call-back field under the headline or in the newsletter sign-up form. The first four are forwarded by email to our team inbox (info@oai.sa), and none of them is saved in a database of the website. A newsletter subscription is kept in our own database and the newsletter is sent through Resend in the United States, as section 7 of the Privacy Policy describes. The site keeps a few small items in your browser — among them a language preference, a theme preference, your answer to the analytics banner, and rate-limit records for the contact form, the Help card, the demo request and the call-back field that count only submissions from the past hour — and the Cookie Policy lists every one. There are no advertising cookies; Google Analytics 4 runs only if you allow it in the banner, as the Cookie Policy describes.
2. The Rushd platform
Product security is documented with the product. The Rushd Security page sets out the platform's infrastructure, encryption, access controls, audit logging and the rules governing staff access to customer data; firms evaluating Rushd should rely on that page.
3. Reporting a vulnerability
If you believe you have found a security flaw in the website, in Rushd or in any system we operate, write to info@oai.sa with enough detail for us to reproduce the issue. Reports of this kind are read outside our normal support hours as well as during them.
4. Good-faith research
We do not take legal action against security research conducted in good faith. Three conditions apply: do not access, alter or delete data that is not yours; do not degrade or disrupt the service for others; and give us reasonable time to fix the issue before disclosing it publicly. Testing that goes beyond these limits is not research — it is prohibited by our Acceptable Use Policy.