Where the plaintext lives when AI reads your files

Ask anyone who runs systems with confidential data whether their files are encrypted and the answer comes quickly. At rest, yes. In transit, yes. Ask where the file exists in the clear when an AI model reads it and the room goes quiet, because the honest answer is: at the model. It has to. A model cannot summarise ciphertext.

We have met this shape before. In a backup pipeline, encryption at rest and encryption in transit are two controls at two different layers, and the backup agent sits between them. It reads through the filesystem, which decrypts for anything with permission, and encrypts again for the destination. For the length of the job the plaintext sits on a host chosen for throughput rather than for trust. The audit checks both ends, finds them encrypted, and never asks about the middle.

AI inference is the same seam, only wider. The connection to the provider is encrypted. The provider's storage may well be encrypted too. In between, the full text of your file sits in memory on a machine you do not run, read by a system whose logs, retention and staff you know only from a policy page. Every name, ID number and diagnosis in that file was readable there, for as long as the request took and for however long anything downstream kept it.

Take a small, ordinary task. A clinic nurse wants an appointment reminder drafted for a patient, in English and Arabic. The note she pastes in reads something like this, and the patient is made up: Fatima Al-Harbi, born 14/03/1961, ID 1098765432, phone +966 55 123 4567, 221 Olaya Main Street, Riyadh, type 2 diabetes, starting insulin next week, to see Dr. Khalid Mansour on Sunday at 10:00.

Now ask what the model needs to write a good reminder. It needs to know there is a patient, a doctor, a time, and that she should bring her readings. It does not need her name. It does not need her ID number, her phone, her street or the year she was born. None of those change a sentence of the draft. They are there because they were in the note, and the note was pasted whole.

That gap, between what a task needs and what it receives, is where most of the exposure sits. Encryption cannot close it. Encryption keeps data from people who should not read it, and the model is supposed to read it. What can be controlled is what it is given.

Saudi law already thinks in these terms. Article 29 of the Personal Data Protection Law sets conditions for sending personal data outside the Kingdom, and one of them is that the transfer is limited to the minimum personal data needed. SDAIA's Regulation on Personal Data Transfer Outside the Kingdom, version 2.0 of August 2024, goes further in Article 7: where a transfer risk assessment is required, it must describe "the measures used to ensure that the transfer or disclosure of personal data to a party outside the Kingdom is limited to the minimum amount of data required to achieve the intended purposes". The same Regulation lists cases where a controller can be exempt from that condition under safeguards such as standard contractual clauses, so this is not a rule that every transfer must be stripped bare, and it concerns transfers abroad, not a model running inside the Kingdom. It is a plain statement of the habit regulators expect. Send what the job needs, and be able to show it.

That habit is what NOAI+ is built on. It joins two Silent Key Technologies products. NOAI for Business is an open source privacy gateway that runs on the company's own machine, between staff and the model. Kontra+ is our contract intelligence service for Gulf construction. Staff send their request through the gateway. Before anything leaves, it swaps names, ID numbers, phones, emails, IBANs, card numbers, addresses, full dates of birth and a list of medical terms for placeholders. The model writes around them. As the answer streams back, the gateway puts the real values in before anyone reads it.

Run the nurse's note through the gateway as the public code stands today and eight values are hidden: two names, the birth date, the ID, the phone, the address, and two medical terms, diabetes and insulin. What the model receives begins: "Draft a short, friendly appointment reminder for our patient [PERSON_1], born [DOB_1], ID [ID_1], phone [PHONE_1]." The reminder comes back with Fatima's name in it. The model never had it.

Each call also leaves a receipt, signed and chained to the one before it, recording who sent it, how many values of each kind were hidden, and a SHA-256 hash of the exact bytes that went out. An administrator can open it and read precisely what the model received. That record matters as much as the hiding. "We minimise what we send" is a policy. A copy of each request as it was sent is evidence.

The limits deserve the same plain statement, because a privacy tool that hides its own gaps is not one. NOAI+ hides what it recognises and nothing more. In that same note, "type 2" and "glucose readings" go through as written, and a condition that is not on the list is sent. In a contract clause the gateway hides the signatory, his ID, his phone and the bank account, but today the two company names still go as written. Teaching it to hide contract parties is the first job of our build week. Hiding names does not make the text anonymous either. A rare condition, a small town and a date can point at one person without a name in sight. The gateway does not make anyone compliant with anything. And a receipt proves what left the gateway. It cannot prove what the provider did with it afterwards.

So the seam is narrowed, not closed. The content still reaches the model, because the content is the work. What changes is whose it is.

That is what we mean by Truly Yours. The file is read. The identity stays with the person it belongs to.

The remaining question is the machine the model runs on, and that one has a practical answer. An open model served with vLLM can run on hardware a company chooses, with the gateway as the only way in. From 12 to 18 October Silent Key Technologies is entering the AMD Developer Hackathon ACT III with NOAI+, built to run an open model on AMD Instinct GPUs with vLLM behind the gateway. The plan for that week is to measure, on made-up patient files and contracts with an answer key, how many private values are hidden, how many still reach the model, and how long each file takes.

For anyone already putting confidential documents in front of a model: have you looked at what the model actually received, byte for byte, or only at what the policy says it should?

Silent Key Technologies, Riyadh. silentkeytechnologies.com

NOAI gateway source, Apache 2.0: github.com/SilentKeyTech/noai

Also from Silent Key: SilentSpace, SilentBOX, BurnKey, ModeGuard, TagTitan, SwiftPOD, Fontbench. Kontra Plus, kontraplus.com.

Sources

1. Saudi Data and AI Authority (SDAIA), Regulation on Personal Data Transfer Outside the Kingdom, Version 2.0, August 2024, Articles 4 and 7 (official PDF, opened 7 Oct 2026): https://dgp.sdaia.gov.sa/wps/wcm/connect/e5bbede0-1119-4f70-b4ef-f043ce58d780/Regulation+on+Personal+Data+Transfer+Outside+the+Kingdom..pdf?MOD=AJPERES

2. Personal Data Protection Law, Royal Decree M/19 of 9/2/1443 AH, Article 29, paragraph 2 (b) and (c): conditions of an appropriate level of protection and the minimum transfer of personal data, as referenced by the Regulation above, Article 4. SDAIA knowledge centre: https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/regulations

3. NOAI public repository, README and src/redact.ts on main at commit 71c2ed7 (6 Oct 2026): https://github.com/SilentKeyTech/noai

4. The eight hidden values: redact() from src/redact.ts at 71c2ed7, run on the made-up patient note on 7 Oct 2026. Output counts PERSON 2, MEDICAL 2, DOB 1, ID 1, PHONE 1, ADDRESS 1. The contract clause: PERSON 1, ID 1, PHONE 1, IBAN 1, with both company names left as written.

5. Kontra+: https://kontraplus.com

6. AMD Developer Hackathon ACT III, 12 to 18 October 2026: https://lablab.ai/ai-hackathons/amd-developer-hackathon-act-iii

7. Gemma with vLLM on AMD Instinct MI300X, AMD ROCm blog: https://rocm.blogs.amd.com/artificial-intelligence/deployingGemma-vllm/README.html