FeaturesSecurityPricingCompareDevelopersBlogStart Free

GCC

Six countries, five regulators, and three currencies with a third decimal.

A Gulf deal is not a Western deal with different names on the signature page. The documents are bilingual, the dinars carry three decimals, the dates come on two calendars, and the first question in the security review is where the data sits. Here is each of those, answered.

Start FreeThe Four Questions

The third decimal

The Kuwaiti dinar, the Bahraini dinar and the Omani rial are subdivided into a thousand, not a hundred. A price of 3.750 KWD is not the same number as 3.75, and a viewer that rounds every currency cell to two decimals will hand a buyer a model that no longer reconciles. It is a quiet failure. Nothing errors, the totals just stop matching the source.

Minor units are the ISO 4217 exponents. The hex in each format token is the Windows locale id for Arabic in that country, which is how Excel tags a locale-aware currency.
CriterionCurrencyMinor unitsLocale-tagged format
KuwaitKWD3[$KWD-3401] #,##0.000
BahrainBHD3[$BHD-3C01] #,##0.000
OmanOMR3[$OMR-2001] #,##0.000
Saudi ArabiaSAR2[$SAR-401] #,##0.00
United Arab EmiratesAED2[$AED-3801] #,##0.00
QatarQAR2[$QAR-4001] #,##0.00
Minor units are the ISO 4217 exponents. The hex in each format token is the Windows locale id for Arabic in that country, which is how Excel tags a locale-aware currency.

Five of the six are pegged to the US dollar, which is why a UAE model and a Qatari model behave like dollar models under sensitivity. Kuwait is pegged to a basket, so a KWD line item carries an FX assumption the others do not. Whether the model says so is the buyer's problem. Whether the number renders with its third decimal is ours. We take the decimal count and the currency literal from the format token rather than from a default, which is not a given: the currency symbol used to be hardcoded to a dollar sign here, so a cell formatted #,##0 "SAR" lost its currency entirely and displayed as a bare number.

The documents are bilingual and the calendar is not one calendar

A Gulf information memorandum is in English. The trade licence, the memorandum of association, the board resolutions and the audited statements filed locally are in Arabic, often dated on the Umm al-Qura calendar. Both sets go into the same room and both have to be readable by a partner who reads only one of the two languages.

Excel encodes the calendar inside the number format, either as the B2 prefix or packed into a locale token such as [$-060401]. We resolve the calendar id and render Umm al-Qura. The widely used ssf engine approximates it with a year offset: run 5 January 2025 through ssf@0.11.2 with B2dd/mm/yyyy and it returns 05/01/1444 where the Umm al-Qura date is 05/07/1446. The month and the year are both wrong. On a facility maturity schedule that is a two-year error nobody is looking for. The full rendering table is on the Saudi Arabia page.

The four questions in a Gulf security review

Diligence questionnaires from Gulf banks, family offices and sovereign-linked buyers have converged on the same short list. Every answer below is checkable without talking to us.

The four questions we are asked most often by Gulf counterparties, and where each answer can be verified.
CriterionOur answerWhere you can check it
Where does the data sit?United States for the database, object storage and application hosting. Germany for transient document processing. No Gulf region.Trust Center subprocessor table
Who else touches it?Nine named subprocessors, each with its purpose and country. AI inference and embeddings are US providers, and the Trust Center states zero retention and no training on your data.Trust Center subprocessor table
Can a bidder see another bidder's file?The filter runs inside the SQL query on tenant id and a per-participant access function, so a chunk outside a bidder's permission is never selected. Structural, asserted against pg_proc.prosrc in CI.Ask for the test; run it in your own room
Can you prove who saw what?Every view is written to a SHA-256 hash-chained audit log whose integrity is verified on a schedule, and each viewed page carries a burned-in watermark with participant name, email, IP and timestamp.Export the log from your own room
The four questions we are asked most often by Gulf counterparties, and where each answer can be verified.

How a bilingual room actually runs

  1. Upload
    Arabic filings and English deal documents into one room
  2. Fence
    Per-participant permissions resolved on the server, not the browser
  3. Ask
    Q&A threads and AI questions in either language
  4. Verify
    Answer cites the page or the cell range; tapping it opens the source
A bilingual Gulf diligence, from a locally filed Arabic document to a cited answer a non-Arabic reader can verify.

Citations are rendered as Q3_Model.xlsx · Revenue!B14:F34, with absolute 1-based sheet rows and column ranges. Tapping one opens the workbook at that sheet and washes those cells. For a bilingual room this is the whole point: a reader who does not read Arabic does not have to trust the answer, because they can see the cell the answer came from.

100%
KSA number formats, display strings, merges and alignment
Scored against LibreOffice ground truth, four producer dialects
Streaming
Purpose-built OOXML parser. The maintained libraries either drop cell styles in streaming mode or hold the whole workbook in memory to keep them.
infrastructure/hetzner/worker/src/xlsx-model/
11.7%
Watermark ink surviving the worst of 64 crops at 25%, all four fields legible
Watermark crop study; survives JPEG q50 and a 50% downscale

What it costs, and what we will not sell you

Flat published plans: a free tier, Teams at $399 a month, Pro at $999 a month, custom Enterprise. AI is included in every paid tier rather than sold as an add-on, and there are no per-page fees, which is the model that makes a document-heavy Gulf diligence unpredictable elsewhere. The 14-day trial takes no credit card, and the price-lock commitment means no surprise mid-contract increase with 90 days notice for any change. See pricing for the Founding 10 terms, which include moving your documents, folder structure and permission setup out of your current data room at no charge.

What we will not sell you is an in-region deployment, a certification badge, or a residency guarantee. If a mandate turns on any of those, buy from someone who has them. The residency and compliance page sets out the full position, and the MENA page covers cross-border deals that reach beyond the Gulf.

GCC FAQ

What Gulf counterparties ask before they upload anything.

No. There is no Gulf region today. The primary database, object storage and application hosting run in the United States, and document processing is transient in Germany. Every subprocessor and its country is published on our Trust Center. If your mandate requires data to stay inside the UAE, Qatar or Saudi Arabia, we do not meet it, and you should know that before a security review rather than during one.
The Kuwaiti dinar, the Bahraini dinar and the Omani rial are subdivided into 1,000 rather than 100, so their number formats carry three decimal places. A viewer that assumes two silently drops a digit on every line of a model. We render the decimal count the file specifies rather than a default, and the currency literal is taken from the format token rather than hardcoded, which was a real bug here: currency used to be hardcoded to a dollar sign, so both a quoted SAR suffix and a locale-tagged riyal fell through to a bare number. One caveat worth having in writing: the committed fidelity fixtures cover Saudi number formats, not KWD, BHD or OMR specifically, so test a dinar model of your own during the trial rather than taking this answer on trust.
Sheet direction and cell reading order are both read from the file. A sheet flagged right-to-left renders with column A at the right edge and frozen panes pinned right, and the horizontal scroll offset, which runs negative in that mode, is sign-normalised so the grid does not tear mid-scroll. A mixed workbook keeps both directions on the same sheet.
Yes, on the Umm al-Qura calendar, resolved from the calendar id inside the Excel number format rather than approximated. Run 5 January 2025 through ssf 0.11.2, the format engine SheetJS ships, with the format B2dd/mm/yyyy and it returns 05/01/1444. The Umm al-Qura date is 05/07/1446. Our fidelity suite fails the build if that cell drifts.
No. We hold no certification or attestation under any Gulf data protection regime, and no SOC 2 certification either. This page is not legal advice and we are not your counsel. What we can tell you precisely is where each byte sits, which subprocessor touches it, and that every view is written to a hash-chained audit log you can export.
That is the normal case in a Gulf sell side and it is what the permission model is built for. Retrieval for the AI runs inside the SQL query, filtered on tenant id and a per-participant document access function, rather than after retrieval or as an instruction in the prompt. A chunk outside a bidder's permission is therefore never selected. That exclusion is structural, and CI asserts it against the deployed function's source in pg_proc.prosrc on every push, with a denial suite that counts only SQLSTATE 42501 as a pass. The measured half is the failure that prompted the lockdown: before July 2026 an unrelated signed-in user retrieved 30 chunks across 13 documents of verbatim deal text, because the caller controlled the participant identifier the filter was checking.

Open A Room

Put a three-decimal dinar model in front of it.

Upload the workbook with the KWD schedule and the Arabic trade licence. If the numbers reconcile and the Hijri dates are right, you have learned more in ten minutes than a vendor call will tell you.

Start FreeSee Pricing

Free to start · No per-page fees · No credit card required

Start Free