OCR Studio and Wemik have entered a partnership to protect sensitive customer data across the GCC financial and public sectors.
The companies will explore joint opportunities to support banks, fintech firms, and public-sector organisations in the region in keeping personal information within their own controlled environments and reducing exposure risks.
According to the companies, the need for local data processing extends beyond the initial extraction of information from identity documents. A further risk emerges once employees begin using that customer information in AI-assisted workflows. Cyberhaven's 2026 AI Adoption & Risk Report found that 39.7% of employee interactions with AI tools involve sensitive data.
The partnership is designed to address exposure risk at both of these stages: when data is first obtained, and when it is subsequently used. OCR Studio provides the initial layer by extracting data from identity documents and bank cards used across the GCC. In addition, its technology supports passports, national ID cards, residence permits, driver's licences, visas, and other identity documents issued in more than 250 jurisdictions, operating directly on a user's device or on an on-premises server, within both native mobile applications and browsers.
Wemik extends this protection to the point at which employees work with the extracted information using GenAI tools. The system detects sensitive information directly on the device, including names, ID numbers, IBANs, account details, and other personal and financial data, and replaces it with tokens before any text reaches an AI system. The mapping between the original data and the tokens remains client-side, allowing the original information to be restored once the AI has returned its response.
Compliance and regional context
Jorge Elizalde, Co-Founder and CTO of Wemik, said employees increasingly rely on AI in daily work, creating a new point of exposure for customer information, and that the partnership with OCR Studio is intended to help businesses avoid unnecessary transfers of sensitive data, both during know-your-customer (KYC) processes and in subsequent use of the data collected. It was also added that the two companies share the view that client-side architecture is a necessary approach when handling customers' personal information.
OCR Studio and Wemik also intend to support organisations in meeting data protection requirements across the GCC, including Qatar's Personal Data Privacy Protection Law (PDPPL). Through the process of combining their client-side technologies, the companies aim to give regulated organisations further scope for automation while keeping raw personal and financial information within their own controlled environments, rather than transferring it to third-party or cloud-based systems.
The partnership reflects a broader trend among financial and public-sector institutions in the GCC to reassess how customer data is handled as AI adoption increases, particularly in jurisdictions where data residency and privacy regulation are becoming more defined.
