Cloud & DevOps Company in Jeddah

A Jeddah cloud number is driven by residency obligations before anything else: a scoped cloud landing-zone design and IaC bootstrap at Jeddah rates, a production cloud migration with refactor (legacy on-prem to Saudi-resident cloud-native, including SAMA Cloud Computing Regulatory Framework notification packs where applicable), or a multi-cloud platform programme (AWS plus Azure plus OCI Jeddah, with sovereign overflow). Scope drivers include AWS me-central-1 or me-south-1 multi-account topology, NCA ECC and CCC control mappings, identity federation, baseline guardrails, a CI/CD blueprint, IaC, container platform, observability, SIEM integration, and DR. Quotes itemise SAR with VAT shown separately, and we offer fixed-fee work rather than open-ended time and materials. Jeddah rates sit above Chandigarh and Edmonton because of Saudi regulatory scope, native Arabic documentation, NCA-aligned engineering, and the AWS me-central-1 and Oracle Cloud Jeddah premium over US regions.

The Saudi Personal Data Protection Law came into force in September 2023, with implementing regulations finalised in 2024 that materially tightened cross-border transfer rules and clarified controller and processor obligations. For cloud architecture this matters in four places. First, personal data of Saudi residents should default to Kingdom-resident infrastructure (me-central-1, Azure Saudi Arabia, OCI Jeddah, sovereign CCSEZ operators) unless cross-border has explicit cover under the SDAIA-approved transfer mechanisms. Second, controllers must register processing activities and appoint a DPO for high-volume or sensitive processing; landing zones must support that registration mapping with tag-driven data inventories. Third, data subject rights (access, correction, deletion, portability) require cloud-native tooling — typically Amazon Macie, Azure Purview, OCI Data Safe, plus custom orchestration. Fourth, breach notification timelines (72 hours to SDAIA, prompt notification to affected data subjects) require SIEM integration and a runbook tested against the client's incident-response process. Our discovery produces a PDPL mapping per workload, a data-classification matrix, and a transfer-impact assessment where cross-border flows are unavoidable.

NCA Cloud Cybersecurity Controls CCC-1:2020 sit on top of the Essential Cybersecurity Controls ECC-1:2018 and apply to any Saudi government entity, NCA-regulated organisation, or third-party cloud service provider supporting them. The 37 main controls span cloud governance, defining cloud strategy, third-party cloud-service-provider assessment (including Saudi-residency requirements for sensitive data), encryption and key management with customer-managed keys, identity and access management with strong multi-factor enforcement, logging and continuous monitoring routed to NCA-aligned SIEM, incident response with NCA reporting timelines, business continuity, and physical-security expectations on the cloud provider's data centres inside the Kingdom. For Critical Systems Cybersecurity Controls (CSCC), additional Tier 1 obligations apply including data residency strictly inside the Kingdom, on-prem or sovereign-cloud deployment for highest classifications, and air-gapped backup. Our cloud builds ship with a CCC control-mapping spreadsheet, evidence artefacts (Terraform modules, SCPs, Azure policies, OCI tag rules), and a quarterly review cadence that survives NCA inspection.

Yes. SAMA's Cloud Computing Regulatory Framework requires SAMA-regulated entities (banks, insurance companies, finance companies, money exchangers, payment service providers) to assess cloud workloads against a four-tier sensitivity model, obtain SAMA non-objection or notification depending on tier, and meet a defined control baseline aligned with the SAMA Cyber Security Framework v1.0. We have shipped cloud platforms for Jeddah-headquartered and Jeddah-operating banks under that framework. Discovery produces a SAMA sensitivity-tier classification per workload, a control-baseline mapping, the non-objection or notification pack the client submits to SAMA, and a residency decision (Saudi-resident cloud for Tier 3 and 4, regional MENA acceptable for Tier 1 and 2 with controls). Build delivers Saudi-resident landing zones (me-central-1, Azure Saudi Arabia, OCI Jeddah), customer-managed encryption keys, full SIEM integration with SAMA-aligned reporting, and runbooks the client's SAMA examiners and internal audit team can defend without rewrite.

ZATCA e-invoicing Phase 2 (Integration Phase, ongoing since 2023 in rolling waves by VAT-registered turnover thresholds) requires Saudi VAT-registered businesses to issue cryptographically signed XML invoices that integrate in real time with the Fatoora platform for B2B and clearance-model invoicing, with a QR code on B2C simplified invoices. For cloud-native stacks we typically build a dedicated invoicing microservice on the client's primary cloud (me-central-1, Azure Saudi Arabia, OCI Jeddah) that handles UBL 2.1 invoice generation, XAdES digital signatures using ZATCA-issued cryptographic stamp identifiers, real-time submission to Fatoora APIs, response handling and retry logic, archival in tamper-evident storage for the seven-year retention period, and reconciliation with ERPs (SAP, Oracle, Priority, Sage, Microsoft Dynamics, Odoo, NetSuite). The service ships with idempotency keys, exactly-once delivery semantics, observability on Fatoora response codes, and a fallback path for ZATCA outages. We have integrated against SAP, Oracle Fusion, NetSuite, Microsoft Dynamics 365, and bespoke ERPs in Jeddah retail and trading environments.

Five credible Saudi-resident or sovereign options exist. AWS me-central-1 (Riyadh, GA August 2024) is the newest and fullest-featured AWS region inside the Kingdom, with Bedrock support and full general-purpose services. AWS me-south-1 (Bahrain, 2019) remains relevant for workloads where regional MENA latency suffices and SAMA or NCA classification permits cross-border to a neighbouring GCC jurisdiction with adequacy controls. Azure Saudi Arabia (Riyadh region) launched as part of Microsoft's USD 2.1B Kingdom investment and offers Azure OpenAI Service in-region with full Azure stack availability. Oracle Cloud Infrastructure operates three regions inside Saudi Arabia — Jeddah (one of OCI's earliest MENA regions), Riyadh, and Dammam (Neom-region) — which is unmatched coverage for Oracle E-Business Suite, Fusion, NetSuite, and Exadata workloads typical of Jeddah family-conglomerate ERP estates. Sovereign Saudi Cloud Computing Special Economic Zone operators provide the highest classification residency for NCA CSCC Tier 1 critical systems and air-gapped or on-prem deployment for the strictest sensitivity tiers. The choice depends on regulator expectations, latency, and total cost, modelled during discovery.

A typical Jeddah cloud migration runs eighteen to thirty weeks from kickoff to production cutover. Week 1 to 4 is discovery, Saudi regulatory mapping (PDPL, NCA ECC and CCC, NCA CSCC if critical, SAMA Cyber Security Framework and Cloud Computing Regulatory Framework if regulated finance, ZATCA if VAT-invoicing, CITC if telco-adjacent, SDAIA if AI in scope), data classification, residency decision (me-central-1, me-south-1, Azure Saudi Arabia, OCI Jeddah, sovereign CCSEZ), landing-zone design, and a CI/CD blueprint. Week 5 to 12 is foundation: IaC delivery, identity federation, network segmentation, baseline guardrails, observability stack, SIEM integration with NCA-aligned reporting. Week 13 to 22 is migration: workloads moved in waves (database, application, integration, edge), each with a rollback plan and a SAMA notification or non-objection pack where applicable. Week 23 onward is steady-state operations handover, run-book finalisation, DR exercise, NCA-aligned tabletop, and quarterly review cadence. Critical-systems work under NCA CSCC Tier 1 adds four to six weeks for additional controls and air-gapped backup.

Yes. We have integrated cloud platforms with SAP ECC, S/4HANA, Oracle E-Business Suite, Oracle Fusion, NetSuite, Microsoft Dynamics 365, Priority Software (popular in Saudi trading and manufacturing), Odoo, and Sage X3 typical of Jeddah family-conglomerate ERP estates. Core banking integrations cover Temenos T24 and Transact, Finacle, Oracle FLEXCUBE, Path Solutions iMAL, and ICS BANKS used across Saudi National Bank, Bank Al Jazira, Bank AlBilad, Riyad Bank, and Al Rajhi. Maritime and logistics integrations cover terminal-operating systems (Navis N4, TOS+, CATOS), customs Single-Window connectivity (ZATCA Fasah, Saudi Customs), and freight-management platforms. Healthcare integrations cover Epic, Cerner, InterSystems, ELLKAY, and the Saudi MOH eHealth standards. Identity federation supports Azure AD, Okta, Auth0, Active Directory, Nafath (Saudi national identity), and SAMA-approved enterprise SSO. Audit logs capture every infrastructure and data-plane action against authenticated identities, suitable for NCA, SAMA, ZATCA, or CITC review.