Cloud & DevOps Company in Manama

There are two shapes of Manama cloud engagement and they cost very differently: a scoped cloud landing-zone design and IaC bootstrap at Manama rates, or a production cloud migration with refactor (legacy on-prem to Bahrain-resident cloud-native, including CBB Rulebook Volume 6 non-objection or notification packs where applicable). Scope drivers include AWS me-south-1 multi-account topology, CBB and iGA control mappings, identity federation, baseline guardrails, and a CI/CD blueprint. Quotes itemise BHD with VAT shown separately, and we offer fixed-fee work rather than open-ended time and materials. Manama rates sit above Chandigarh and Edmonton because of in-region delivery from Dubai, Arabic documentation, CBB-aligned engineering, and the me-south-1 premium over US regions. Investcorp-style alternative-asset-manager work attracts a senior-team rate uplift.

CBB Rulebook Volume 6 Module OM (Outsourcing) governs how Bahraini retail and wholesale banks, Islamic banks, and other CBB-licensed entities can outsource activities, including cloud computing. Material outsourcing requires CBB non-objection before commitment; non-material outsourcing requires notification with prescribed information. Cloud-specific expectations include data-residency considerations (Bahrain-resident or GCC-resident depending on sensitivity), the licensee's right to audit the cloud provider, business-continuity arrangements, exit strategy, sub-outsourcing controls, encryption at rest and in transit with customer-managed keys for sensitive data, and incident-notification timelines codified in the CBB Cyber Security Risk Management Module. Our cloud builds for CBB-licensed clients ship with a materiality assessment per workload, the non-objection or notification pack the client submits to CBB, a residency decision aligned with the materiality tier, customer-managed encryption keys, a CBB-aligned audit log architecture, and an exit-strategy runbook tested in tabletop exercises. We have shipped to this pattern for Manama banks and one Bahrain Islamic-finance institution.

Bahrain's Personal Data Protection Law Law 30 of 2018 was one of the GCC's earliest comprehensive data-protection statutes and gives the Personal Data Protection Authority (PDPA) enforcement teeth. For cloud workloads it matters in four places. First, consent and lawful basis must be documented per processing purpose; landing zones must support that mapping with tag-driven data inventories. Second, cross-border transfer of personal data is permitted only to jurisdictions with adequate protection or under approved safeguards, and the PDPA maintains a list — for cloud workloads this typically means me-south-1 (Bahrain) is straightforward, GCC and adequacy-listed jurisdictions are workable, and US or non-listed jurisdictions need transfer-impact assessments and contractual safeguards. Third, data-subject rights (access, correction, deletion, portability, objection) require cloud-native tooling, typically Amazon Macie, Azure Purview, or custom orchestration. Fourth, breach notification to the PDPA and affected data subjects has prescribed timelines and requires SIEM integration plus a tested incident-response runbook. Our cloud builds produce a PDPL mapping per workload, a data-classification matrix, and a transfer-impact assessment where cross-border flows remain.

Yes. Islamic-finance cloud platforms — Sharia-compliant core banking, Murabaha and Sukuk product platforms, Mudarabah investment pools, Takaful insurance stacks — ship with AAOIFI-aligned controls baked into the architecture rather than reviewed at the end. Discovery includes a Sharia Supervisory Board engagement plan, a product-taxonomy mapping (Murabaha, Mudarabah, Musharakah, Ijara, Sukuk, Wakala, Salam, Istisna), and an AAOIFI Financial Accounting Standards (FAS) mapping for the products in scope. Build delivers a Sharia-screen layer in any AI or LLM components (if generative AI is exposed to retail customers), a Sharia-audit-trail logging architecture that records every product-classification decision and any deviation, a Sharia-compliant cloud-services-procurement policy aligned with AAOIFI Governance Standard 5 on independence of the Sharia Supervisory Board, and quarterly reports to the SSB. We have run this pattern with KFH Bahrain-adjacent work, Bahrain Islamic Bank-style engagements, and CBB-regulated Islamic-finance fintechs in the Bahrain FinTech Bay sandbox.

Three reasons. First, me-south-1 was the first AWS region in the Middle East (GA July 2019) so a disproportionate share of MENA workloads — from Saudi banks pre-me-central-1, UAE clients pre-me-central-1, and Bahraini regulated entities — terminate in Bahrain by default, and migration to a different region is a project, not a free lunch. Second, Bahrain's iGA Cloud-First Policy and CBB Rulebook Volume 6 explicitly recognise me-south-1 as a Bahrain-resident option for CBB-licensed entities, with documented audit and inspection rights. Third, latency: Bahrain sits geographically central to Saudi Arabia's Eastern Province (where Aramco, SABIC Jubail, and major industrial clusters operate), Qatar, the eastern UAE, and Kuwait, which makes me-south-1 a strong choice for multi-country GCC platforms even when Dubai me-central-1 or Riyadh me-central-1 might be closer to a single client's HQ. We default to me-south-1 for new Bahrain builds and recommend multi-region (me-south-1 plus me-central-1 Riyadh or me-central-1 Dubai) for clients with cross-GCC traffic profiles.

Bahrain's iGA (Information and eGovernment Authority) runs the National Authentication Framework (Bahrain.bh national identity federation), the National Suite of digital-government services, the Government Data Network, and the Sijilat commercial-registry integrations. Our cloud platforms integrate with these where the client's use case requires national identity verification (KYC for fintechs, customer onboarding for banks, government-to-business platforms), commercial-registry validation, or eGovernment payment-rails connectivity. Identity federation typically uses SAML 2.0 or OpenID Connect against the National Authentication Framework, with role-mapping into the client's IAM (Azure AD, Okta, Auth0, AWS IAM Identity Center). Sijilat integration validates commercial-registry numbers against the iGA dataset with retry logic and observability. Government Data Network connectivity, where available to private-sector partners, runs through approved encrypted tunnels with iGA-approved cipher suites. Audit logs capture every cross-platform action against authenticated identities, suitable for iGA, CBB, or PDPA review.

A typical Manama cloud migration runs sixteen to twenty-six weeks from kickoff to production cutover. Week 1 to 4 is discovery, Bahraini regulatory mapping (CBB Rulebook Volume 6 outsourcing rules and Cyber Security Risk Management Module, iGA Cloud-First Policy and data classification, PDPL Law 30 of 2018, CRA cybersecurity regulation if telco-adjacent, AAOIFI if Islamic finance, National Cybersecurity Strategy alignment), data classification, residency decision (me-south-1 default, hybrid on-prem for highest sensitivity), landing-zone design, and a CI/CD blueprint. Week 5 to 10 is foundation: IaC delivery, identity federation with iGA National Authentication Framework or enterprise SSO, network segmentation, baseline guardrails, observability stack, SIEM integration with CBB-aligned reporting. Week 11 to 20 is migration: workloads moved in waves with rollback plans and CBB non-objection or notification packs where applicable. Week 21 onward is steady-state operations handover, run-book finalisation, DR exercise, CBB-aligned tabletop. Islamic-finance work under AAOIFI alignment adds two to four weeks for Sharia Supervisory Board engagement and audit-trail layer.

Yes. We have integrated cloud platforms with SAP ECC, S/4HANA, Oracle E-Business Suite, Oracle Fusion, NetSuite, Microsoft Dynamics 365, and Sage typical of Bahraini banking, asset-management, and trading estates. Core banking integrations cover Temenos T24 and Transact, Finacle, Oracle FLEXCUBE, Path Solutions iMAL (popular in Islamic finance), and ICS BANKS used across GIB, Bank ABC, AUB, KFH Bahrain, NBB, BBK, and Bahrain Islamic Bank. Asset-management integrations cover SimCorp Dimension, BlackRock Aladdin, and Investcorp's bespoke deal-management stack patterns. Telco integrations cover Amdocs, Ericsson, and Huawei BSS-OSS stacks used at Batelco, STC Bahrain, and Zain Bahrain. Identity federation supports Azure AD, Okta, Auth0, Active Directory, iGA National Authentication Framework, and CBB-approved enterprise SSO. Audit logs capture every infrastructure and data-plane action against authenticated identities, suitable for CBB, iGA, PDPA, or CRA review. Where Islamic-finance products are exposed, additional Sharia-audit-trail logging routes to the client's Sharia Supervisory Board reporting pipeline.