Cloud & DevOps Company in Riyadh

Where you land depends on which of these you commission: a scoped landing-zone engagement at Riyadh rates, a SAMA-aligned banking cloud landing zone with HSM custody, dual-region failover to me-south-1, full audit-evidence pipelines, and a tested incident-response runbook, or full Aramco-adjacent or HUMAIN-aligned platform builds with sovereign data centres in the mix, OT-to-IT IEC 62443 segregation, and full Saudi-national CCWS workforce planning. Scope drivers include an AWS me-central-2 Dammam multi-account Control Tower setup, NCA ECC control mapping, CCRF tier classification, identity federation against Nafath where applicable, and an SRE-ready Terraform module library. Riyadh rates carry a sovereignty premium because in-Kingdom GPU capacity, NCA-cleared engineers, and SAMA-experienced architects are scarcer than Dubai equivalents. We quote fixed fees in SAR with a milestone schedule, not open T and M.

AWS me-central-2 Dammam went generally available in 2024 as the first AWS region named after a Saudi city, with three availability zones inside Saudi Arabia. For Riyadh procurement that matters because CCRF Internal and many Confidential workloads can now stay on-soil inside a hyperscaler region with the full AWS service catalogue, without falling back to a sovereign data centre. PDPL Article 29 cross-border transfer concerns evaporate for any workload landed in me-central-2. SAMA-supervised banks get a Saudi-resident region with KMS HSM-backed key custody, CloudHSM, and the audit-trail services (CloudTrail, Config, GuardDuty, Security Hub, Detective) that SAMA examiners expect. We default new Riyadh engagements to me-central-2 as primary with me-south-1 Bahrain as the dual-region failover, falling back to STC Cloud or Mobily Bayanat only for Top Secret tier or specific Aramco OT-adjacent patterns.

SAMA Cyber Security Framework expects board-approved cybersecurity strategy, four maturity-level controls, and an outsourcing-rule evidence chain when cloud is involved. We deliver landing zones built on AWS Control Tower with Organizations and Identity Center, dedicated accounts per environment and per business-unit, AWS KMS customer-managed keys with CloudHSM root custody for SAMA CSF level 3 and 4, Conditional Access and FIDO2 phishing-resistant MFA on every privileged path, dual-region active-passive failover between me-central-2 Dammam and me-south-1 Bahrain, CloudTrail organisation trails to a write-once log bucket with object-lock, Security Hub and GuardDuty correlated to MITRE ATT&CK, and an evidence pipeline that produces the quarterly KRI and KPI reports SAMA reviewers ask for. The outsourcing-rule documentation, including the AWS Saudi Arabia data processing agreement and the audit-rights addendum, ships with the architecture pack. We have shipped to first-attempt SAMA reviewer pass.

The Cloud Computing Regulatory Framework (CCRF) is the CITC rulebook for cloud in Saudi Arabia. It classifies data into four tiers (Public, Internal, Confidential, Top Secret) and defines which hosting models are permitted at each tier. Public and Internal workloads can sit in any approved cloud region including AWS me-central-2 Dammam, AWS me-south-1 Bahrain, AWS me-central-1 UAE, and GCP me-central2 Dammam. Confidential workloads generally require in-Kingdom residency, which AWS me-central-2 satisfies for most patterns, with sovereign data centres (STC Center3, Mobily Bayanat, NourNet) as fallback. Top Secret workloads typically require sovereign-only deployment inside an NCA-approved Saudi data centre with controlled physical access. Our discovery phase runs a column-level CCRF classification against your data model so the architecture is defensible to CITC auditors and aligned with the NCA ECC and CSCC overlay where applicable.

Yes. The Cloud Computing Workforce Standards (CCWS) define Saudi-national participation expectations and skills requirements for cloud-services delivery in the Kingdom, and government and PIF procurement now reference CCWS in tender documents. Codazz works with Saudi-national delivery partners to meet CCWS targets on government and PIF engagements, with our Edmonton and Chandigarh hubs covering specialist scope that is hard to source locally and Saudi-resident engineers covering on-soil presence, knowledge transfer, and the CCWS workforce evidence chain. Discovery includes a CCWS gap analysis against your specific tender requirements, a workforce plan with skill matrices, and a knowledge-transfer schedule that produces certified Saudi-national operators by go-live. We will tell you up front when a workload demands a fully Saudi-resident delivery team and we will assemble it.

Yes. Aramco and its Dhahran-headquartered downstream and petrochemical affiliates run strict operational-technology segregation under IEC 62443 layered with API 1164 and API 1173, and any cloud integration must respect zones-and-conduits boundaries. We build IT landing zones inside AWS me-central-2 Dammam with a one-way data-diode pattern (or DMZ with strict allow-listing) into the OT environment, jump-host hardening with PAM (CyberArk, Delinea, Microsoft PIM), CCTV-aligned audit, and an incident-response runbook tested under Aramco's standards. Cloud-side observability (Datadog or CloudWatch) ingests OT telemetry only through approved telemetry brokers, never with direct OT-network access. The architecture pack ships with an IEC 62443 zone diagram, an API 1164 and 1173 control mapping, and an SOC playbook that distinguishes IT incidents from OT incidents (which trigger different escalation paths).

HUMAIN, the PIF-backed AI company launched in 2025, is building sovereign GPU and AI infrastructure inside Saudi Arabia, with announced capacity that targets ALLaM, Arabic-first frontier models, and government AI workloads. For Riyadh enterprises that means a credible third option alongside AWS me-central-2 Dammam and sovereign data centres: HUMAIN-aligned GPU capacity for Confidential and Top Secret AI workloads where hyperscaler residency is insufficient or where the workload requires SDAIA-approved sovereign infrastructure. Our cloud architectures factor HUMAIN integration paths into the design, with a documented migration plan for AI inference workloads from hyperscaler GPUs to HUMAIN sovereign capacity as it scales. Government, PIF subsidiary, and Aramco AI workloads are the natural candidates.

A typical Riyadh SAMA-aligned cloud migration runs eighteen to thirty weeks from kickoff to production, assuming clean source-environment documentation. Weeks 1 to 4 cover discovery, CCRF tier classification, NCA ECC mapping, SAMA CSF baseline, and a target-state architecture. Weeks 5 to 12 cover landing-zone build (Control Tower, Organizations, Identity Center, KMS, CloudHSM, network), Terraform module hardening, and Saudi-national CCWS workforce ramp. Weeks 13 to 22 cover application migration in waves, shadow-mode parallel running, and SAMA evidence-pack assembly. Weeks 23 to 30 cover cutover, dual-region failover testing, incident-response rehearsal, and SAMA or NCA review preparation. We have shipped to first-attempt SAMA reviewer pass on this cadence. Pre-data or pre-architecture engagements add six to ten weeks of foundation work before migration starts.