Data Residency
Where data physically sits, what the three UAE regimes and the Saudi rules actually require, and the difference between contracted and technically enforced residency.
Contracted is not the same as enforced
Most residency commitments are contractual: a clause saying data stays in a region. A smaller number are technically enforced: the system cannot write outside the region even if misconfigured. Buyers routinely accept the first while believing they bought the second, and the difference only surfaces during an audit.
We state which one applies, per deployment, in writing.
The regimes we deploy under
| Market | What actually governs it |
|---|---|
| UAE | Three non-overlapping regimes — federal, DIFC and ADGM — and which one applies is decided by your trade licence, not your office address. See the UAE brief |
| Saudi Arabia | Residency expectations are materially stricter and, for regulated sectors, are enforced rather than contracted. See the Saudi brief |
| UK / EU | UK GDPR and GDPR, with transfer mechanisms documented per sub-processor. See the DPA |
Deployment options run from our hosted service through private cloud to fully on-premise, where data never leaves your environment. Which of those is available depends on the engagement, and we would rather scope that honestly than list four tiers we cannot all staff.