The questions asked before a first call.

Cloudi Arabia is a market-entry desk for Saudi cloud. It qualifies a blocked opportunity, maps the honest route in a written Path Note, prepares the enquiry the way a provider’s enterprise team wants to receive it, and makes the introduction. It does not host workloads, audit controls, give legal advice, or resell capacity. Scope, delivery, and formal responsibility sit with the downstream provider or specialist under their own agreements.

It is none of those four things. Cloudi Arabia is the introduction and preparation layer: it frames the workload, the classification, and the commercial question, then routes the conversation to a CST-registered provider or a formally qualified specialist.

An operating desk reachable at hello@cloudiarabia.com. Entity and team details are published on the About page as they are formalised; until then we deliberately publish only what is verifiable.

Introductions are made without charge to the enquirer. Any engagement terms are agreed directly with the downstream party.

No margin on the provider bill is claimed and none is taken. Your commercial relationship with the provider is direct.

The target is a reply within 4 business hours (Sunday–Thursday, Riyadh time) and, where there is a fit, a written Path Note in about 48 hours. These are targets, not contractual SLAs; the dependency is a complete enquiry: buyer, workload, and where it is stuck.

A short written document you can forward internally: the provisional route (provider class, hosting, contracting standing, sector approvals), the facts behind it with sources and dates, what the first provider conversation will ask for, and the order of operations. It is preparation, not legal advice.

Where the route is clear and the enquiry is complete, the introduction follows the Path Note. The long pole is usually the buyer’s security review, not the introduction.

Not necessarily — that is what should be established before you spend on any route. Buying in-Kingdom infrastructure and holding standing to sign a government contract are different questions. MISA investment registration has a review of up to 10 days per MISA, Etimad has a Foreign Supplier route, and some deals need neither. The Path Check gives you a provisional answer in three minutes.

MISA investment registration is the entry step that replaced the old licence for foreign investors. A branch or subsidiary is the corporate form you register. The Regional Headquarters (RHQ) programme is separate and affects eligibility for government tenders. Which one your deal needs depends on the buyer and the contract — a Saudi-qualified adviser confirms the choice.

Yes — Etimad has a Foreign Supplier registration route using a home-country licence and a local representative. In practice most tenders still expect a Saudi CR or MISA registration, and local-content scoring increasingly decides awards, so read the specific tender before relying on the foreign route.

Expect Arabic or bilingual drafting and SAR-denominated commitments — market commentary describes both as standard expectations for Saudi cloud contracting. Providers working with international vendors handle this routinely.

At the date checked: Google Cloud (Dammam, via CNTXT), Oracle (Jeddah and Riyadh), Alibaba Cloud (Riyadh, via sccc), and Huawei Cloud (Riyadh) are live in-Kingdom, alongside SITE Cloud and the national CST-registered providers. AWS lists its Saudi regions as announced, not launched; Microsoft has confirmed Azure Saudi Arabia East for customer workloads from Q4 2026. Every row is sourced and dated on the Saudi cloud map.

Google sells the Dammam region (me-central2) through CNTXT for KSA-billed customers — that is Google’s own published access model. Learning the designated route early keeps the deal moving; discovering it during procurement costs the schedule.

CST registers cloud providers into classes (Qualifying, A, B, C) that determine which data classifications and which sectors a provider may serve. Class C covers the government sector and higher classifications, which is why government-linked tenders cite it. Ask any provider for its current registration class in writing — CST publishes the register.

Both sit outside the Kingdom. Whether that is acceptable depends on the data classification and the customer — for government-linked and residency-bound workloads the practical answer is usually no. Confirm the residency expectation in writing before architecting around a nearby region.

Under PDPL the roles must be explicit: typically the party deciding purposes and means of processing is the controller (usually you or your customer), and the hosting provider processes on instructions. The exact allocation is contractual and belongs in the buyer’s and provider’s paper; Cloudi Arabia orients you on the questions, and qualified counsel settles them.

Only with a lawful basis plus safeguards under the Regulation on Personal Data Transfer Outside the Kingdom (September 2024) — standard contractual clauses, binding common rules, or accreditation. No adequacy list had been published at the date checked. Your DPO and counsel own this answer for your specific flows.

Government and critical-infrastructure buyers work from the NCA’s ECC-2:2024 and CCC-2:2024 and flow the relevant controls down to suppliers by contract. Expect questions on hosting location, provider registration class, access control, encryption, monitoring, and incident reporting — split between you and the provider.

The NDMO policy classifies government data as Top Secret, Secret, Confidential, or Public, and the classification drives which provider class and hosting arrangement is acceptable. The data owner on the government side decides; your job is to know the proposed class early because it shapes everything downstream.

If your end customer is a SAMA-regulated financial institution, the institution needs SAMA approval before using cloud services — and explicit approval for cloud outside the Kingdom. That approval belongs to the customer, but your deal timeline inherits it.

The GSN is the National Information Center’s secure network for government connectivity. A non-government company connects only with a government entity’s approval and the service provider’s approval, under a standard SLA. Whether you need it depends on how your service integrates with government systems.

They stay with you. Cloudi Arabia prepares and introduces; your contract with your customer, your product, and your roadmap are untouched.

The provider’s own SLA governs, under the agreement you sign with the provider. Cloudi Arabia makes no SLA representation on any provider’s behalf.

Portability is a legitimate selection criterion — raise renewal, exit, and data-return terms in the first commercial conversation. The commercial orientation service exists to put questions like this on the table early.

A readiness pack: the buyer (named where the vendor permits), workload shape and data classification, residency expectation, PDPL roles as proposed, timeline, budget band, and the specific blocker. The intention is that your enterprise team spends its first call on the real questions.

No. No reseller margin, no capacity commitments, no SLA representation, no billing of the end client. Prepared demand is handed to your team and the commercial relationship is directly yours.

Write to hello@cloudiarabia.com or use the contact form with the Provider role selected. Tell us which sectors and workload classes your registration covers and how your enterprise team wants to receive introductions.