Reference
The Saudi cloud map.
Sourced and dated, on every row.
What your counsel, your buyer’s security team, and a provider’s enterprise desk will each check — in one place, sourced and dated. Last checked 30 Aug 2026; when a row moves, the changelog says so.
Live in-Kingdom cities · 03 · every row sourced below
- RIYADH
- Oracle · Alibaba via sccc · Huawei · SITE · national CST registrants
- JEDDAH
- Oracle · SITE
- DAMMAM
- Google Cloud me-central2 · sold through CNTXT
Regions and providers
In-Kingdom regions, and the routes to buy them.
AWS and Azure rows state announced status per the providers’ own pages — third-party launch claims do not move these rows.
| Provider | In-Kingdom region | Status | Access | Source |
|---|---|---|---|---|
| Google Cloud | Dammamme-central2 | LiveLive since 15 Nov 2023 · 3 zones | KSA-billed customers buy through CNTXT (Google’s designated route); customers with a non-KSA billing address may buy from Google or a partner, but their Dammam access requires invoiced billing. | Google Cloud — Dammam region access |
| Oracle Cloud | Jeddah · Riyadhme-jeddah-1 · me-riyadh-1 | LiveJeddah since 2020; Riyadh since 2024 (with center3/stc) | Direct from Oracle; single availability domain per region. | Oracle — Riyadh cloud regionOracle — release notes (Riyadh) |
| Alibaba Cloud via sccc by stc | Riyadh | LiveLive since June 2022 · 2 availability zones | Bought through sccc (Saudi Cloud Computing Company), the stc–Alibaba joint venture; over 90 localized Alibaba Cloud products. | Saudi Press Agency — sccc launchsccc.sa |
| Huawei Cloud | Riyadh | LiveLive · holds CST Class C registration | Direct from Huawei Cloud; Huawei publishes its KSA Class C registration, covering government-sector data classes. | Huawei Cloud — KSA CST Class C |
| SITE Cloud | Riyadh RD1 · Jeddah JD1 | LiveLive · sovereign-cloud positioning | Government-linked provider (Saudi Information Technology Company); dedicated-region offering. | SITE Cloud — regions |
| stc / Solutions, Mobily, Zain, Salam, NourNet, Detasad and other CST registrants | Various (KSA) | LiveNational providers with CST registrations | CST publishes the authoritative register of cloud providers and their classes; ask any provider for its current CST registration class. | CST — registered cloud providers |
| AWS | Saudi Arabia | AnnouncedAnnounced, not launched | AWS's infrastructure page lists Bahrain and UAE (me-central-1) as its live Middle East regions and Saudi Arabia among announced plans. In-Kingdom today: Outposts, Direct Connect, and a Jeddah CloudFront edge. | AWS — global infrastructure (regions) |
| Microsoft Azure | Saudi Arabia East (Eastern Province) | Q4 2026Customer workloads from Q4 2026, per Microsoft | Datacenter construction completed December 2024; Microsoft has confirmed availability for customer workloads from Q4 2026. Not live at the date checked. | Microsoft — Saudi Arabia datacenter region |
Rows checked 30 Aug 2026. Provider classes are quoted only from CST’s own register or a provider’s published registration; where the register needs a human read, we say so rather than guess.
Who regulates what
The regulators a vendor’s counsel will meet.
This is the substance a buyer’s legal, security, and procurement teams will discover on their own — better to arrive knowing it.
CST
Communications, Space and Technology Commission
Cloud Computing Services Provisioning Regulations (in force 10 Oct 2023)
Providers that control the data centre or critical infrastructure of a cloud system must register with CST. Registration classes (Qualifying, A, B, C) determine which data classifications and which sectors — including government — a provider may serve. CST publishes the register.
CST — Regulation 1482CST — cloud computing registrationCST — registered providers
NCA
National Cybersecurity Authority
Essential Cybersecurity Controls ECC-2:2024 · Cloud Cybersecurity Controls CCC-2:2024
Applies to government entities and to private entities owning, operating, or hosting critical national infrastructure — from both the provider and the tenant perspective. A buyer in scope will flow these controls down to its suppliers by contract.
SDAIA
Saudi Data & AI Authority
Personal Data Protection Law (fully enforceable since 14 Sep 2024) · Regulation on Personal Data Transfer Outside the Kingdom (Sep 2024)
Cross-border transfer of personal data needs a lawful basis plus safeguards (standard contractual clauses, binding common rules, or accreditation); no adequacy list had been published at the date checked. Controller and processor roles must be explicit in the hosting chain.
Mayer Brown — PDPL transfer regulations (2024)IAPP — PDPL first anniversary
NDMO
National Data Management Office (under SDAIA)
National Data Governance Interim Regulations, incl. Data Classification Policy
Government data must be classified — Top Secret, Secret, Confidential, or Public — and the classification drives which provider class and hosting arrangement is acceptable.
NIC
National Information Center (under SDAIA)
Government Secure Network (GSN) and Government Service Bus
A non-government company may connect to the GSN only with a government entity’s approval and the service provider’s approval, under a standard SLA.
SAMA
Saudi Central Bank
Cyber Security Framework · Rules on Outsourcing
Financial institutions need SAMA approval before using cloud services, and explicit approval for cloud located outside the Kingdom.
MISA
Ministry of Investment
Investment registration (replaces licensing) · Regional Headquarters programme
A subsidiary or branch is a real option: investment registration review takes up to 10 days per MISA. The RHQ rule affects eligibility for government tenders on Etimad.
MoF / Etimad
Ministry of Finance · Etimad portal
Government Tenders and Procurement Law (M/128, 2019) · local-content rules
Etimad is the single gateway to government tenders. A foreign supplier can register without a Saudi CR via the Foreign Supplier route with a home-country licence and a local representative, but most tenders in practice expect a Saudi CR or MISA registration, and local-content scoring increasingly decides awards.
MCIT
Ministry of Communications and Information Technology
Cloud First Policy (2020)
Government entities must consider cloud first for new IT investment. The policy exempts SAMA, MoD, PSS, MoI, and NCA.
Provider classes
How to read a provider’s CST class.
CST registers cloud providers under the Cloud Computing Services Provisioning Regulations into classes — Qualifying, A, B, C — and the class determines which data classifications (public through top secret) and which sectors (individuals, private, non-profit, government) a provider may serve. Government-linked tenders commonly cite Class C because it covers the government sector and higher classifications.
The practical discipline: ask any provider for its current registration class in writing, and read it against your customer’s sector and the data classification the workload will hold. CST publishes the authoritative register; a provider’s own compliance page (as Huawei Cloud does for its Class C) is the next-best evidence.
Note: CST’s register page renders in the browser; we quote specific classes only after a human read of the register or a provider’s published registration, and each quoted class carries its source.
Glossary
The vocabulary of a Saudi cloud deal.
- CST
- Communications, Space and Technology Commission — registers cloud providers and assigns registration classes (Qualifying, A, B, C). Formerly CITC.
- CST Class C
- The registration class qualified to serve government-sector workloads and higher data classifications. Government-linked tenders commonly cite it.
- NCA
- National Cybersecurity Authority — issues the ECC and CCC control sets.
- ECC-2:2024
- Essential Cybersecurity Controls, second edition — the NCA baseline for in-scope entities.
- CCC-2:2024
- Cloud Cybersecurity Controls, second edition — extends the ECC for cloud, from both provider (CSP) and tenant (CST) perspectives.
- SDAIA
- Saudi Data & AI Authority — parent of the NDMO and NIC; supervises PDPL enforcement.
- PDPL
- Personal Data Protection Law — fully enforceable since 14 September 2024, with a separate regulation for transfers outside the Kingdom.
- NDMO
- National Data Management Office — issues the government data classification policy (Top Secret / Secret / Confidential / Public).
- NIC / GSN
- National Information Center; operates the Government Secure Network, which non-government companies join only with approvals.
- MISA
- Ministry of Investment — investment registration (review up to 10 days) replaced the old licensing regime.
- RHQ
- Regional Headquarters programme — affects eligibility for government tenders.
- Etimad
- The government procurement portal; single gateway to tenders. Has a Foreign Supplier registration route.
- LCGPA
- Local Content and Government Procurement Authority — local-content scoring increasingly decides awards.
- SAMA
- Saudi Central Bank — financial institutions need its approval before using cloud services.
- CNTXT
- The exclusive route to Google Cloud’s Dammam region for KSA-billed customers.
- sccc
- Saudi Cloud Computing Company — the stc–Alibaba joint venture operating Alibaba Cloud’s Riyadh region.
Changelog of checks
When we looked, and what moved.
The map is re-checked on a monthly cadence and on any provider or regulator announcement.
Initial publication: all provider and regulator rows verified against the linked first-party sources.
Found a row that has moved? Tell us and we will correct it with the next check. Then check your Saudi path.