Cloud services · Cloud computing
Cloud computing in Saudi Arabia: where your workloads can run
Cloud computing means using servers, storage, databases and software that another party provides over the network, and paying for what you use. In Saudi Arabia the first question is not which provider to pick but where each class of your data may live. This guide sets out the options, what the Communications, Space and Technology Commission (CST) publishes, and how Interkey builds and operates cloud environments for organisations in the Kingdom. It is not legal advice.
Published 5 min read
In short
- What it is: computing resources rented over the network instead of bought and run in your own premises.
- Where it runs in Saudi Arabia: a global provider's region inside or outside the Kingdom, a local provider, infrastructure you operate, or a mix.
- What decides it: your data classification, not a preference for a provider.
- The regulator: CST publishes a guide for cloud computing service providers operating in the Kingdom.
- What Interkey does: cloud strategy, landing zone, migration and operation, from Riyadh.
What cloud computing means in plain terms
Instead of buying servers and running them in its own data centre, an organisation rents computing capacity from a provider and pays for what it uses. The service can be raw infrastructure, a platform for running applications, or finished software. The usual gains are faster set-up of environments, flexible capacity and less operating work. Organisations in Saudi Arabia ask a question before all of that: where exactly will our data be, and who operates it?
Where a workload can run from Saudi Arabia
The set of options is larger here than the usual cloud conversation assumes, and every row is the right answer for some class of data.
| Option | What it is | When it fits |
|---|---|---|
| Global provider's region inside the Kingdom | A global provider's services delivered from infrastructure located in Saudi Arabia | Data that must stay in the Kingdom but may sit with a global operator. The list of such regions changes, so check it at scoping |
| Global provider's region abroad | The same services from a region outside Saudi Arabia | Only data classes your policy allows to leave. Often the widest service catalogue |
| Local provider | A Saudi-operated cloud, usually narrower in services and closer in accountability | Workloads where the operator's jurisdiction matters as much as the data's location |
| Private, on infrastructure you operate | Your data centre or colocation, run with cloud operating discipline | Data that may not leave systems you control |
| Hybrid | Several of the above, with the boundaries designed | Most real estates. See the guide to hybrid cloud |
What CST publishes for cloud providers
The Communications, Space and Technology Commission publishes on its website a Guide for Cloud Computing Service Providers, issued under decision 506/1445 in 2023. CST states that it was issued to clarify the registration procedures and requirements for cloud computing service providers operating in the Kingdom. It is addressed to providers. A buyer can use it by asking each candidate provider, in writing, about its registration status with CST and what that registration covers.
This page does not summarise what any regulator requires, because summaries of controls are how wrong requirements spread. Read the authority's own text with someone qualified to read it: CST's Guide for Cloud Computing Service Providers. This is not legal advice.
Residency is decided per class of data, not per organisation
The most common design error is one estate-wide answer: everything in the Kingdom, or everything abroad. A classification policy usually gives different answers for different classes, which is why most estates end up as a mix. Classify first. Otherwise you discover later that completed decisions were taken against the wrong constraint.
Read more
The region map keeps changing. Google Cloud runs a region in Dammam (me-central2), and Google states that organisations billed in Saudi Arabia buy through its exclusive reseller in the Kingdom. AWS says its Saudi Region is on track to launch in December 2026, and it was not in AWS's list of available Regions on 2 November 2026. Announced is not live. See Google Cloud in Saudi Arabia and AWS in Saudi Arabia for the detail.
From the question to a running cloud environment
-
Classify.
Every class of data gets a written answer, from your policy, to where it may live.
-
Choose locations.
Which rows of the table are open to each class, then the provider that offers the services the workloads need.
-
Build the foundation.
Identity, network and guardrails, built once before the first workload.
-
Migrate.
One decision per application: leave it, retire it, rehost, replatform or rewrite.
-
Operate and review cost.
A named operator and a regular review, so the bill is not a surprise in year three.
How Interkey helps
Interkey provides cloud services for organisations in Saudi Arabia across the whole programme: the strategy that decides where classes of data may live, the landing zone and guardrails, operation of the estate after the move, and cost discipline. The work is delivered from Riyadh in Arabic and English and is indifferent to provider, because the classification decides the target. Cloud migration covers the decision for each application and the move itself.
Read more
We start by asking you to describe the estate and the classes of data in it, and whether you have a classification policy today, before any provider is named. There is nothing worth buying here for an estate that has already landed in the cloud, runs at an accepted cost and has a team that owns it.
Relatedcloud services
Questions buyers ask about cloud computing
What is cloud computing?
Renting computing capacity, such as servers, storage, databases and software, from a provider over the network, and paying for what you use instead of buying and running the infrastructure.
Does our data have to stay in Saudi Arabia?
It depends on the class of data and on the requirements that apply to your organisation. Your classification policy and your compliance owner decide it, and this is not legal advice. Some classes may be hosted abroad and some may not.
Are there cloud regions inside Saudi Arabia?
Yes: Google Cloud runs a region in Dammam. AWS has announced a Saudi Region and says it is on track to launch in December 2026; it was not in AWS's list of available Regions on 2 November 2026. Lists change, so check them when you buy.
Which cloud provider do you recommend?
None before the classification is done, and often more than one afterwards. Interkey works across providers and in-Kingdom options.
Do you operate the environment after the move?
Yes, under a written scope: patching, capacity, identity, guardrail changes and a monthly account of what changed and what it cost. Your own team can run it instead, and we build the foundation so that it can.
Next
Related pages
Next step
Start with where the data may live
Describe the estate, the classes of data in it and whether you have a classification policy today. The conversation starts there, before any provider is named.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia