Do you work on site in Saudi Arabia?

Yes. Our engineers work at customer sites in the Kingdom and remotely from Dubai, and most engagements combine the two. Every engagement is contracted with Mamluk LLC-FZ, which is registered in Meydan Free Zone, Dubai.

Can the Bahriya Kubernetes Engine run inside Saudi Arabia?

Yes. BKE is installed on the customer's own servers, in the customer's own data centre, so the cluster and the data it holds stay wherever that hardware is. The requirements for each node are published in full.

BKE is licensed at a flat annual fee per cluster, whatever the number of nodes, cores or memory. The figure and a worked example are on the BKE pricing page , and a 14-day trial can be started from the Mamluk console without a sales call.

Will we have to keep personal data in the Kingdom?

Possibly. Under the PDPL as it stands, personal data may be transferred abroad under safeguards. Draft amendments published by SDAIA on 6 October 2026 would require it to be stored in the Kingdom, and the consultation on them closes on 5 November 2026. A platform on your own hardware inside the Kingdom meets the stricter rule as well as the current one, so the outcome of the consultation does not require you to move it.

Have you worked with Saudi banks?

Yes. We have worked in the Saudi banking sector, where the platform must satisfy the Saudi Central Bank's Cyber Security Framework as well as the NCA's controls.

Saudi Arabia

Kubernetes and enterprise architecture in Saudi Arabia.

We work with organisations in Saudi Arabia at their own sites and remotely from Dubai, and we have done so in banking. Every platform we build there is designed around the Kingdom's cybersecurity controls and its personal data law.

Begin an engagement About BKE

The market

Controls that are mandatory, and a data law that is changing.

Saudi Arabia has a detailed and mandatory set of national cybersecurity controls. The National Cybersecurity Authority's Essential Cybersecurity Controls are mandatory for government entities and for operators of critical national infrastructure, and its Cloud Cybersecurity Controls extend them to cloud providers and the organisations that use them. Banks are subject in addition to the Saudi Central Bank's Cyber Security Framework.

The rules on where data must be held are changing. The Cloud Cybersecurity Controls were updated in 2025 to reflect changes to data localisation requirements, and on 6 October 2026 the Saudi Data and AI Authority published draft amendments to the implementing regulations of the Personal Data Protection Law, which would require personal data to be stored in the Kingdom. The draft is under public consultation until 5 November 2026 and is not yet in force.

An organisation that runs its platform on its own hardware in the Kingdom does not need to predict the outcome of that consultation. That is how BKE is deployed.

What we do in KSA

Five services and one distribution, delivered on site and remotely.

Our engineers work at customer sites in Saudi Arabia and remotely from Dubai. Every engagement is contracted with Mamluk LLC-FZ, and the same engineers deliver every service below.

Enterprise Architecture as a Service

A senior architect on call, paid for by the day.

Kubernetes Consulting

Strategy, architecture and platform design for Kubernetes done properly.

Kubernetes Development

Custom operators, charts, controllers and the long maintenance tail.

Kubernetes Support

A Kubernetes support contract with named engineers and a defined response time.

Managed Kubernetes on Premise

A fully managed Kubernetes practice running inside your own data centre, on BKE.

Bahriya Kubernetes Engine

The only enterprise Kubernetes distribution developed and supported from within the GCC.

Sectors we have worked in, in Saudi Arabia: Banking.

Regulatory context

The frameworks that shape where workloads run.

These are the national frameworks most relevant to where a workload runs in Saudi Arabia.

Essential Cybersecurity Controls (ECC-2:2024) National Cybersecurity Authority: The mandatory cybersecurity baseline for government entities and for private entities that own or operate critical national infrastructure. It is a framework of controls; requirements on the location of data are addressed separately.
Cloud Cybersecurity Controls (CCC-2:2024) National Cybersecurity Authority: Extends the ECC to cloud service providers and the organisations that use them. The NCA updated the controls in July 2025 to reflect changes to data localisation requirements.
Personal Data Protection Law (PDPL) Saudi Data and AI Authority: Applies to the processing of personal data relating to individuals in the Kingdom, including processing from abroad, and has been enforced since September 2024. It currently permits transfer abroad under safeguards. Draft amendments published in October 2026 would require personal data to be stored in the Kingdom; the draft is not yet in force.
Cloud Computing Services Provisioning Regulations Communications, Space and Technology Commission: Governs cloud service providers and their subscribers in the Kingdom, and has been in force since October 2023. It restricts the transfer of government entities' data outside the Kingdom.
Cyber Security Framework (SAMA CSF) Saudi Central Bank: Applies to banks, insurers and finance companies regulated by the Saudi Central Bank. It is a framework of cybersecurity controls and maturity levels against which those institutions are assessed.

This summary is provided as context and is not legal advice. Which frameworks apply to an organisation depends on its sector, its licences and the data it holds, and should be confirmed with its regulator and its own counsel. Mamluk does not claim certification against any framework listed here.

Questions

Common questions from organisations in Saudi Arabia.

Do you work on site in Saudi Arabia?: Yes. Our engineers work at customer sites in the Kingdom and remotely from Dubai, and most engagements combine the two. Every engagement is contracted with Mamluk LLC-FZ, which is registered in Meydan Free Zone, Dubai.
Can the Bahriya Kubernetes Engine run inside Saudi Arabia?: Yes. BKE is installed on the customer's own servers, in the customer's own data centre, so the cluster and the data it holds stay wherever that hardware is. The requirements for each node are published in full.
How is BKE priced?: BKE is licensed at a flat annual fee per cluster, whatever the number of nodes, cores or memory. The figure and a worked example are on the BKE pricing page, and a 14-day trial can be started from the Mamluk console without a sales call.
Will we have to keep personal data in the Kingdom?: Possibly. Under the PDPL as it stands, personal data may be transferred abroad under safeguards. Draft amendments published by SDAIA on 6 October 2026 would require it to be stored in the Kingdom, and the consultation on them closes on 5 November 2026. A platform on your own hardware inside the Kingdom meets the stricter rule as well as the current one, so the outcome of the consultation does not require you to move it.
Have you worked with Saudi banks?: Yes. We have worked in the Saudi banking sector, where the platform must satisfy the Saudi Central Bank's Cyber Security Framework as well as the NCA's controls.