Do you work on site in Dubai?

Yes. Our engineers work at customer sites across Dubai and remotely from Dubai, and most engagements combine the two. Every engagement is contracted with Mamluk LLC-FZ, which is registered in Meydan Free Zone, Dubai.

Can the Bahriya Kubernetes Engine run inside Dubai?

Yes. BKE is installed on the customer's own servers, in the customer's own data centre, so the cluster and the data it holds stay wherever that hardware is. The requirements for each node are published in full.

BKE is licensed at a flat annual fee per cluster, whatever the number of nodes, cores or memory. The figure and a worked example are on the BKE pricing page , and a 14-day trial can be started from the Mamluk console without a sales call.

Our firm is in the DIFC. Does that change anything?

It changes which data protection law applies: the DIFC Data Protection Law rather than the federal PDPL. It does not change how we work. A platform on your own hardware leaves you in control of where personal data is held and where it is transferred, which is what both laws ask you to be able to show.

Dubai, United Arab Emirates

Kubernetes and enterprise architecture in Dubai.

Mamluk is registered in Meydan Free Zone and our engineers are resident in Dubai. For an organisation in the emirate, an engagement with us is a local one: we work at your site, in your time zone, and under the same rules you do.

Begin an engagement About BKE

The market

Government standards, and a free zone with its own law.

Dubai adds two sets of rules to the federal baseline. The Dubai Electronic Security Center sets information security standards for Dubai government entities, including a standard that cloud service providers must be certified against before government entities may use them. The Dubai International Financial Centre has its own data protection law, administered by its own commissioner.

For a government entity or a supplier to one, this means the choice of platform is constrained by certification as well as by preference. For a firm in the DIFC, it means personal data is governed by DIFC law rather than the federal PDPL.

A platform running on the organisation's own hardware sits outside the question of which cloud provider holds a certificate, because no provider holds the workload. That is how BKE is deployed, and it is how Bahriya, our own public cloud, is built.

What we do in Dubai

Five services and one distribution, delivered on site and remotely.

Our engineers work at customer sites in Dubai and remotely from Dubai. Every engagement is contracted with Mamluk LLC-FZ, and the same engineers deliver every service below.

Enterprise Architecture as a Service

A senior architect on call, paid for by the day.

Kubernetes Consulting

Strategy, architecture and platform design for Kubernetes done properly.

Kubernetes Development

Custom operators, charts, controllers and the long maintenance tail.

Kubernetes Support

A Kubernetes support contract with named engineers and a defined response time.

Managed Kubernetes on Premise

A fully managed Kubernetes practice running inside your own data centre, on BKE.

Bahriya Kubernetes Engine

The only enterprise Kubernetes distribution developed and supported from within the GCC.

Regulatory context

The frameworks that shape where workloads run.

These are the Dubai and DIFC rules most relevant to where a workload runs. The federal frameworks on the UAE page apply as well.

Dubai Information Security Regulation (ISR) Dubai Electronic Security Center: The information security standard for Dubai government entities and the organisations that work with them. It is a framework of security controls rather than a rule on where data must be stored.
DESC Cloud Service Provider Security Standard (CSP Security Standard) Dubai Electronic Security Center: Dubai government and semi-government entities may use only cloud service providers certified against this standard. An entity that runs its platform on its own infrastructure is not relying on a provider's certification.
Law No. 26 of 2015 Regulating Data Dissemination and Exchange in the Emirate of Dubai (Dubai Data Law) Government of Dubai, administered by Digital Dubai: Governs how Dubai government entities classify, publish and share the data they hold. It concerns the classification and exchange of data rather than its physical location.
DIFC Data Protection Law, DIFC Law No. 5 of 2020 (DIFC DPL) DIFC Commissioner of Data Protection: Applies to entities in the DIFC in place of the federal PDPL. It does not require data to be stored in the UAE, but permits transfers only to adequate jurisdictions or under safeguards, and amendments in force from July 2025 require the destination to be assessed and the assessment documented.

This summary is provided as context and is not legal advice. Which frameworks apply to an organisation depends on its sector, its licences and the data it holds, and should be confirmed with its regulator and its own counsel. Mamluk does not claim certification against any framework listed here.

Questions

Common questions from organisations in Dubai.

Do you work on site in Dubai?: Yes. Our engineers work at customer sites across Dubai and remotely from Dubai, and most engagements combine the two. Every engagement is contracted with Mamluk LLC-FZ, which is registered in Meydan Free Zone, Dubai.
Can the Bahriya Kubernetes Engine run inside Dubai?: Yes. BKE is installed on the customer's own servers, in the customer's own data centre, so the cluster and the data it holds stay wherever that hardware is. The requirements for each node are published in full.
How is BKE priced?: BKE is licensed at a flat annual fee per cluster, whatever the number of nodes, cores or memory. The figure and a worked example are on the BKE pricing page, and a 14-day trial can be started from the Mamluk console without a sales call.
Our firm is in the DIFC. Does that change anything?: It changes which data protection law applies: the DIFC Data Protection Law rather than the federal PDPL. It does not change how we work. A platform on your own hardware leaves you in control of where personal data is held and where it is transferred, which is what both laws ask you to be able to show.