Search for a command to run...
A mobile-friendly guide to cloud availability, residency, procurement and recovery across four Gulf markets.
No comments yet. Be the first to comment.
QDB is bringing model-compression specialist Multiverse Computing to Doha, but the investment size and local operating plan remain undisclosed.
A practical architecture for normalization, morphology, typo tolerance and hybrid retrieval across Arabic-speaking markets.
DataVolt says construction could begin within months, but power, financing and customers remain unresolved.
IBM’s Saudi and UAE sample shows that lost business costs far more than breach notification. Recovery and identity still matter most.
Sultan Byte
12 posts
Articles addressing day-to-day development challenges
On this page
A Gulf deployment used to mean choosing between Europe, Bahrain and a private data centre. That is no longer the useful question. AWS, Microsoft Azure, Google Cloud and Alibaba Cloud now operate regions across the UAE, Qatar, Saudi Arabia and Bahrain, but their maps do not line up. Neither do their service catalogues, procurement routes, current operating conditions or recovery options.
For a team serving Gulf customers, the right region must satisfy four constraints at once: the data can legally be there, the required managed services are available, users get acceptable latency, and the failure plan works without quietly sending regulated data to another country.
This is practical technical information, not legal advice. Sector rules, free-zone laws and contractual commitments may impose tighter requirements than the general privacy laws discussed here.
Cover: original SultanByte technical illustration. It shows deployment paths rather than measured network links.
The current footprint produces a different answer in each country. Alibaba Cloud belongs in this comparison: it has two Availability Zones in Dubai and a two-zone partner region in Riyadh.
The comparison is split into country cards rather than one wide table so it remains readable on smaller screens.
me-central-1, three Availability Zones; open regional disruption.me-east-1, two Availability Zones.me-central2, three zones.me-central-1, two Availability Zones.me-central1, three zones.me-south-1, three Availability Zones; currently unavailable according to the public AWS Health Dashboard.The AWS entries and zone counts come from its live Regions and Availability Zones table. Microsoft's operational region list includes Qatar Central, UAE Central and UAE North. Its broader geographies page names Saudi Arabia East among regions that are "available or coming soon." Until Microsoft marks it generally available and exposes the services you need, treat it as roadmap information.
Google's Compute Engine documentation lists three zones in both Doha (me-central1) and Dammam (me-central2). That confirms compute placement, not every product. Alibaba Cloud's live ECS regions and zones table lists Dubai and the Riyadh partner region with two zones each. Its global locations page gives the same footprint.
Original infographic: SultanByte. Provider availability and operational status are explained and linked in the surrounding text.
This is confirmed operational impact, not a hypothetical risk. As of 16:35 GST on 8 August 2026, the public AWS Health Dashboard showed two open issues. Its 30 April update said the UAE region could not reliably support customer applications, while the Bahrain region was unavailable. AWS said restoration would take several months and told customers to migrate accessible resources or recover inaccessible resources from remote backups in other regions.
AWS's incident record says drone strikes directly hit two UAE facilities and caused physical impact near a Bahrain facility. It reported structural damage, disrupted power delivery, fire-suppression water damage and impaired connectivity. Two of the UAE region's three Availability Zones were significantly impaired. EC2, S3, DynamoDB, Lambda, Kinesis, CloudWatch and RDS were among the affected services. Reuters independently reported the AWS statement and customer impact, while TeleGeography analysed the multi-site failure using infrastructure data current to Q1 2026.
The distinction matters. There is proof of a prolonged AWS regional disruption. There is no basis here to imply that Azure, Google Cloud or Alibaba Cloud had the same operational impact. At 16:35 GST on 8 August, Azure status showed no active widespread event, Google Cloud Service Health showed no broad severe incident, and the Alibaba Cloud Health Status Middle East view for Dubai showed no incident. Those public pages have limited scope and do not replace account-level service health.
The engineering lesson is narrower than "the Gulf is unsafe." Multiple sites in one region can share a geopolitical, power, cooling, connectivity or emergency-access failure boundary. AWS's own updates said physical restoration required work on facilities, cooling and power systems, plus coordination with local authorities. By 30 April, it expected the process to take months. Do not base a recovery-time objective on quick hardware replacement or unrestricted site access.
For any provider, ask for evidence rather than reassurance:
Can backups be restored without the primary region's console, keys or control plane?
Do private links and internet paths use independent carriers and physical routes?
Can the team obtain infrastructure code, secrets and recovery instructions if local connectivity is degraded?
Does the approved recovery site stay within the required legal boundary?
Has the organisation tested the path while capacity in the preferred region is unavailable?
A region badge is a poor proxy for deployability. Build a short list of services the application cannot operate without: the exact database engine and tier, Kubernetes or serverless runtime, key-management mode, private connectivity, observability stack, backup target and any AI APIs. Then check each product, SKU and feature in the candidate region.
This matters even for common services. Microsoft's product availability table separates UAE North, UAE Central and Qatar Central and shows availability at SKU level. AWS says its regional services list is updated daily. Google publishes a minimum launch set that includes Compute Engine, GKE, Cloud Storage, Cloud SQL, Cloud VPN, KMS and Secret Manager, while other products can arrive later; its locations page remains the source to check before committing.
Alibaba needs the same product-by-product check. The presence of ECS in Dubai or Riyadh does not mean a matching database tier, AI service, security feature or support route is available. Use the service's regional documentation and a proof of concept in the actual account. For Riyadh, the commercial and operating relationship also runs through SCCC by stc rather than a standard global Alibaba Cloud assumption.
Do this review with the architecture diagram open. A "local" application can still export data through a managed logging sink, global analytics service, support tool, model API or disaster-recovery copy. The database region is only one row in the data-flow inventory.
AWS makes the distinction explicit: customer content for regional services stays in the region or regions the customer selects, unless a service says otherwise. Its global services, including IAM, Organizations, CloudFront, Route 53, Global Accelerator, Direct Connect, WAF and Shield, may store and process data globally. Operational data such as billing and resource labels may also be processed in other regions. Check the equivalent boundary service by service on Azure, Google Cloud and Alibaba Cloud rather than inferring it from a region selector.
Google Cloud's Dammam region is not purchased in the same way as a typical European or US region. Google's current Dammam access documentation says customers with a Saudi billing address must buy Google Cloud services through CNTXT, Google's exclusive reseller in the Kingdom. Access to me-central2 for Saudi-based customers requires that route, and support is handled through CNTXT rather than directly through Google Customer Care.
Customers billed outside Saudi Arabia can continue to buy from Google or an authorised partner, but Dammam access requires invoiced billing. A credit-card account must move to invoiced billing first. These details affect onboarding time, support escalation, commercial terms and account design.
Alibaba Cloud's Saudi footprint is also a partner region. SCCC by stc describes the service as Alibaba Cloud infrastructure with Saudi control and data sovereignty across two Riyadh Availability Zones. Treat SCCC as the contracting, support and operating route to validate. Do not assume that a global Alibaba Cloud agreement, console feature or support entitlement automatically transfers to the Saudi partner environment.
Google's Dammam page says Saudi Arabia's Communications, Space and Technology Commission granted Google Cloud a Class C licence for the region, based on an assessment against the National Cybersecurity Authority's Essential Cybersecurity Controls and Cloud Cybersecurity Controls. That is useful evidence for a compliance review, but it does not certify the customer's workload. The same caution applies to provider and partner certifications: configuration and operating controls remain the customer's responsibility.
Saudi Arabia, the UAE, Qatar and Bahrain have separate privacy regimes. A deployment approved for one country should not be copied into another with only the region name changed.
Saudi Arabia's Personal Data Protection Law material says the law covers processing involving people in the Kingdom, including processing by entities outside Saudi Arabia. It requires organisational, administrative and technical protection measures, including during transfer. SDAIA separately publishes the law's implementing regulation and the regulation for transfers outside the Kingdom on that page.
The UAE's official data-protection overview says Federal Decree Law No. 45 of 2021 applies to electronic processing inside or outside the country and sets requirements for cross-border transfers. UAE deployments may also fall under sector rules or a free-zone regime such as the DIFC, so "hosted in Dubai" is not a complete compliance answer.
Qatar has its own personal-data privacy framework and regulator. Teams should confirm the exact controller, data categories, transfer basis and sector obligations with local counsel before choosing an overseas backup region.
Bahrain also has its own Personal Data Protection Law and regulator. An AWS region code does not settle whether a workload, backup, support path or cross-border transfer is compliant. Map the controller, data classes, processors, encryption-key access and recovery destination before treating Bahrain as a residency answer.
A useful engineering artefact is a transfer register generated from the system design. For every data class, record the primary store, replicas, backups, logs, support access, encryption keys and subprocessors. That turns residency from a checkbox into something the team can test.
Availability Zones protect against many data-centre failures inside one region. The March 2026 AWS incident proved that they do not cover every multi-site physical event, regional network fault, power interruption or control-plane dependency.
The current Gulf footprint makes recovery choices awkward:
Azure can support an in-country, two-region design in the UAE using UAE North and UAE Central, subject to service support and the application's replication model.
AWS's UAE and Bahrain regions cannot currently be treated as a healthy recovery pair. Its public dashboard says the UAE region is unreliable and Bahrain is unavailable.
Google has one region in Qatar and one in Saudi Arabia. Using both for recovery is a cross-border transfer and Dammam has its own access conditions.
Alibaba Cloud has two zones in Dubai and two in its Riyadh partner region. A UAE-to-Saudi recovery design crosses a border and changes the commercial operating route.
Qatar, Saudi Arabia and Bahrain do not currently offer two healthy, generally available in-country regions from the same provider in this comparison. Bahrain’s only listed hyperscale region is the disrupted AWS region.
For strict in-country workloads in a single-region market, the honest options are narrower: multi-zone production plus tested backup and restore in the same country, a second local provider or colocation site, or an approved cross-border recovery location. A snapshot in the same region is not disaster recovery.
Set recovery objectives only after testing the actual path. Measure how long it takes to restore the largest database, recreate secrets and keys, rebuild private connectivity, switch DNS and validate application consistency. A cross-region replica that cannot be promoted without a vendor ticket is not meeting a short recovery-time objective.
Use the following order for a new Gulf workload.
Classify the data and rules. Identify personal, health, financial, government and security-sensitive data. Map the controller, users and sector regulator by country.
Draw every storage and access path. Include telemetry, backups, CDN logs, support access, SaaS integrations and AI services. Mark anything that can leave the selected country.
Test the regional service bill of materials. Verify exact SKUs, quotas, zone support, private endpoints, customer-managed keys and backup destinations. Save links to the live provider tables in the architecture decision record.
Check live and account health. A region that exists in provider documentation may still be impaired. Record the observed status and timestamp in the deployment decision.
Run latency tests from real networks. Test the mobile operators, offices and customer locations that matter. Browser round-trip time, API latency and database placement are more useful than geographic distance.
Design recovery before production. Decide whether the application can cross a border during an incident. If it cannot, document the local alternative and test a full restore.
Check the commercial path. Confirm billing entity, reseller or partner requirements, support ownership, currency, committed-spend terms and how an account can be exited.
Automate placement controls. Use policy-as-code to block unapproved regions, public storage, unmanaged keys and unreviewed replication. Alert on configuration drift.
The best default is the closest compliant, currently healthy region with the complete service set, deployed across zones, with recovery designed as a separate decision. In August 2026, that wording matters: a pin on a provider map does not prove that the region can carry production today.