Move to the cloud without a weekend of guessing

Every workload gets one of four treatments. Rehost copies it as is, which is fastest and keeps the old design problems. Replatform moves it onto a managed database or a managed runtime, which costs a few extra weeks and removes patching work. Refactor rewrites parts of it for the cloud, which only pays off for systems you will keep for years. Retire switches it off, and in our experience a surprising share of an estate falls into this last group once someone asks who still uses it.

The inventory stage decides the split. We scan the servers, read the connection logs and interview the people who rely on each system. The result is a table with one row per workload and a recommended treatment, an effort range and a risk rating. You approve the table before any money goes on infrastructure.

Most mid-sized estates move in three or four waves over 8 to 16 weeks. A single application with one database can move in 4 to 6 weeks including rehearsals. The order matters more than the speed: shared services such as identity and file storage move first, because everything else depends on them.

Saudi Arabia ties where data may sit to what the data is. The Communications, Space and Technology Commission (CST) publishes the Cloud Computing Regulatory Framework, which registers cloud providers and sets obligations by the sensitivity of the customer content they host. The National Data Management Office classifies government and regulated data into levels, and the National Cybersecurity Authority issues cloud cybersecurity controls that apply on top. For the highest levels, hosting has to stay inside the Kingdom.

Personal data adds a second layer. Under the Personal Data Protection Law (PDPL), moving personal data outside Saudi Arabia is permitted only on defined grounds and subject to the transfer regulations issued by SDAIA. Companies often discover this when a SaaS tool or a backup job quietly copies records to a foreign region.

In-Kingdom capacity now exists from several providers, including AWS, Google Cloud, Oracle, STC Cloud and Alibaba Cloud in Riyadh, though the list of services offered differs by provider and changes often. We compare the services you need against each region before recommending one, and we write the classification decision into the project record so an auditor can follow it.

A good cutover is boring. We replicate data continuously from the old database to the new one, so on the day the final sync takes minutes. The application is already running in the cloud against a copy, tested by your own staff, before anyone changes a DNS record.

We run two full rehearsals. The first finds the surprises: a hard-coded IP address, a licence tied to a machine, a scheduled job nobody documented. The second is timed against the written runbook, with the people who will be on duty during the real move. If the second rehearsal misses its time window, we do not book the real date.

The old system stays untouched and read-only for an agreed period after cutover, usually 2 to 4 weeks. That is your rollback. When the period ends without incident, we decommission it with a signed checklist, and the savings start for real.