A cloud environment someone watches every day, not only when it breaks

Managed operations is a shared model, and the split has to be explicit. We take the environment layer: virtual machines or containers, networking, databases, storage, identity configuration, monitoring and backups. You keep decisions about what the business runs, who gets access, and which spend is approved. Application code can sit with you, with us under an application support agreement, or with a separate vendor, but the environment contract names who owns which layer so nothing falls between teams.

On day one we take over the runbook. If the environment was built by hand in a console, we describe it in infrastructure as code first, because an environment nobody can reproduce is an environment nobody can safely change. That step usually takes 3 to 5 weeks including discovery. After it, every change goes through a reviewed pull request, a test environment and an approved window. You can read what changed, when and why, and rolling back means running the previous version.

Where the workload runs is often a regulatory question, not a preference. The Communications, Space and Technology Commission publishes a cloud computing regulatory framework that classifies customer data and sets provider obligations, and the National Cybersecurity Authority's cloud controls apply to organisations in regulated and government-linked sectors. Personal data also falls under PDPL, which restricts transfers outside the Kingdom without a lawful basis. For financial institutions, SAMA requirements add outsourcing and resilience expectations.

In practice this shapes the platform choice and the region. AWS, Microsoft Azure and Google Cloud each offer or have announced Saudi regions, and local providers exist for workloads that must stay in-Kingdom. We help you map data classes to hosting options, build to the requirements that apply, and record the evidence an auditor will ask for: access logs, backup records, patch history. We do not claim any approval on your behalf. Your regulator and your contract decide what is required, and we build to it.

We agree response tiers by severity and state them as response times, not uptime percentages. A P1, meaning a production outage or data risk, is acknowledged within 1 hour in agreed cover hours, or around the clock if you buy 24/7 cover. A P2 gets a response within 4 working hours. Resolution depends on the cause, and we report honestly against each target every month.

Pricing combines the size of the environment, the cover hours, the response tiers and the number of platforms involved. Cloud provider charges are billed to you directly, so you keep full visibility and ownership of the account. Our fee covers the operating work. In the first quarter we often find waste worth recovering, such as idle capacity and oversized databases, and the monthly cost review tracks it. We suggest a 12 month term, because the benefits of tested backups and tuned alerts build over time.