The full answer
Saudi organisations, particularly those funded under Vision 2030 programmes, are expected to meet the National Cybersecurity Authority's controls and keep sensitive data inside the country. Creuto treats both as architecture decisions made in discovery, not compliance paperwork added at the end.
Data residency is handled by deploying to a cloud region in Saudi Arabia on AWS, Azure or Google Cloud, keeping backups and logs in-region and configuring AI features so that prompts and documents do not leave the chosen environment. Private or self-hosted models are available where a hosted model is not acceptable.
Security controls follow the same practices Creuto applies everywhere, aligned with SOC 2 and ISO 27001: secure coding to OWASP guidance, least-privilege access, secrets kept out of code, dependency patching, logging of administrative actions, and vulnerability assessment and penetration testing before major releases. Evidence from each control is documented so your internal or external auditors can use it.
Creuto serves Riyadh, Jeddah and Dammam remotely from its Dubai studio, with overlapping working hours and Arabic right-to-left interface support. Your organisation remains responsible for its own NCA compliance; Creuto's role is to build and document the technical controls that support it. Start with a discovery call.