For procurement, vendor management and compliance · Saudi Arabia
You have to clear us before anyone can buy us.
Sastrum is built to pass a Saudi regulated firm's outsourcing assessment: deployment your way, a security pack on request, and a contract written for regulated firms.
Your situation
A cloud vendor is an outsourcing decision, and the regulator will ask to see it.
Problems
- SAMA's outsourcing rules and the NCA's controls make a cloud vendor a notified decision, with data expected to stay in the Kingdom.
- Most vendors answer the security questionnaire slowly, partially, or with marketing.
- Data residency, access and exit terms get settled late, after the business has already chosen.
Needs
- Clear hosting options and regions, stated once and not changed in the sales cycle.
- A security pack that answers the questionnaire: data handling, access, continuity, testing, what is certified and what is not.
- A price model with no surprises, and a contract that fits the outsourcing policy.
Desires
- Clear a vendor in weeks, not months, with the documents already in hand.
- One contact who answers the same day.
What you would love
- A vendor who sends the due-diligence answers before you ask for them.
- An exit plan written into the contract from the start.
Three things that are different
Built to be assessed, not just bought.
- 01
Deployment your way.
SaaS, private cloud in your own account, or on-premise, the same product in each case. Hosting in a Saudi region is stated in the contract, and the on-premise option keeps everything, including the AI models, inside the Kingdom.
- 02
A security pack on request.
Data handling, hosting, access control, business continuity, a penetration test summary, and the certifications SecurEyes holds. Nothing is claimed that the pack cannot show.
- 03
A vendor you can assess.
SecurEyes, which has served Saudi regulated firms from Riyadh for years, is a cyber security consultancy of twenty years that stands behind the product and the contract, and answers your due-diligence questionnaire itself.
Coverage for Saudi Arabia
The standards your assessment will check against.
The frameworks your own firm answers to are mapped in the product, which is also what your assessment of us will measure.
Your regulators
Frameworks for you
- SAMA Cyber Security Framework
- NCA Essential Cybersecurity Controls (ECC-2:2024)
- Personal Data Protection Law (PDPL)
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Banks, finance companies, insurers, capital market institutions
SAMA CSF, NCA ECC, PDPL, CMA
Why this matters now
The obligations are dated and the penalties are public.
Saudi figures, each linked to its source.
SAR 27m
average cost of a data breach in Saudi Arabia, 2026
SAR 5m
maximum fine for a PDPL violation, doubled for repeat offences
SAR 3m
maximum fine for disclosing sensitive personal data, with up to two years' prison
72 hours
to notify SDAIA of a personal data breach
Start the assessment with the pack in hand.
Tell us which questionnaire you use and we will answer it, with the hosting options and a draft contract.