What is actually being asked
Three different questions hide behind "data residency". Where is the data stored? — the country of the servers that hold any copy. Who can reach it? — including a vendor's support staff abroad, since remote access is often treated the same as a transfer. Is a copy held at all? — a tool that queries your database in place and stores only the result on screen is a very different proposition from one that syncs your tables into its cloud.
Saudi Arabia's personal-data rules and its public-sector data standards, and the UAE's federal and free-zone data laws plus sector rules for banks and healthcare, each answer these questions differently for different kinds of data. What they share is that the buyer must be able to state, precisely, where the data sits and who can reach it.
The three deployment options
- On your own servers — your data centre, a rack in the office, or a closed network. Nothing leaves. The strongest answer, and the one regulated and government-linked organisations usually want. Ask whether the self-hosted product is the full product and whether it phones home for licensing or usage.
- Your own cloud account in a region you choose — the major cloud providers now run regions in the UAE and Qatar, with Saudi regions expanding. You control the account; the vendor installs and supports.
- The vendor's cloud, querying in place — acceptable for many private companies if the tool sends each question to your database and holds no copy; ask exactly what is stored, where, and for how long, including caches and scheduled report files.
What a vendor must be able to answer
- Is the self-hosted edition the full product, with the same features, AI included?
- Does the product make any outside connection — licence checks, telemetry, error reporting, AI calls — and can each be switched off?
- When connected live, what is stored: query results, caches, exports, scheduled PDFs? Where, and for how long?
- Can the AI assistant run on a model inside our network, or does every question leave?
- Who at the vendor can reach our installation, from where, and is that access logged?
- Does the interface work in Arabic, right to left, for the board and government users who will read it?
A simple test
Ask for the product to be installed on a machine with no internet access and to run a dashboard. If it works, the vendor's "no call-home" claim is true. If it needs a licence server or an activation call, it is not.
Where Klayara fits. Klayara runs on your own servers or in the cloud region you choose, is the same product self-hosted as in the cloud, makes no outside connection when the AI module is off or points at a model inside your network, queries live sources in place without copying, and runs in Arabic right to left. See self-hosting, security and permissions, and the Saudi Arabia and UAE pages.