Tools & resources · Saudi hosting

What changes if…?

Change one assumption in a fictional service and see what happens to the four proposed scopes. Every result explains its reasoning and the evidence still missing.

01 / Choose a fictional starting point

The six cases follow section 15 of the supplied proposal. All unmodified components are explicitly assumed local; real projects need dated evidence.

Or test a difficult boundary

Local interface and chat-history database; required AI inference abroad; provider retention unknown. Storage remains unresolved.

02 / Change an assumption

Backup location

Delivery / TLS location

Live support access

Retained logs / telemetry

AI inference location

AI provider retention

This service requires AI inferenceAPI-only service, with no hosted interface filesAssume the entire required component inventory is knownTurn this off to see how a missing inventory blocks a supported result.

Edit the complete component inventory

Processing, every retained copy, delivery and access are separate facts. An encrypted overseas copy still has an overseas location.

Interface files

Authoritative interface origin

Every retained copy

Evidence environment

Application API

Processing

Every retained copy

Fallback / recovery processing

Evidence environment

Database and replicas

Processing

Every retained copy

Evidence environment

Encrypted backup

Every retained copy

Evidence environment

Logs and telemetry

Processing

Every retained copy

Evidence environment

Delivery and edge

Delivery and TLS termination

Processing

Every retained copy

Evidence environment

Required service dependencies

Processing

Every retained copy

Evidence environment

Live operational support

Operational access

Every retained copy

Live viewing only; no support downloads or retained copies / عرض مباشر فقط دون تنزيل أو نسخ محفوظة لدى الدعم

Evidence environment

Keys and management services

Processing

Every retained copy

Operational access

Evidence environment

Required AI inference

Processing

Every retained copy

Fallback / recovery processing

Evidence environment

03 / See what changes

Boundary: the fictional production service, including necessary partners. Customer devices and mere public internet transit are excluded.

0 scope outcomes changed from the selected case.

Unchanged

Frontend Origin

Supported under these assumptions

All required facts for this scope are assumed local. This is a hypothetical result, not production verification.

Read component reasons

Interface files: Authoritative interface origin is in Saudi Arabia under the supplied fictional assumptions.

Unchanged

Backend Processing

Contradicted under these assumptions

Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.
Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.

Read component reasons

Application API: Processing is in Saudi Arabia under the supplied fictional assumptions.
Application API: Fallback / recovery processing is in Saudi Arabia under the supplied fictional assumptions.
Database and replicas: Processing is in Saudi Arabia under the supplied fictional assumptions.
Logs and telemetry: Processing is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Processing is in Saudi Arabia under the supplied fictional assumptions.
Required service dependencies: Processing is in Saudi Arabia under the supplied fictional assumptions.
Keys and management services: Processing is in Saudi Arabia under the supplied fictional assumptions.
Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.
Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.

Unchanged

Stored Data

Not enough information

Required AI inference: Every retained copy has no complete location evidence.

Read component reasons

Interface files: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Application API: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Database and replicas: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Encrypted backup: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Logs and telemetry: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Required service dependencies: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Live operational support: Every retained copy is outside this function: Live viewing only; no support downloads or retained copies / عرض مباشر فقط دون تنزيل أو نسخ محفوظة لدى الدعم
Keys and management services: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Required AI inference: Every retained copy has no complete location evidence.

Unchanged

Full Service

Contradicted under these assumptions

Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.
Required AI inference: Every retained copy has no complete location evidence.
Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.

Read component reasons

Interface files: Authoritative interface origin is in Saudi Arabia under the supplied fictional assumptions.
Interface files: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Application API: Processing is in Saudi Arabia under the supplied fictional assumptions.
Application API: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Application API: Fallback / recovery processing is in Saudi Arabia under the supplied fictional assumptions.
Database and replicas: Processing is in Saudi Arabia under the supplied fictional assumptions.
Database and replicas: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Encrypted backup: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Logs and telemetry: Processing is in Saudi Arabia under the supplied fictional assumptions.
Logs and telemetry: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Delivery and TLS termination is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Processing is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Required service dependencies: Processing is in Saudi Arabia under the supplied fictional assumptions.
Required service dependencies: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Live operational support: Operational access is in Saudi Arabia under the supplied fictional assumptions.
Live operational support: Every retained copy is outside this function: Live viewing only; no support downloads or retained copies / عرض مباشر فقط دون تنزيل أو نسخ محفوظة لدى الدعم
Keys and management services: Processing is in Saudi Arabia under the supplied fictional assumptions.
Keys and management services: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Keys and management services: Operational access is in Saudi Arabia under the supplied fictional assumptions.
Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.
Required AI inference: Every retained copy has no complete location evidence.
Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.
Stored Data remains unresolved; Full Service requires every applicable scope.

Advisory evidence review — no badge issued

These are independent proposal criteria, not legal classifications or a compliance verdict.

Fictional scenario under proposed rules — not a scan of your website. Results follow only if the stated assumptions are true.

Ownership, sovereignty, legal applicability and data-transfer conditions require separate review.

04 / Turn evidence gaps into questions

Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.

Affected scopes: Backend Processing, Full Service
Who can supply it: Infrastructure owner and service provider
Ask this question: For Required AI inference in production, which countries are involved in Processing? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Useful evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.

Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.

Affected scopes: Backend Processing, Full Service
Who can supply it: Infrastructure owner and service provider
Ask this question: For Required AI inference in production, which countries are involved in Fallback / recovery processing? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Useful evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.

Required AI inference: Every retained copy has no complete location evidence.

Affected scopes: Stored Data, Full Service
Who can supply it: Infrastructure owner and service provider
Ask this question: For Required AI inference in production, which countries are involved in Every retained copy? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Useful evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.

Stored Data remains unresolved; Full Service requires every applicable scope.

Affected scopes: Full Service
Who can supply it: Service owner and infrastructure owner
Ask this question: For the service in production, which countries are involved in the service boundary and its dependencies? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Useful evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.

Editable provider email

A template generated from the current scenario. Review and edit it before using it. No message is sent by this page.

Subject: Hosting-location and service-boundary evidence request

Hello,

We are preparing an advisory review of “Fictional Saudi service / خدمة سعودية افتراضية”. Please clarify the following without sending secrets or customer records:

1. For Required AI inference in production, which countries are involved in Processing? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Requested evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.
2. For Required AI inference in production, which countries are involved in Fallback / recovery processing? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Requested evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.
3. For Required AI inference in production, which countries are involved in Every retained copy? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Requested evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.
4. For the service in production, which countries are involved in the service boundary and its dependencies? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Requested evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.

Advisory evidence review — no badge issued
Proposal policy: saudi-hosted-draft-1.0
Source bundle: saudi-hosting-sources-2026-10-03.2
Fictional scenario under proposed rules — not a scan of your website. Results follow only if the stated assumptions are true.

01 / Choose a fictional starting point

The six cases follow section 15 of the supplied proposal. All unmodified components are explicitly assumed local; real projects need dated evidence.

Or test a difficult boundary

Local interface and chat-history database; required AI inference abroad; provider retention unknown. Storage remains unresolved.

03 / See what changes

Boundary: the fictional production service, including necessary partners. Customer devices and mere public internet transit are excluded.

0 scope outcomes changed from the selected case.

Unchanged

Frontend Origin

Supported under these assumptions

All required facts for this scope are assumed local. This is a hypothetical result, not production verification.

Read component reasons

Interface files: Authoritative interface origin is in Saudi Arabia under the supplied fictional assumptions.

Unchanged

Backend Processing

Contradicted under these assumptions

Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.
Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.

Read component reasons

Application API: Processing is in Saudi Arabia under the supplied fictional assumptions.
Application API: Fallback / recovery processing is in Saudi Arabia under the supplied fictional assumptions.
Database and replicas: Processing is in Saudi Arabia under the supplied fictional assumptions.
Logs and telemetry: Processing is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Processing is in Saudi Arabia under the supplied fictional assumptions.
Required service dependencies: Processing is in Saudi Arabia under the supplied fictional assumptions.
Keys and management services: Processing is in Saudi Arabia under the supplied fictional assumptions.
Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.
Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.

Unchanged

Stored Data

Not enough information

Required AI inference: Every retained copy has no complete location evidence.

Read component reasons

Interface files: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Application API: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Database and replicas: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Encrypted backup: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Logs and telemetry: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Required service dependencies: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Live operational support: Every retained copy is outside this function: Live viewing only; no support downloads or retained copies / عرض مباشر فقط دون تنزيل أو نسخ محفوظة لدى الدعم
Keys and management services: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Required AI inference: Every retained copy has no complete location evidence.

Unchanged

Full Service

Contradicted under these assumptions

Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.
Required AI inference: Every retained copy has no complete location evidence.
Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.

Read component reasons

Interface files: Authoritative interface origin is in Saudi Arabia under the supplied fictional assumptions.
Interface files: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Application API: Processing is in Saudi Arabia under the supplied fictional assumptions.
Application API: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Application API: Fallback / recovery processing is in Saudi Arabia under the supplied fictional assumptions.
Database and replicas: Processing is in Saudi Arabia under the supplied fictional assumptions.
Database and replicas: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Encrypted backup: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Logs and telemetry: Processing is in Saudi Arabia under the supplied fictional assumptions.
Logs and telemetry: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Delivery and TLS termination is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Processing is in Saudi Arabia under the supplied fictional assumptions.
Delivery and edge: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Required service dependencies: Processing is in Saudi Arabia under the supplied fictional assumptions.
Required service dependencies: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Live operational support: Operational access is in Saudi Arabia under the supplied fictional assumptions.
Live operational support: Every retained copy is outside this function: Live viewing only; no support downloads or retained copies / عرض مباشر فقط دون تنزيل أو نسخ محفوظة لدى الدعم
Keys and management services: Processing is in Saudi Arabia under the supplied fictional assumptions.
Keys and management services: Every retained copy is in Saudi Arabia under the supplied fictional assumptions.
Keys and management services: Operational access is in Saudi Arabia under the supplied fictional assumptions.
Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.
Required AI inference: Every retained copy has no complete location evidence.
Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.
Stored Data remains unresolved; Full Service requires every applicable scope.

Advisory evidence review — no badge issued

These are independent proposal criteria, not legal classifications or a compliance verdict.

Fictional scenario under proposed rules — not a scan of your website. Results follow only if the stated assumptions are true.

Ownership, sovereignty, legal applicability and data-transfer conditions require separate review.

04 / Turn evidence gaps into questions

Required AI inference: Processing includes US outside Saudi Arabia under the supplied facts.

Affected scopes: Backend Processing, Full Service
Who can supply it: Infrastructure owner and service provider
Ask this question: For Required AI inference in production, which countries are involved in Processing? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Useful evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.

Required AI inference: Fallback / recovery processing includes US outside Saudi Arabia under the supplied facts.

Affected scopes: Backend Processing, Full Service
Who can supply it: Infrastructure owner and service provider
Ask this question: For Required AI inference in production, which countries are involved in Fallback / recovery processing? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Useful evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.

Required AI inference: Every retained copy has no complete location evidence.

Affected scopes: Stored Data, Full Service
Who can supply it: Infrastructure owner and service provider
Ask this question: For Required AI inference in production, which countries are involved in Every retained copy? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Useful evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.

Stored Data remains unresolved; Full Service requires every applicable scope.

Affected scopes: Full Service
Who can supply it: Service owner and infrastructure owner
Ask this question: For the service in production, which countries are involved in the service boundary and its dependencies? Include relevant fallback, copies and access, the evidence date and its limits. If a condition does not apply, what is the written justification?
Useful evidence: Actual resource configuration with a dated provider statement, a copy/dependency inventory and relevant access records. Marketing descriptions alone are insufficient.

Editable provider email

A template generated from the current scenario. Review and edit it before using it. No message is sent by this page.

Subject: Hosting-location and service-boundary evidence request

Hello,

We are preparing an advisory review of “Fictional Saudi service / خدمة سعودية افتراضية”. Please clarify the following without sending secrets or customer records: