Data residency and compliance
Sahifa exists so that Saudi companies can generate customer documents without the content leaving the Kingdom. This page sums up what that means for your compliance file. It describes the service, not legal advice: whether it meets your obligations is for your compliance team to decide.
The commitment
- Every API request is processed on servers in Saudi Arabia: Oracle Cloud Infrastructure, Jeddah region (
me-jeddah-1). - The HTML, URLs and parameters you send, and the PDFs and images produced, are handled in memory and discarded when the response has been sent. They are never written to disk, logged, cached or backed up.
- There is no CDN, proxy or load balancer outside the Kingdom between your systems and the renderer. TLS ends on the server in Jeddah.
- One exception is under your control: if your document asks the renderer to load a page, image or font hosted elsewhere, that request goes to where it is hosted. Embed resources in the HTML, or host them in the Kingdom, to keep everything inside.
The full list of where each part of the service runs, including the account database, backups, email and the website chat, is on the data residency page.
How this relates to Saudi regulation
| Framework | What it expects | How Sahifa supports it |
|---|---|---|
| SAMA Cyber Security Framework and outsourcing rules (banks, payment and fintech companies licensed by SAMA) | Customer data handled by a third party stays in the Kingdom unless approved otherwise; the outsourcing is documented and auditable. | Processing only in Jeddah, no storage, a signed data processing agreement and a signed data residency letter for your outsourcing file. |
| Personal Data Protection Law (PDPL) and its regulations on transfer outside the Kingdom (SDAIA) | Personal data is transferred abroad only under the conditions of the law. | Document content is not transferred abroad and not retained. Sahifa acts as a processor under the data processing agreement. |
| ZATCA e-invoicing | Invoices carry the required fields and QR code; the PDF copy matches the cleared invoice. | Sahifa renders your HTML exactly, including Arabic text and the QR code you supply. It does not issue or clear invoices. See Arabic documents. |
Documents for your auditor
- Data processing agreement: read it at /en/dpa or download the PDF (English, Arabic). On the Compliance plan we sign it with you.
- Data residency letter: a signed statement on company letterhead of where processing takes place, included in the Compliance plan.
- Security and data handling: what is logged, what is never stored, and how the renderer is isolated: security.
- Sub-processors: listed on the data residency page and in the agreement. Customers with a signed agreement are told at least 30 days before a change.
Who operates the service
Sahifa is operated by Yimello LLC, a software company registered in the United Arab Emirates. Administration happens over encrypted SSH to the server in Jeddah, only when needed to run the service. Questions from compliance teams are welcome at support@sahifa.dev.