Cybersecurity · Cloud compliance · Oman · UAE · Qatar · Saudi Arabia
Cloud compliance with Zoho, Microsoft and Google
Your email, files and business apps live in Zoho, Microsoft and Google data centres. We show you which certifications and in-country locations each vendor lists for your country, then configure the platform so it works the way your compliance team requires.
Why work with Gulf Infotech on cloud compliance?
Zoho Authorized PartnerMicrosoft Solutions Partner for Modern Work and Google Cloud Premier Partner: the platforms on this page are the ones we license, deploy and support every day.
Since 2007in the Middle East, with 1,500+ active cloud customers and offices in Muscat, Dubai and Doha.
We set up the account in the right place from day onethe country a Zoho account is created in, or the region a Microsoft 365 tenant is created in, decides where its data is stored.
Clear rolesthe vendor certifies its cloud; your compliance team decides your requirements; we configure the platform to match them.
Cloud compliance depends on the cloud that holds your data. Gulf Infotech deploys Zoho, Microsoft 365 and Google Workspace and Google Cloud, so your data sits in the vendor's certified data centres, under the vendor's own ISO/IEC 27001, SOC 2 and GDPR commitments. Zoho hosts in the UAE and Saudi Arabia, Microsoft 365 in the UAE, and Google Cloud in Qatar and Saudi Arabia.
- Scopeyour requirements
- Gap reviewidentities, devices, email
- Remediationcontrols deployed
- Evidence packfor your compliance team
Whose compliance matters when your data is in the cloud?
The vendor's. When you run Zoho, Microsoft 365 or Google Workspace, your mail, files and records are stored and processed in that vendor's data centres. The certifications auditors and customers ask about, such as ISO/IEC 27001 or a SOC 2 report, belong to the vendor's cloud, and each vendor publishes them on its own trust pages.
What stays with you is how the platform is set up: who can sign in and how, which devices hold company data, what can be shared outside the company, how long records are kept, and whether backups restore. That is the part we configure. The certifications listed below are the vendors' own statements, linked in the sources of this page.
Which certifications do Zoho, Microsoft and Google list?
Takeaway: the three vendors hold the same core ISO and SOC certifications, so the deciding questions are usually where your data is stored and how your account is configured. Verified administrators can download each vendor's certificates and audit reports from the vendor's own portal.
Vendor: Zoho
Certifications and reports the vendor lists: ISO/IEC 27001, 27017, 27018 and 27701; ISO 9001 and ISO 22301; SOC 1 Type 2 and SOC 2 Type 2; PCI DSS for Zoho Books, Invoice, Inventory, Billing, Expense, Checkout and Commerce
Privacy commitmentsZoho states that its offerings have privacy features that comply with the GDPR
Vendor: Microsoft 365
Certifications and reports the vendor lists: ISO/IEC 27001, 27017, 27018 and 27701; SOC 2 Type 2
Privacy commitmentsMicrosoft lists the GDPR among its compliance offerings; audit reports in the Microsoft Service Trust Portal
Vendor: Google Workspace and Google Cloud
Certifications and reports the vendor lists: ISO/IEC 27001, 27017, 27018 and 27701; SOC 2; CSA STAR Level 2
Privacy commitmentsGoogle commits in its contracts to comply with the GDPR for customer personal data in Google Cloud and Google Workspace
Where can your data stay in your country?
Takeaway: in the UAE and Saudi Arabia you can keep Zoho data in the country; in the UAE, Microsoft 365 data too. For Google Cloud workloads, Doha and Dammam are in-country regions for Qatar and Saudi Arabia. See in-country cloud hosting and data residency.
| Country | Zoho | Microsoft 365 | |
|---|---|---|---|
| UAE | Data centres in Dubai (primary) and Abu Dhabi (secondary), with SOC 1 and SOC 2 Type II, ISO 27001, ISO 22301 and PCI DSS, according to Zoho | A tenant created in the UAE stores its data in Microsoft's UAE data centres. For Microsoft's full commitment that data at rest stays in the UAE, for the services Microsoft lists, the tenant needs the Advanced Data Residency (ADR) licence | Global Google Workspace certifications apply |
| Saudi Arabia | Data centres in Riyadh (primary) and Jeddah (secondary). Zoho is a CST-registered, Class-B certified cloud provider, which Zoho says reflects the NCA's Essential and Cloud Cybersecurity Controls | Global Microsoft 365 certifications apply | Google Cloud Dammam region holds a CST Class C licence, based on an NCA assessment against the ECC and CCC, plus CSA STAR Level 2 |
| Qatar | Global Zoho certifications apply | Global Microsoft 365 certifications apply | Google Cloud Doha region: Qatar NIA v2.1 certification from the NCSA, covering data classifications C1 to C3, plus CSA STAR Level 2 |
| Oman | Global Zoho certifications apply | Global Microsoft 365 certifications apply | Global Google certifications apply |
How do we help you meet your compliance requirements?
Requirements
your compliance team or your customers tell us what must be met: where data is stored, who may access it, how long it is kept.
Platform and location
we match the requirement to the vendor and the data centre, for example a Zoho account in the UAE or Saudi data centre, or a Microsoft 365 tenant created in the UAE with ADR.
Configuration
multi-factor sign-in, admin roles, device management, sharing limits, retention, data loss prevention and email protection, set up on the platform you use.
Evidence
configuration exports and test records your team can keep on file, plus the vendor's own certificates and reports, which your administrators download from the vendor's portal.
Ongoing care
quarterly reviews and policy changes under a support contract.
What does a security and data controls review check?
The review is how we check and fix the part that is yours: the configuration. We look at sign-in security and admin accounts, the laptops and phones that hold company data, email protection against phishing and spoofing, sharing settings and labels, backups and restore tests, and the settings of your Microsoft 365, Google Workspace or Zoho account. You get a gap list with the fix and cost for each item, and we can deploy the fixes.
The first check, of what is publicly visible about your domain and email setup, is free. The full review of your Microsoft 365, Google Workspace or Zoho setup, with a written report, is a paid service quoted after scoping. Licences, deployment, migration, training and support are separate, paid components.
Cloud compliance and security by country
Frequently asked questions
Not sure where to start? We review your current setup with you.
Is Zoho compliant in the UAE and Saudi Arabia?
Zoho runs data centres in both countries: Dubai and Abu Dhabi in the UAE, and Riyadh and Jeddah in Saudi Arabia. In Saudi Arabia, Zoho is a CST-registered, Class-B certified cloud provider, which Zoho says reflects the NCA's Essential and Cloud Cybersecurity Controls. Zoho also lists ISO/IEC 27001, 27017, 27018 and 27701 and SOC 2 Type 2 for its cloud services.
Does Microsoft 365 keep data in the UAE?
A tenant created in the UAE stores its data in Microsoft's UAE data centres. For Microsoft's full commitment that data at rest stays in the UAE, for the services Microsoft lists, the tenant needs the Advanced Data Residency (ADR) licence on all of its paid licences. A tenant created elsewhere moves to the UAE only by migrating to a new UAE tenant, which we do as a paid project.
Which Google Cloud regions are in Qatar and Saudi Arabia?
Google Cloud runs a Doha region in Qatar and a Dammam region in Saudi Arabia. According to Google, the Doha region is covered by Qatar's NIA v2.1 certification for data classifications C1 to C3, and the Dammam region holds a CST Class C licence based on an NCA assessment. Both carry CSA STAR Level 2 certification.
Is Gulf Infotech itself certified?
The certifications that apply to your data are your vendor's, because your data is stored in Zoho, Microsoft or Google data centres, not on Gulf Infotech servers. Our part is choosing the right vendor and location for your requirements and configuring the account securely. Your compliance team and advisers decide which requirements apply to your business.
Do Microsoft 365, Google Workspace and Zoho comply with the GDPR?
Each vendor states its own GDPR position. Microsoft lists the GDPR among its compliance offerings, Google commits in its contracts to comply with the GDPR for customer personal data in Google Cloud and Google Workspace, and Zoho states that its offerings have privacy features that comply with the GDPR. Your compliance team decides how the GDPR applies to your business, and we configure the platform to match.
How do we get the vendor's certificates for an audit?
Each vendor publishes its certificates and audit reports on its own trust portal. Zoho lets verified organisation administrators download them from the Zoho Accounts compliance page after accepting an online NDA; Microsoft publishes them in its Service Trust Portal; Google offers them through its Compliance Reports Manager. We show your administrator where to find each one.
Start with a compliance review
Tell us which platforms you use, where your users are and what your customers or compliance team require. We will show you where your data sits today and what we would change.