How to Choose a Web Host: Start With Where the Data Is Stored

Before you compare disk speed and support hours, answer one question: which country will hold your customer records, and where will their backups sit? That answer settles half the decision, because it is the only hosting criterion governed by a published legal text rather than a technical preference. In Saudi Arabia some organisations must be served from inside the Kingdom and others need not be. In Egypt, storing customer data on a server abroad requires a licence from the Personal Data Protection Center before you start.

This guide orders the work of choosing a web host the way that protects your money and your calendar: data location first, then the hosting type, then the clauses you discover a year later. It is a technical and commercial explanation for business owners, not legal advice; your own position needs a lawyer who reads your activity and contracts.

Saudi Arabia: who must host locally, and who need not

A common shortcut says that "Saudi Arabia requires data localisation" for everyone. Published texts are more precise than that.

The Cloud Cybersecurity Controls issued by the National Cybersecurity Authority in October 2020 require, in control 2-3-م-1-10, that cloud services be provided from inside the Kingdom, covering the systems used "including storage, processing and disaster recovery centres". The next control extends that to monitoring and support systems. So the backup site and the disaster-recovery location are inside the obligation, not only the primary server.

That scope, though, is drawn tightly. Subscribers covered are government entities and their affiliated companies, plus private-sector entities that own, operate or host critical national infrastructure. The document lists, among examples explicitly outside scope, providers serving private-sector entities that neither own nor operate such infrastructure. An online store, a clinic or a mid-sized contractor is therefore not under these controls unless it is tied to a government entity or to critical infrastructure.

What governs everyone else is Article 29 of the Personal Data Protection Law. It does not ban transfers abroad; it makes them conditional on three published requirements: that the transfer not prejudice national security or the Kingdom's vital interests, that an adequate level of protection exists outside the Kingdom, and that the transfer be limited to the minimum personal data needed.

A separate Regulation on Personal Data Transfer Outside the Kingdom explains how that is satisfied. The competent authority publishes a list of countries offering an adequate level of protection and reviews it every four years. In the exemption cases, specific safeguards apply: standard contractual clauses, binding common rules, or an accreditation certificate, together with a written risk assessment before the transfer that covers the geographic scope of the processing.

When we reviewed SDAIA's knowledge centre on 21 September 2026, that country list did not appear among the published documents, while the standard contractual clauses and the transfer risk-assessment guideline did. In practice, a company hosting abroad builds its position on contractual safeguards and a risk assessment rather than on a country appearing in a list.

One more party belongs in the picture: the provider itself. The Cloud Computing Services Provisioning Regulations were issued by the Communications, Space and Technology Commission under decision 506/1445, adopted on 8 October 2023, and set out the obligations and rights of providers and of government and private-sector subscribers alike. If a provider offers cloud services inside the Kingdom, asking about its regulatory standing with the Commission is a fair question before you sign.

Egypt: this is a licensing matter, not a technical preference

Here the text is blunter. Article 14 of Personal Data Protection Law 151 of 2020.pdf), as published in the Official Gazette, prohibits transferring personal data collected or prepared for processing to a foreign country, or storing or sharing it there, except where protection is no lower than the level required by the law and with a licence or permit from the Center. Article 16 adds the licence requirement for making data available to another controller or processor outside Egypt. Breaching these articles carries, under Article 42, imprisonment of at least three months and a fine of EGP 500,000 to 5 million, or one of the two.

The operative word is "storing". Putting your database on a server in Frankfurt or Virginia falls inside the article even if you never send a file to anyone.

Its Executive Regulation was issued by decision 816 of 2025 of the Minister of Communications and Information Technology, published in Al-Waqa'i Al-Masriya issue 244 supplement (A) dated 1 November 2025, and its Article 2 states that it takes effect the day after publication. Its issuance started the compliance window the law grants, which our guide to customer data protection in Egypt and Saudi Arabia covers in detail.

Three provisions in that regulation bear directly on a hosting contract:

• The licence names the country. Article 16 obliges the controller or processor to transfer data to the country or countries stated in the licence, and to update the licence if other countries are added during its term. Moving your data to another region later goes through an amendment to the licence, not a setting in a control panel.
• The application form asks exactly where data is stored. Article 24 requires, for a cross-border transfer licence, a statement of the security systems and the storage locations, both temporary and final, and the measures protecting the data on its way to the final destination. A separate item repeats the requirement for sufficient detail about those temporary and final storage locations on the Center's forms.
• Timing and fees. The Center notifies the applicant of its decision within a period not exceeding 90 working days from completion of the documents, and no reply counts as a rejection (Article 26 of the Executive Regulation). The cross-border licence fee is 50% of the controller or processor licence fee (Article 27), and the schedule in Article 19 exempts anyone processing up to 100,000 personal records from the licence fee, and sets EGP 200 a year for 101,000 to 200,000 records.

Fees are not the obstacle here. That second provision is. Many cheap hosting plans cannot tell you which city the server sits in, or where your backups are copied, and that alone makes the form impossible to complete. Version 1.1 of the Center's Licenses and Permits Guidelines, dated 26 January 2026, confirms that the cross-border licence is supplementary and cannot be issued or stay valid without a general licence, that it expressly covers contracting with a cloud provider that processes or stores personal data on servers outside Egypt, and that appointing a data protection officer is a prerequisite for applying.

If you are considering a provider inside Egypt, building and operating data centres and providing hosting and cloud services falls under a regulatory framework approved by the National Telecom Regulatory Authority, so ask your provider about its licence: some sellers of "Egyptian hosting" are reselling servers abroad.

What this turns into on a call with a provider

Five questions compress the section above. Ask for the answers in writing.

1. Which country and city hosts the data centre that will hold my database and files?
2. Where are the backups kept, and do they leave that country?
3. Is data replicated to other locations for disaster recovery or temporary storage?
4. Who on the support team can reach the data, and from which country?
5. Do you commit to contractual data-protection clauses, and will you sign an addendum?

A provider who answers all five in one message saves you weeks later. One who dodges the second question in particular has earned its way off your list.

Hosting types: the difference that shows up on a bad day

Four tiers are familiar on paper. What matters is what happens when something breaks or traffic doubles without warning.

Shared hosting becomes the wrong decision as soon as one of these is true: you store customer data covered by the law and cannot name the country of storage; your system needs scheduled jobs and background queues; you run a selling season that multiplies traffic within hours; or an auditor or enterprise client asks you to demonstrate that your data is isolated. In those cases the gap between a five-dollar plan and a fifty-dollar one is not a saving but a postponed, more expensive problem.

Performance: what distance actually costs you

Distance sets a floor no server can beat, because the signal crosses cables and routers on the way out and back. Everything the browser does (a DNS lookup, a TLS handshake, then every API call) pays that trip again.

Microsoft publishes round-trip latency measurements between Azure regions. The current dataset is dated 30 July 2026 and reports the median over a thirty-day window. Between West Europe and UAE North the figure is 111 ms; between East US and UAE North it reaches 174 ms; between UAE North and Qatar Central it drops to 15 ms. These are measurements between data centres on Microsoft's own network, not from a phone on a mobile network in Jeddah or Mansoura, but they give you the order of magnitude: the trip to Europe is roughly seven times the trip within the Gulf, and a page that fires ten sequential requests pays that gap ten times over.

Closest regions available today to an Egyptian or Gulf audience, according to the providers' own documentation:

None of these lists shows a region inside Egypt as of the date we checked them. The Egyptian market is left with a nearby region in the Gulf or Europe, or a licensed data centre inside Egypt.

A content delivery network solves half the problem. It brings images, CSS and JavaScript close to the visitor and leaves every dynamic request (signing in, adding to cart, checking out) travelling the full distance to your origin. That is why server location still matters with a CDN in place, and what improves the page itself is in our website speed guide.

Two small items get forgotten until they bite. First, the domain must be in your company's name rather than the provider's or the developer's; .sa domains are registered through accredited registrars, each with its own price, since SaudiNIC publishes no single fee. Second, TLS certificates keep getting shorter: in April 2025 the CA/Browser Forum approved a schedule reducing the maximum certificate validity from 398 days to 47 days in stages beginning March 2026 and ending March 2029. Manual renewal will not survive that schedule, so ask plainly whether the host supports automated renewal over ACME.

Published prices, and what is not published

Numbers in most comparison guides are estimates, out of date, or drawn from affiliate pages. What can be verified today is limited, but enough to calibrate expectations.

Microsoft publishes its prices through a public retail prices interface that can be queried per region. Queried on 21 September 2026 for a Standard_D2s_v5 virtual machine on pay-as-you-go, the price was USD 0.118 per hour in UAE North and in Qatar Central, against 0.115 in West Europe and 0.096 in East US. For that size, hosting in the Gulf costs under 3% more than Western Europe, while the gap against US East approaches 23%. The belief that nearby hosting is "far more expensive" does not survive that number; what does survive is that moving away from both the Gulf and Europe saves money and costs latency.

At the other end of the market, AWS publishes Lightsail bundle prices plainly: the first bundle starts at USD 5 a month with 0.5 GB of memory, a 20 GB disk and 1 TB of transfer, and the general-purpose bundles run up to USD 1,764. The same page notes that transfer beyond the included allowance starts at USD 0.09 per GB and varies by region, which is the line that surprises media-heavy sites.

Regional providers specialising in managed services inside Saudi Arabia or Egypt mostly publish no public price and work from quotations. That is not a flaw in itself, but it means comparison requires two or three written quotes from you, each naming the geographic region, the CPU, memory and disk limits, the egress price, what support covers, and the renewal price. Any figure that does not come from an official pricing page or a signed quote stays a guess.

The clauses that hurt a year later

Backups, and who owns them

That usual reassurance, "the provider takes daily backups", hides a split of responsibility. The shared responsibility model puts the infrastructure on the provider while the customer remains responsible for the guest operating system, including its updates and security patches, and for managing their own data. The copy that brings you back after an application bug, an accidental deletion or a ransomware attack is your copy.

Ask the contract for four things: how often the backup is taken, how long it is kept, in which country, and whether you can download it in full whenever you want. Test a restore once before you need one; how to build the plan is in our website backup guide.

A published uptime figure is not an unconditional promise

Read the Amazon EC2 service level agreement as an example of what these numbers actually mean. The 99.99% region-level figure is conditional on running your instances across two or more availability zones; a single instance is covered at 99.5%. The large number on the marketing page describes an architectural commitment on your side, not a guarantee you buy with the plan.

When the provider misses the commitment, the remedy is a credit on your bill: 10% below 99.99%, 30% below 99%, and 100% below 95%, in the agreement's own words. It states plainly that those credits do not entitle you to a refund or any other payment, that you must submit the claim before the end of the second billing cycle after the incident, and that the agreement is your sole and exclusive remedy. In plain terms: two hours of downtime on a campaign day can cost you a full day of sales, and the provider compensates you with a tenth of the month's bill if you claim in time.

So do the arithmetic from your side: what does one hour of downtime cost you? If the number is large, the fix is engineering on your end: a design that survives one server failing, and backups you have tested.

The exit: the door you inspect before entering

Get five written confirmations before you sign: that you can download the full database in a standard format at any time; that site files and media are reachable over SSH or object storage; what it costs to move 100 GB of data out; that the domain account and DNS records are yours; and how much notice terminating the contract requires. These confirmations are free before signing and cost weeks afterwards.

First-year price versus renewal price

Always compare on the renewal price rather than the promotional one, and ask for the renewal price of every line: hosting, the domain, the certificate if it is paid, backups, and out-of-hours support. Ask for the renewal price to appear in the written quote.

A short list before you sign

• The country and city of the data centre, written into the quote.
• Where the backups live, how long they are kept, and your right to download them.
• The provider's regulatory standing with the competent authority in its country, and a licence number if one exists.
• The uptime commitment, its conditions, the credit value, and the claim window.
• Who patches the operating system and components, and how often.
• The egress price, and the renewal price of every line.
• Domain ownership and DNS records in your company's name.
• Support for automated TLS certificate renewal.
• A support channel with a written response time, not "24/7 support" left undefined.

When you choose a web host, the decision never proves itself on an ordinary day. It shows on the day a server fails, or the day an auditor asks you to prove where your customer data lives. Most of the pain on those two days is bought, or avoided, in the first hour of comparison.

If you are building a new system or reviewing an existing setup, send a description of what you have to the Snaabble team before you sign. Within 24 hours you will get a first sketch of the architecture that suits your size and market, together with an initial time and cost estimate, at no charge and with nothing owed. What we do is set out on our web development page.

Frequently asked questions

Am I legally required to host my website inside Saudi Arabia?

It depends who you are. The Cloud Cybersecurity Controls issued by the National Cybersecurity Authority require the service to be provided from inside the Kingdom, but their scope is government entities and their affiliates plus private-sector entities that own, operate or host critical national infrastructure. A private company outside that scope is governed by the Personal Data Protection Law and the transfer regulation, which permit transfers under conditions and safeguards rather than prohibiting them.

May I store my Egyptian customers' data on a server abroad?

Not without a licence or permit. Article 14 of Law 151 of 2020 prohibits transferring personal data to a foreign country, or storing or sharing it there, unless protection is no lower than the level required by the law and a licence or permit has been obtained from the Personal Data Protection Center. Article 42 penalises breaches with imprisonment of at least three months and a fine of EGP 500,000 to 5 million, or one of the two.

How long does an Egyptian cross-border transfer licence take?

Article 26 of the Executive Regulation states that the Center informs the applicant of approval or rejection within a period not exceeding 90 working days from the date all information and documents are complete, and that no reply counts as a rejection. Put that period in your project schedule rather than discovering it afterwards.

Are the backups included with hosting enough?

Not on their own. The shared responsibility model used by cloud providers places the infrastructure on the provider and leaves the operating system, the application and the data with the customer. Keep an independent copy outside the hosting account, and test restoring it regularly.

How should I read the uptime figure in a hosting contract?

The gap between 99.9% and 99.99% is the minutes allowed per month, but four details around it matter more: what the contract excludes, whether it requires a particular architecture on your side, how downtime is calculated, and what the credit is worth, how you claim it and within what window. The Amazon EC2 service level agreement is a good example of those details written out. The percentage alone, without them, is a marketing number.

Sources

• National Cybersecurity Authority: Cloud Cybersecurity Controls CCC-1:2020.
• SDAIA: Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom.
• Communications, Space and Technology Commission: Cloud Computing Services Provisioning Regulations.
• Egypt's Personal Data Protection Center: Law 151 of 2020.pdf), the Executive Regulation and the Licenses and Permits Guidelines.
• Provider documentation: regions at AWS, Google Cloud, Oracle and Azure; Azure inter-region latency; the Amazon EC2 SLA; Lightsail pricing.
• CA/Browser Forum: Ballot SC-081v3 on the certificate validity schedule.