Digital Sovereignty · UAE data sovereignty

Tenderd: a Control Tower-governed, region-locked AWS landing zone in the UAE

Sovereign in-country landing zonePolicy-enforced region lockData residencyMulti-account segmentationPreventive controlsCentralized immutable audit loggingCentralized workforce identityIdentity federation & MFA enforcementEncryption-at-rest enforcementPrivate connectivity & network isolationInfrastructure-as-code foundationCI/CD delivery pipeline automationDay-2 runbooks & team enablementCloud-to-cloud migrationPhased cutover with parity validationContainer platform modernizationConnected device telemetry & alertingInfrastructure observabilitySecrets management & credential eliminationMigration TCO & business case modellingTarget-state architecture design & costed POC

Eligible

UAE public-sector contracts unlocked by in-country residency

2 → 5

governance and security maturity, five-point CAF scale

standing console access — every change through reviewed Terraform

AWS Organizations (SCPs)AWS UAE Region (me-central-1)AWS IAM Identity CenterAWS CloudTrail

Tenderd’s fleet and heavy-equipment SaaS pursues public-sector and government work that mandates in-country data. VeUP’s answer is sovereignty by construction: an AWS estate where Service Control Policies deny every region except me-central-1, the audit trail cannot be deleted, root access keys are blocked, MFA and encryption at rest are mandatory — data residency enforced by policy that an auditor can read, not by a configuration someone remembered.

The challenge

For UAE public-sector and regulated enterprise contracts, “our data stays in the country” is a claim that must survive procurement scrutiny. Conventional residency — deploying in-region and trusting nobody launches elsewhere — fails that test: one engineer, one console session, one us-east-1 default and the claim is false. Tenderd needed residency it could warrant contractually: technically impossible to violate, continuously provable, and covering not just application data but the audit records that prove the controls themselves.

The solution

VeUP built the estate sovereign-by-design. At the organization root, Service Control Policies deny all AWS regions except me-central-1 — residency enforced above every account, unoverridable from inside them. The same policy layer blocks root-user access keys, mandates MFA, requires encryption at rest, and protects the audit trail: CloudTrail and AWS Config cannot be disabled or deleted by anyone the SCPs govern. Identity federates from Google Workspace through IAM Identity Center via SAML, so access is centrally granted and centrally revoked; a hub-and-spoke Transit Gateway network connects the multi-account structure; and CloudTrail, Config, and GuardDuty findings centralize into a dedicated log-archive account with immutable long-term retention. The operating model is infrastructure-as-code only — no non-admin console mutation — so every change to the sovereign posture is itself an auditable artifact. A prior in-region pilot migration on Amazon ECS Fargate validated the path before the production commitment.

Production outcomes

KPI	Result
Residency enforcement	100% of the estate region-locked to me-central-1 by Service Control Policy — a deny-by-default control no account inside the organization can override, and a one-line answer to any procurement audit.
Audit integrity	Tamper-protected CloudTrail/Config with centralized, immutable log archive — the evidence chain for the sovereign posture is itself sovereign and undeletable.
Commercial eligibility	In-country residency and policy-enforced governance qualify the platform for public-sector and government tenders that mandate national data residency — the sovereignty posture as market access.
Lessons & continuation	Sovereignty is a control-plane property: enforce residency above the accounts (SCP), protect the audit trail from its own administrators, and run IaC-only — then residency claims become verifiable statements about policy, not assurances about behavior.

AWS services in production

AWS Organizations (Service Control Policies)AWS Control TowerAWS UAE Region (me-central-1)AWS IAM Identity Center (SAML federation)AWS Transit GatewayAWS CloudTrailAWS ConfigAmazon GuardDutyAWS KMSAmazon ECS (Fargate)