Home/GCC data residency
GCC data residency
Where tick. stores and processes customer data across Gulf Cooperation Council markets.
Last updated: June 2026
Our approach
tick. is designed for SMEs operating in Qatar, Saudi Arabia, UAE, and neighbouring GCC markets. We prioritize hosting and subprocessors that support regional data residency expectations and contractual data processing agreements (DPAs).
Infrastructure
- Application database & auth — Supabase project region selected at provisioning (typically EU or US West for current pilots; enterprise plans may request region pinning subject to provider availability).
- File storage — Receipts, exports, and invoice PDFs stored in tenant-scoped buckets with row-level security policies.
- Payments — Stripe processes billing metadata; card data never touches tick. servers (Stripe security documentation).
Cross-border transfers
Where data leaves your country, we rely on standard contractual clauses and subprocessors with SOC 2 / ISO 27001 certifications. Enterprise customers may request a data processing addendum listing sub-processors.
Regional regulations
- Qatar — Communications Regulatory Authority (CRA) personal data protection framework.
- UAE — Federal Decree-Law No. 45 of 2021 on Personal Data Protection (UAE Government portal).
- KSA — Personal Data Protection Law (PDPL) via SDAIA.
Data subject requests
Export and deletion requests can be initiated via privacy@tick.app. We respond within statutory timeframes applicable to your jurisdiction.