Compliance.

Where CyberListen is operating from the Kingdom, these pages follow the law of the Kingdom.

A foreign regime applies only when its own rules say it does. The Wassenaar Arrangement does not, by itself, bind a Saudi company. The US International Traffic in Arms Regulations do not attach to every line of code written in Riyadh. Where we adopt a rule, we say it is our own. Where US jurisdiction actually attaches, compliance is a legal duty.

A certificate is a document from an authority. Nothing on this site is that document.

Personal data is governed by the Personal Data Protection Law, Royal Decree No. M/19 dated 9/2/1443H, as amended by Royal Decree No. M/148 dated 5/9/1444H, the Implementing Regulations, and the Regulation on the Transfer of Personal Data Outside the Kingdom. The competent authority is SDAIA.

The practical rules are on the privacy page. In short: minimize, do not treat a destination as adequate until SDAIA has listed it. Where a safeguard is required, it has to be one the Transfer Regulation recognises.

The Anti-Cyber Crime Law, Royal Decree No. M/17 dated 8/3/1428H (26 March 2007), is a hard limit. We do not develop, supply, or assist a tool whose purpose is unauthorised access or other conduct that law criminalizes.

“Law enforcement” is not, by itself, authority. The customer needs a lawful basis for the particular material and the particular system. If that cannot be stated, we decline the work.

The National Cybersecurity Authority is the national authority for cybersecurity. Its instruments do not all apply to every private company.

For our own operation we intend a baseline proportionate to the Cybersecurity Controls for Non-Critical National Infrastructure Private Sector Entities (NCNICC-1:2025). Naming that instrument is not a certificate, and it is not a statement that the Authority has assessed us.

Where a customer or a system is in scope of a national instrument, that instrument is named in the contract. The ones we expect to meet in that case are the Essential Cybersecurity Controls (ECC-2:2024) and, where their own scope is met, the Critical Systems, Data, and Cloud Cybersecurity Controls.

This website is not a public cloud under the Communications, Space and Technology Commission Cloud Computing Regulatory Framework. If an engagement hosts government or classified data, the location, the classification, and any CST or NCA cloud control are written into the contract.

The Kingdom does not publish one dual-use list that copies the Wassenaar lists. Controls are real, but they are organized by commodity and by authority.

The Law of Weapons and Ammunition, Royal Decree No. M/45 dated 25/7/1426H (30 August 2005), and the Ministry of Interior’s implementing regulations, govern weapons and ammunition. They are not a general software-export law. The Kingdom has also notified the World Trade Organization of an export restriction on specified arms and ammunition (G/MA/QR/N/SAU/2, 24 October 2024), administered by the Ministry of Interior.

Customs controls apply under the GCC Common Customs Law as implemented in the Kingdom, with the Zakat, Tax and Customs Authority. We comply with every restriction that touches a shipment or a person. Because those rules do not give a company a Wassenaar-style software list, we apply the Wassenaar lists ourselves. That is a choice. It is not a claim that the Kingdom has enacted those lists.

The Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies is voluntary among its Participating States. The plenary chair’s statement of 4 December 2025 records 42 Participating States. Saudi Arabia is not one of them. The Arrangement does not, by its own force, bind a company established only in the Kingdom.

We bind ourselves to the lists anyway. Before software or technology crosses a border — by download, by remote access, or in a person’s head — we classify it against the current Munitions List and the List of Dual-Use Goods and Technologies.

The General Technology Note controls technology required for the development, production or use of a listed item, as that note is written. The General Software Note is a decontrol: it excludes software that is generally available to the public, or that is in the public domain, from the dual-use list. It does not itself impose a control. We do not treat those two notes as the same rule.

Intrusion software and related technology sit in Category 4. IP network communications surveillance systems sit in Category 5 Part 1. They are not the same control. We do not supply either class of item. A transfer that would meet a listed parameter does not proceed unless the competent authority of the state the transfer leaves has authorised it. If no such authority exists, the transfer does not happen.

An unlisted item is still refused if we know it is intended for a weapons-of-mass-destruction programme or a military end use the exporting state’s law prohibits.

The International Traffic in Arms Regulations, 22 CFR Parts 120 to 130, are administered by the Directorate of Defense Trade Controls. They control defense articles on the United States Munitions List (22 CFR § 121.1), technical data, and defense services. A release of technical data to a foreign person can be a deemed export.

ITAR is not a Saudi law, and it does not attach to every Saudi product. It attaches when its own jurisdictional rules are met.

Saudi Arabia was designated a major non-NATO ally (91 FR 3017, 13 January 2026), reflected in 22 CFR § 120.23. That status can matter to licensing policy. It is not a license, and it is not an exemption.

Where an item or defense service is subject to ITAR, we will not export, reexport, retransfer, broker, or release it except under the required authorization. If an activity would require registration under 22 CFR Part 122, it is not started unless that registration is in place.

Most US Wassenaar dual-use controls sit in the Export Administration Regulations, 15 CFR Parts 730 to 774, administered by the Bureau of Industry and Security. The Commerce Control List is the first place a dual-use item of US origin is classified.

Foreign-produced items can be subject to the EAR under the foreign direct product rules, or when they contain more than a de minimis level of controlled US content. We assess that before a cross-border release of a build that incorporates, or was produced with, US-origin technology.

EAR99 is not a permission to ship. Sanctions and end-use rules can still prohibit the transfer.

The split we use: if it is on the US Munitions List, ITAR; if it is dual-use and subject to US jurisdiction, the EAR; if it is neither, the Wassenaar lists still apply as our own rule, and Saudi restricted-goods rules still apply as law.

We do not deal with a party or a destination when the laws of the Kingdom prohibit it, or when a United Nations sanction implemented in the Kingdom prohibits it. Where US jurisdiction attaches, we also comply with the applicable Office of Foreign Assets Control sanctions. We do not describe ourselves as a US person for a transaction that never touches US jurisdiction.

Before a cross-border release we expect the end user, the end use, and the destination, and we screen the parties. A red flag we cannot clear stops the transfer. Personnel outside the Kingdom do not receive controlled technology unless the classification allows that specific access.

We will not intercept communications or access a system without the client’s authority. Customer-authorised log collection, forensic acquisition and analysis of material the client is entitled to provide are ordinary parts of the services. We will not supply intrusion software or an IP-network surveillance system that meets a listed parameter, except where a competent authority of the exporting state has actually authorised that transfer. We will not release ITAR technical data or an EAR-controlled item without the US authorisation that item requires. We will not ship a good the Ministry of Interior or customs has restricted, without the licence that restriction requires.