Biruni
Talk to usRequest access

Research · Notes

Sovereignty is the procurement answer

GCC IRBs and university IT increasingly reject studies that export citizen data to EU/US clouds. Residency has to be architectural.

← All notes

Source: docs/00-executive/vision-strategy.md §3; docs/02-architecture/security-compliance.md

The forcing function

Saudi PDPL (SDAIA), UAE Federal Decree-Law No. 45 of 2021, and Egypt’s Law No. 151 of 2020 make cross-border participant data a real blocker — not a paperwork afterthought.

How Biruni answers

Participant data is written and retained in AWS me-central-1 (Riyadh) by default, with consent, minimization, and audit as schema properties. PDPIA and IRB kits generate per study; participants get a DSAR portal.

Roadmap honesty

A UAE region (me-south-1) is planned in Phase 3 of the roadmap so Emirati institutions get the same residency answer locally. It is not live yet.