Oasis Stack Oasis Stack A CloudHost Initiative
EN
Talk to us

Same cloud.
Higher
confidence.

Governance, Security & Compliance

Control built into the cloud.

Bring identity, access, policy, security, compliance and audit into one governance layer. Apply controls consistently from the organisation and estate down to every unit and resource, without slowing your cloud.

Explore Governance View security architecture
  • Stronger security
    by design
  • Simpler
    compliance
  • Clear operational
    control
  • Trust for
    what's next

The challenge

Cloud governance is often fragmented.

Identity sits in one system, security policies in another and permissions inside each platform. Compliance is tracked separately and audit evidence is collected by hand. As environments grow, operators are left connecting them.

  • IdentityUsers, SSO, MFA
  • AccessRoles, privileges
  • SecurityNetwork, workloads, secrets
  • PolicyRules, controls
  • ComplianceFrameworks, evidence
  • AuditEvents, reports
Governance layerIdentifyControlProtectVerifyEvidence

One governance model across your entire cloud.

OutcomeGovernance becomes part of every cloud operation.

Governance hierarchy

Put controls where they belong.

Organisation policy → Estate policy → Unit policy → Resource control

Governance follows the Oasis Stack hierarchy, from the business level down to individual resources. Define governance at the right level and apply it consistently below.

  1. OrganisationBusiness governance
    • Corporate identity
    • Organisation administrators
    • Global policies
    • Commercial boundaries
    ExampleAcme Corporation
  2. EstateEnvironment governance
    • Security posture
    • Location policies
    • Service entitlements
    • Access boundaries
    • Compliance requirements
    ExampleProduction Estate
  3. UnitWorkload governance
    • User access
    • Application policies
    • Resource quotas
    • Secrets
    • Environment controls
    ExampleSAP Unit
  4. ResourcesTechnical controls
    • VMs and networks
    • Storage and databases
    • Kubernetes
    • GPU
    • Applications
    ExampleSAP-DB-01

Core capabilities

One governance layer. Eight connected capabilities.

An optional module, adopted when you need it. Oasis Core already provides sign-in, permissions and governed workflows; this module adds the full governance layer, applied to a VM, a cluster, a GPU job or a marketplace service in the same way.

  1. 01

    Identity & SSO

    One identity across the platform, with enterprise SSO, Microsoft Entra ID, Active Directory, Google Workspace and local identities.

  2. 02

    Multi-Factor Authentication

    Added assurance for administrators, operators, customers, partners and privileged functions.

  3. 03

    Role & Access Control

    The right access for each person at organisation, estate, unit or resource level, and no more.

  4. 04

    Privileged Access & Secrets

    Credentials, certificates and service accounts held centrally and used inside workflows, not shared.

  5. 05

    Policy Management

    Governance requirements turned into policies enforced on every order, provisioning, access and change.

  6. 06

    Security Controls

    Segmentation, firewalls, private connectivity and workload security built into service delivery.

  7. 07

    Compliance Management

    Operational controls mapped to the frameworks your organisation needs to address.

  8. 08

    Audit & Evidence

    A contextual audit trail for operations, compliance reporting and investigations.

Identity and access with VirtueSuite

Identity that understands your cloud.

VirtueSuite, CloudHost's identity and access management service, is integrated into the module. Identity is not simply connected to Oasis Stack; it follows the organisation, estate and unit model, so users sign in once and reach services according to their scope and role.

Identity sources

  • Microsoft Entra ID
  • Active Directory and LDAP
  • Google Workspace
  • Local and national identity providers, per region
  • Local identities

VirtueSuite

  • SSO and SAML
  • MFA
  • Roles
  • Policies
  • Privileged access
  • Secrets

Oasis Stack and applications

  • Organisation
  • Estate
  • Unit
  • Resources
  • Oasis Stack, AppLite, cloud and enterprise applications

Access follows responsibility.

  1. Organisation administrator · all estates
  2. Estate administrator · Production Estate
  3. Unit administrator · SAP Unit
  4. Resource operator · selected resources

Governed by role, organisation, estate, unit, application, resource and action. Example roles.

Privileged access, held to a higher bar.

  • Two-person rule: privileged actions need a second approver
  • Every privileged session recorded in full
  • Credentials used inside automated workflows, not handed to operators
  • MFA required where the policy says so

Secrets and keys under your control.

  • Secrets, API credentials, service accounts and certificates held centrally
  • Keys and secrets managed by OpenBao with HSM-backed custody
  • Or keys brought and held by the customer

Policy inheritance

Define once. Inherit intelligently.

Policies set at the organisation flow down through estates and units to each resource, which carries the sum of everything above it. This is why the Organisation → Estate → Unit → Resources structure matters.

Organisation policyAcme Corporation
  • Approved regions: UAE and KSA
  • MFA required for administrators
EstateProduction Estate
  • Inherits organisation policy
  • Backup mandatory
  • Internet access restricted
UnitSAP Unit
  • Inherits organisation and estate
  • Database access private only
Effective controlsSAP-DB-01
  • Approved region
  • Administrator MFA
  • Backup enabled
  • Private database access
  • Restricted internet

Example policies.

Policy management

Governance moves from documents into operational control.

  • Location policyProduction workloads stay within approved regions.
  • Access policyProduction units require MFA for administrative access.
  • Service policyOnly approved service classes may be deployed in this estate.
  • Backup policyCritical workloads require protected backup.
  • Network policyInternet-facing resources require approved security controls.

From policy to evidence

Close the governance loop.

Deploy → Audit → Find problem → Remediate

Traditional compliance works backwards: deploy, audit, find the problem, remediate. Oasis Stack runs it forwards, so periodic compliance becomes continuous governance.

  1. 01RequirementRegulatory or business need
  2. 02ControlTechnical or operational control
  3. 03PolicyDefined in Oasis Stack
  4. 04EnforcementApplied in real time
  5. 05MonitoringContinuous visibility
  6. 06EvidenceAudit-ready records
  7. 07ReportCompliance reports
  8. 08ImproveContinuous optimisation

Governance at provisioning time

Prevent first. Detect second.

Every request is checked for identity, placement, entitlement, policy, compliance and security before anything is deployed, and the decision is recorded. Every deployment starts with context and control.

  1. 01RequestDeploy a VM
  2. 02IdentityWho is requesting?
  3. 03Estate & UnitWhere does it belong?
  4. 04EntitlementCan they consume it?
  5. 05PolicyIs it permitted?
  6. 06ComplianceDoes it meet controls?
  7. 07SecurityApply protection
  8. 08ProvisionDeploy
  9. 09AuditRecord decision and action
Traditional
  1. Request
  2. Security review
  3. Compliance review
  4. Infrastructure team
  5. Network team
  6. Approval
  7. Provision
Days or weeks.
Oasis Stack
  1. Request
  2. Automated governance Identity ✓Entitlement ✓Policy ✓Security ✓Quota ✓
  3. Provision
  4. Continuous monitoring
Control shouldn't mean more tickets. Embed it in automation instead of putting it in front.

Compliance in context

See compliance in operational context.

Requirements connect to controls, policies, resources and evidence, which is more useful than a wall of framework logos. The module helps you meet a framework; certification stays with the operator.

Compliance management

From framework to evidence.

Framework→Requirement→Control→Policy→Resource→Evidence

Mapped today: NCA ECC and PDPL, with Oditr, CloudHost's compliance as a service, integrated. Further frameworks you may need to address are mapped to the same control set on request, as additional scope:

  • ISO 27001
  • ISO 27017
  • ISO 27018
  • ISO 22301
  • CSA STAR
  • SAMA
  • NESA
  • ADHICS
  • GDPR
  • HIPAA

Listing a framework here does not mean CloudHost or Oasis Stack holds that certification.

Governance overview

Control coverage by areaExample

Identity & access
Data protection
Network security
Backup & resilience
Logging & monitoring

Framework → Controls → Estates → Units → Resources. Illustrative; no compliance score is implied.

Audit & evidence

Time14:32:18
UserOperations Admin
OrganisationAcme Corporation
Estate · UnitProduction · SAP
ResourceSAP-DB-01
ActionFirewall policy modified
ResultSuccessful

Who, what, when, where, and in which estate, unit and resource. Example record. Every action across all modules is recorded in an immutable trail.

Data protection

  • Encryption at rest and in transit, keys under your control
  • Classification and residency rules per dataset
  • Retention, deletion and legal hold

Threat detection

  • Workload, network and identity telemetry, with a SIEM feed through Observa and Oditr
  • Detection rules and anomaly signals, with Amin
  • Response playbooks tied to the estate and the service

Security controls

  • Network segmentation and firewall policies
  • Web application protection, private connectivity and VPN
  • Secure administrative access, log collection and monitoring

Available controls depend on the underlying infrastructure and integrated security providers.

Built for governance teams

Built for governance teams. Invisible to consumers.

Governance and security teams define the guardrails. Consumers work inside them and don't need to understand every policy underneath.

For governance and securityDefine the guardrails.
  • Set policies
  • Manage identities and control privileges
  • Define compliance requirements
  • Monitor controls
  • Review audit activity
  • Collect evidence and generate reports

Governance overviewExample

12Estates governed
48Units active
1,248Resources managed
36Policies active
For cloud consumersWork inside the guardrails.
  1. Select estate
  2. Select unit
  3. Choose service
  4. Configure
  5. Policy check
  6. Deploy
Deploy a service
EstateProduction Estate
UnitSAP Unit
ServiceGeneral Compute
Policy✓ Approved
Deploy

Sovereignty

Sovereignty is more than data location.

Control where data lives, and who can control it. Sovereignty covers six boundaries, not only an in-country data centre.

  • DataWhere does data reside?
  • OperationalWho operates the infrastructure?
  • IdentityWho controls identities and authentication?
  • SecurityWho defines and operates the controls?
  • TechnologyWhat platforms and dependencies are required?
  • GovernanceWho defines policies and compliance requirements?
Explore Oasis Sovereign Cloud
  • EnterpriseInternal governance and access
  • SovereignJurisdiction, identity and operational control
  • Service ProviderCustomer isolation, delegated administration
  • FederatedGovern what participates
  • Air-GappedNo external dependencies
  • AI CloudGPU, datasets and AI environments
  • Multi-CloudVisibility across connected clouds

See it running

From a policy to an audit report.

The posture view across estates, and a control written, enforced on a live order and reported as evidence.

Connected across Oasis Stack

Governance runs through the platform.

Governance doesn't sit beside Oasis Stack. Policies are written against Oasis Core's identity, organisation model and event stream, so one policy reaches every module without being re-implemented.

Build. Cloud Foundation. Run. Oasis Core. Accelerate. Infrastructure for AI. Control. Governance, Security & Compliance.

What Core provides and what this module adds
Governance, Security & Compliance
Oasis CoreIdentity context, estates, workflowsCloud FoundationInfrastructure policies and controlsInfrastructure for AIGPU access and AI isolationDigital TransformationApplication identities and accessCloudSouqMarketplace entitlementsOasis Multi-CloudPolicy across connected cloudsSovereign CloudSeven layers of sovereignty

Intelligence across the platformAmin raises findings with the fix for operators; Noura guides customers

How it is built
Security & Sovereignty Compliance & Evidence
The other modules
Oasis CoreCloud FoundationInfrastructure for AIDigital TransformationCloudSouqOasis Multi-Cloud
Platform overview

Adopting this module

What adopting Governance involves.

Each of these is agreed with you before deployment, and the walkthrough we show uses your selected services and integrations.

Talk to us
  1. Control mappingMap applicable requirements to implemented controls, evidence sources and accountable owners.
  2. Enforcement coverageVerify which workflows enforce policy, and how exceptions and privileged access are approved.
  3. Key custody and auditAgree identity, key ownership, retention, evidence exports and audit review procedures.

In productionThe governance model described here is the one enforced on YallaCloud in production.

Read the case study

The outcome

Governance becomes part of every cloud operation.

  • One identityConnect people, applications and services through one identity and access model.
  • One policy modelApply controls consistently from organisation to resource.
  • Continuous evidenceLink requirements, controls, activities and resources.
  • Control without complexityEmbed governance in automation so security never blocks consumption.

Oasis StackA CloudHost Initiative

Govern with confidence.
Operate with control.

Talk to us Security architecture