Hosting your app's data in the UAE: AWS UAE region, Azure UAE North and what in-country really means

The two UAE cloud regions you can choose today

AWS opened its Middle East (UAE) Region in 2022. The AWS News Blog post announcing it, dated 29 August 2022, gives the API name me-central-1, says the region has three Availability Zones, and says customers can deploy workloads and store data in the United Arab Emirates. The launch list included Amazon EC2, Amazon RDS, Amazon S3, AWS Lambda, Amazon ECS and Amazon SNS. The RDS documentation today lists an endpoint for Middle East (UAE), me-central-1.

Microsoft lists two UAE regions on its Azure regions page. UAE North is in Dubai and supports three availability zones. UAE Central is in Abu Dhabi, has no availability zones listed, and is marked as a restricted region: access is limited to specific customer scenarios such as disaster recovery, and you have to request it for your subscription. UAE North and UAE Central are listed as each other's paired region.

My default for a new app is simple. I would pick AWS me-central-1 or Azure UAE North, depending on which cloud your team or your enterprise customers already use. I would not plan a launch around UAE Central unless Microsoft has granted you access first.

One caution applies to both. A region existing does not mean every service runs in it. Microsoft says so directly on its regions page: some services might not support availability zones even in a region that has them. Check each service you plan to use against the provider's own region list before you commit.

What in-country covers, and the parts that still leave

Hosting in a region controls where your stored data sits. AWS's RDS documentation explains that each Region is isolated and that resources are not replicated across Regions unless you choose to. That is the useful part: if your database, its backups and your file storage are all in me-central-1, they stay there by default.

Some parts of a normal app are global by design. These are the ones founders tend to miss.

• Push notifications. Firebase's own architecture page says messages go from your server to the FCM backend, then to a platform transport: Apple Push Notification service for Apple devices, the Android transport layer for Android. Firebase notes those transports are outside the core FCM product. Your server can be in Dubai, and the notification still passes through Google and Apple systems.
• CDN. CloudFront routes each request to the edge location that can best serve the user, typically the nearest one, and keeps cached copies there and in regional edge caches deployed globally. Your origin stays in the UAE. Cached copies of what you serve do not.
• Email. Amazon SES lists an API endpoint in me-central-1, but its own endpoint page says SMTP endpoints are not currently available in Middle East (UAE), and the region is not in the email receiving list. Once an email is sent, it lands with the recipient's mail provider, wherever that is.
• Analytics and crash reporting SDKs. Each vendor decides where its data lives. Firebase's locations page, for example, says Google Analytics uses one reporting location set for the whole organisation.

Which parts of a Flutter, Node.js and PostgreSQL app can stay in the UAE

This is the stack I build on, so here is how each piece maps. "Yes" means the provider lists the service in a UAE region, not that a rule is satisfied.

Questions to take to your regulator or lawyer first

I am not going to tell you what the law requires. I am a developer, and rules differ by sector, by emirate and by free zone. What I can do is turn the vague request "keep the data in the UAE" into questions that produce a usable answer. Ask these before the backend is built, because moving a live database between regions later is real work.

• Which data does the requirement cover: all personal data, or specific categories such as health or financial records?
• Does it cover backups, logs and monitoring data, or only the main database?
• Is encrypted data stored abroad treated differently from plain data?
• Does remote access from outside the UAE, by a developer or support agent, count as a transfer?
• Do push notification payloads, CDN caches and outgoing email count?
• Which third-party SDKs are acceptable, and what do you need from each vendor in writing?
• Does your sector regulator or free zone authority publish its own guidance you should follow?

What this costs with my packages

Region choice is a setup decision, not a separate product. My Growth package ($1,699) includes your own Node.js backend and PostgreSQL database, and the Scale package ($2,500) adds an admin dashboard, integrations and push notifications where supported. In both, I would deploy the backend, database and file storage in the UAE region you choose, keep backups in the same region, and design push messages so they carry no sensitive details.

Hosting itself is not included. It is a third-party fee you pay the cloud provider directly, in your own account, so the infrastructure is yours. Specialised compliance work, such as audits or formal data residency documentation for a regulator, is quoted separately. Bring me the answers from the checklist above and I will tell you which parts of your app can stay in-country, which cannot, and what that changes in the build.