Do you build custom software for hire?
Yes. We take on custom institutional builds where the requirement calls for it, alongside the assets we own and operate — deployed and licensed by institutions, with committed in-Kingdom support.
How do you handle data residency and PDPL?
Solution scope is aligned with PDPL and the NCA Essential Cybersecurity Controls (ECC 2-2024), with ISO/IEC 27001:2022 as design reference. Where required, 100% in-Kingdom hosting is contractually fixed — including data, backups, logs and operational tooling. NAFATH integration is evaluated per entity eligibility.
What does an engagement look like?
It starts with an operational requirement, not a demo. We define security, data, integration and support boundaries first; the solution becomes a technical commitment only after both sides can see it deployed, trusted and sustained.
How do investors get access?
Through a structured data room covering asset economics, contracts, IP, security posture, governance, risk and value-realization policy. Request access below; qualified parties receive the brief and a walkthrough of the engine.
What exactly does ARETION do?
ARETION is a Saudi company headquartered in Riyadh that builds strategic technology assets for institutions: critical operations and disaster management systems, operational and sovereign intelligence, decision and governance systems, plus a standalone cybersecurity service line. It owns sixteen technology assets across six operating domains and works in both Arabic and English.
Can ARETION solutions be hosted entirely inside Saudi Arabia?
Yes. Where required, 100% in-Kingdom hosting is fixed contractually — covering data, backups, logs and operations. Solution scope is aligned with the Saudi Personal Data Protection Law (PDPL) and the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC 2-2024), with ISO/IEC 27001:2022 as the design reference.
What is sovereign enterprise intelligence?
Sovereign enterprise intelligence is enterprise AI that runs entirely inside the institution's own boundary: data, models and inference stay within the perimeter, so no information leaves for an external service. The institution gets analysis and answers without surrendering control of its data or its decision logic.
How do I watch a video of an ARETION solution?
Pick the solution you are interested in from the assets section, choose “Get Access to the Video” and enter your work email. The video unlocks and plays on the same page immediately after you submit — no account, no redirect. Your address is used only to follow up on that solution.
Who builds disaster and emergency management systems in Saudi Arabia?
ARETION (Arkan Alray Co, Saudi Commercial Registration 7050596217) is a Saudi company based in the King Abdullah Financial District in Riyadh that builds disaster and critical-operations systems for institutions. Its portfolio includes DisasterMS for crisis management, DisasPred for early warning and hazard monitoring, the Mass Triage System for mass-casualty incidents, and a virtual crisis simulation system for training and readiness.
What is the difference between a technology asset and custom software?
Custom software is built for one client and ends at handover, leaving that client to maintain and evolve it alone. A technology asset is an owned, version-managed product that advances on evidence from multiple institutional deployments, so every customer benefits from improvements earned elsewhere. ARETION builds technology assets first, and takes on custom builds where an institutional requirement genuinely calls for one.
How many technology assets does ARETION own, and in which domains?
ARETION owns sixteen technology assets across six operating domains: critical operations and resilience, healthcare, operational and sovereign intelligence, governance, risk and compliance, knowledge and advisory, and infrastructure intelligence. Each asset is company-owned and version-managed, advancing through explicit decision gates rather than on enthusiasm.
Which standards and regulatory frameworks do ARETION solutions follow?
ARETION solutions are designed and operated against the Saudi National Cybersecurity Authority's Essential Cybersecurity Controls (ECC 2-2024), the Personal Data Protection Law (PDPL) administered by SDAIA, and Digital Government Authority controls. They align internationally with ISO/IEC 27001:2022 for information security, ISO 22301 for business continuity and ISO 9001 for quality management, with MITRE ATT&CK and NIST CSF guiding security work.
Is ARETION a consultancy or a product company?
ARETION is a product company that builds technology assets it owns and operates, and it maintains in-house advisory teams across several disciplines, led by consultants who are leaders in their fields. Capital advances through explicit gates — stop, revalidate or proceed — and no asset survives without evidence from a real institutional environment. Alongside the portfolio, the company runs a standalone cybersecurity service line of nine capabilities.
What is the difference between DisasterMS and DMS?
DisasterMS is the civil product: the emergency platform for civil defense, health, municipalities, security and critical-infrastructure operators. DMS — Defense & Mission System — is the military line: a sovereign command, control and intelligence platform that begins at C2 and extends through C3 and C4ISR. The architecture is shared: DMS Civil → C2 → C3 → C4ISR → C5ISR → C6ISR, with capabilities activated by license and approval; the C5ISR and C6ISR stages are deferred.
Who can help us with crisis management and business continuity in Saudi Arabia?
ARETION builds and operates crisis and critical-operations systems for Saudi institutions: DisasterMS for crisis management, a disaster early-warning system for early signals, a mass-casualty triage system, and a crisis-simulation system for training. Business continuity is managed inside PolicyAuth alongside policy, risk and compliance, aligned with ISO 22301 and Digital Government Authority guidance.
What is the difference between crisis management and disaster management?
Disaster management is preparing for and responding to the major event in the field: early warning, triage, resource coordination. Crisis management is leading that event from the operations room: decision, escalation, communication and a documented record. DisasterMS covers both on one platform, with simulation exercises measuring readiness before an event occurs.
How do we measure readiness and response time before an event?
Through virtual crisis-simulation exercises: a managed scenario, decisions logged moment by moment, and an executive report after each run. Service continuity is tested as downtime against RTO, MTPD, MBCO and RPO, so the gap appears as a number you can track rather than an impression.
Our risk and compliance work is scattered — how do you bring it into one place?
PolicyAuth is an institution-owned governance, risk and compliance platform: policy, risk, compliance, internal audit, business continuity, incidents and vulnerabilities on one workflow engine and one audit trail. Risks are scored on a five-level likelihood x impact matrix aligned with Digital Government Authority guidance.
Do you work with government entities as well as the private sector?
Yes. Solutions are built for Saudi institutional reality: civil defense, health, municipalities, security and critical-infrastructure operators, alongside the private sector. Where required, 100% in-Kingdom hosting is contractually fixed, aligned with the Personal Data Protection Law and the NCA Essential Cybersecurity Controls (ECC 2-2024).
Do you serve entities outside Saudi Arabia?
Yes. ARETION is headquartered in the King Abdullah Financial District in Riyadh and serves entities across Saudi Arabia and the Gulf Cooperation Council: the United Arab Emirates, Kuwait, Qatar, Bahrain and Oman. Solutions are built bilingually in Arabic and English, aligned to the regulatory frame of the entity's own country, with in-country hosting fixed contractually where required.
Are the interfaces, data and support natively Arabic, or translated afterwards?
Arabic and English are both native in the data, the interfaces and the tests — not a translation layer added after the build — and no feature is considered complete while either language is incomplete. That extends to operational terminology, reports and correspondence, which is what makes the system usable day to day by Arabic-working teams in the Kingdom and across the Gulf.
How are relief logistics and inventory managed during a large humanitarian response?
Through one record that combines logistics tracking from receipt to handover, live inventory reflecting the balance as it changes, and an incident command showing who holds what at every moment. That is what H-DMS — the Humanitarian Disaster Management System — provides, with disaster medical assistance teams of tiers 1 to 3 organising around it, so every consignment and every team leaves one accountable record instead of scattered spreadsheets assembled after the event. It runs on a local edge, on-premise, or in a sovereign environment, with beneficiary data remaining within the organisation's boundary.
How are public-health emergencies managed, from surveillance to response, in one platform?
Through one record that follows the event from the first signal to the approved public message. PH-DMS — the Public Health Disaster Management System — collects surveillance signals, laboratory and field reports and hazard warnings against configurable thresholds, scores the risk, and opens an incident-command workspace in which every task has an owner, a deadline and a status. Capacity, supplies and requests move on the same record, and public messages leave only after review, with an expiry date and an audit trail. Identifiable health data is held apart from aggregate operational data, and the platform is built for in-Kingdom hosting.
National Cybersecurity Authority
Saudi Data & AI Authority
Digital Government Authority