Business

What is Nafath and Why You Need a Saudi Server

CLOUD|February 25, 2026|4 min read|1,971 views

Nafath is Saudi digital identity verification system. If your system needs to integrate with it — your server must be in Saudi.

National Access (Nafath) and the Server Decision

Nafath is Saudi Arabia's national digital identity platform, operated by the Communications, Space and Technology Commission (CST). Integration with it has become a necessity, not an option, for any application serving citizens and residents.

The fundamental rule: Foreign servers do not work with Nafath — period. This is not an unwritten rule; it is a clear technical and security requirement.

Why Is a Saudi Server Mandatory?

1. National Cybersecurity Authority (NCA) Requirements

The NCA requires that government and citizen data be stored within the Kingdom. Integration with identity systems is classified as such sensitive data.

2. Nafath API Requirements

Sandbox Environment:
 - URL: https://nafath.api.iam.gov.sa/sandbox
 - Available to all servers for testing

Production Environment:
 - URL: https://nafath.api.iam.gov.sa/v1
 - Requires a documented, registered Saudi IP
 - Requires technical accreditation certificate

3. IP Whitelisting Requirements

# When registering with Nafath for production
# You must provide:
# - Static dedicated IP address
# - Geographic location: Saudi Arabia
# - ASN belonging to an approved Saudi service provider

Complete Technical Requirements

Server Requirements

Requirement	Minimum	Recommended
vCPU	2	4+
RAM	4 GB	8 GB+
SSD	40 GB	80 GB+
IP	Static dedicated	Static dedicated
Uptime SLA	99.9%	99.99%
Location	Saudi Arabia	Riyadh or Jeddah

Network and Security Requirements

# 1. HTTPS is mandatory - non-negotiable
# SSL certificate from a recognized CA
# TLS 1.2 minimum, TLS 1.3 preferred

# 2. Obtain a Dedicated IP
# On cloud.net.sa: 400 SAR/year for dedicated IP

# 3. Enable firewall
ufw enable
ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 22/tcp
ufw deny from any to any

# 4. Allow outbound to Nafath only
ufw allow out to any port 443

SSL/TLS Requirements

# Verify TLS settings
openssl s_client -connect nafath.api.iam.gov.sa:443 -tls1_3

# nginx: modern TLS only
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;

# HSTS
add_header Strict-Transport-Security "max-age=63072000" always;

Logging and Audit Requirements

# All Nafath requests must be logged
# nginx: enable detailed access log
log_format nafath_log '$remote_addr - $remote_user [$time_local] '
 '"$request" $status $body_bytes_sent '
 '"$http_referer" "$http_user_agent" '
 '$request_time $upstream_response_time';

access_log /var/log/nginx/nafath_access.log nafath_log;

// Laravel: log every Nafath request
class NafathMiddleware
{
 public function handle(Request $request, Closure $next): Response
 {
 $startTime = microtime(true);
 $response = $next($request);

 Log::channel('nafath')->info('API Request', [
 'timestamp' => now->toISOString,
 'user_id' => auth->id,
 'national_id' => $request->input('nationalId'),
 'action' => $request->input('action'),
 'ip' => $request->ip,
 'duration_ms' => round((microtime(true) - $startTime) * 1000, 2),
 'status' => $response->getStatusCode,
 ]);

 return $response;
 }
}

Obtaining Nafath Accreditation

Official Steps

1. Register at the Developer Portal:
 https://api.iam.gov.sa/developer

2. Submit accreditation request with:
 - Business entity document (commercial registration)
 - Description of the service being provided
 - Server IP address (static Saudi IP)
 - Privacy policy

3. Review by the authority (7-14 business days)

4. Receive:
 - Client ID
 - Client Secret
 - Production environment access

cloud.net.sa Servers and Nafath

cloud.net.sa provides VPS servers in Riyadh and Jeddah with:

Dedicated IP at 400 SAR/year
uptime عالي مع ضمان تعاقدي guaranteed by contract
Approved Saudi ASN
Latency very low latency within the Kingdom
Technical support for configuring Nafath requirements

The Business plan (4 vCPU, 8GB, 40GB) at competitive pricing — pricing and plans with a dedicated IP (400 SAR) is the ideal package for most Nafath integration applications.

Pre-Accreditation Checklist

[ ] Server in Saudi Arabia (Riyadh or Jeddah)
[ ] Static dedicated IP registered
[ ] HTTPS enabled with valid certificate
[ ] TLS 1.2+ enabled
[ ] Audit logging enabled
[ ] Privacy policy published
[ ] Commercial registration / business license
[ ] Technical service description
[ ] Successful testing in Sandbox environment

Summary

A Saudi server is not optional for those integrating with Nafath — it is a technical and legal requirement. Companies that need national identity verification have no choice but a server on Saudi soil.