1. Who you contract with
Your contracting party is BITS Blackrock IT Solutions LLC, a limited liability company incorporated in Egypt. We are German-led, and we have client-facing teams in Riyadh, Dubai and Berlin, but there is no German, Saudi or Emirati legal entity: the contract is with the Egyptian company. We state this plainly because it is the kind of thing that should surface in the first meeting rather than in legal review.
- Legal entity: BITS Blackrock IT Solutions LLC
- Commercial Registration No. 191833, Alexandria Investment Registry Office
- Unified Corporate Registry Number: 01000191833
- Registered seat: 8 Ali Basha Zulfakar St, Mostafa Kamel, Sidi Gaber, Alexandria, Egypt
- Engineering: Cairo. Client-facing presence: Riyadh, Dubai, Berlin
2. Where your data sits
For systems we build and you host, your data stays in the environment you choose and we hold only the access your team grants us. For systems we operate for you, the hosting region is agreed in the contract before the build starts.
- Deployment targets: AWS, Azure, Google Cloud, your own private cloud, or on-premise in your data centre
- Region and residency are set per engagement and written into the agreement, not decided at deployment time
- On-premise deployment is available specifically for cases where data may not leave your network at all
3. Access from Egypt, and the legal basis for it
Our engineering team sits in Cairo. If your project requires that team to access personal data, that access constitutes a transfer to a third country, and we treat it as one rather than glossing over it.
- Egypt is not covered by an EU adequacy decision. Transfers of personal data from the EEA rely on the EU Standard Contractual Clauses, concluded as part of the data processing agreement.
- For Saudi clients, transfers outside the Kingdom are handled in line with the PDPL and SDAIA transfer rules, including the risk assessment they require.
- Where a transfer is not acceptable to you at all, the on-premise route removes it: engineering access is then limited to what you grant, in your environment, under your logging.
4. Subprocessors
This website itself uses a deliberately small set of third parties. Subprocessors specific to a client engagement are named in that engagement’s data processing agreement before work begins, and we notify you before adding one.
- Website hosting and delivery: Vercel Inc.
- Contact form processing: Web3Forms
- Cloud infrastructure for systems we operate on your behalf: AWS, Microsoft Azure or Google Cloud, in the region agreed with you
- Any AI model provider used in a client system is named in that engagement and can be replaced with a self-hosted model on request
5. How we build
Security is designed in rather than reviewed at the end. These are working practices, not certifications, and we describe them as such.
- Every project starts with a documented architecture, including the data boundary, before code is written
- Code review, test coverage and a security review are mandatory stages, not optional ones
- Encryption in transit and at rest; access to client environments is role-based and logged
- Each system is built on the assumption that it carries sensitive data, whether or not it currently does
6. Certifications: where we actually stand
We build platforms that carry other organisations through ISO 27001, SOC 2, NIS2 and DORA audits. That is not the same as holding those certifications ourselves, and we will not let the two be confused.
- BITS is not currently certified to ISO 27001. Certification has been initiated; we will publish the status here as it progresses and will not claim it before it is issued.
- The framework names shown across this site describe what our platforms are built to satisfy for our clients, not certifications held by BITS.
- Where your procurement process requires a certified supplier today, we will tell you that we do not meet that bar rather than work around the question.
7. Documents you can request
Send us a request and we will provide the applicable documents for your engagement. If something on this list does not yet exist in the form you need, we will say so instead of delaying.
- Data processing agreement including the Standard Contractual Clauses
- Description of technical and organisational measures
- Subprocessor list for your specific engagement
- Security questionnaire responses, completed by a founder rather than a sales team
- Master Services Agreement and the project Statement of Work
For any question on this page, or to request the documents above, contact our contact form. A founder answers these directly.