Skip to content
EmaLite LLC — enterprise technologyLLC
العربية
Enterprise infrastructureRiyadh · Kingdom of Saudi Arabia

Infrastructureengineeredto stay up.

We design, build and support the networks, data centres and cloud platforms Saudi organisations run on — from the fabric in the data centre to the cabling underneath it, documented well enough that the next engineer can follow what we did.

Start a projectWhat we do
Scroll

Technology capabilities

Engineered with

We are vendor-literate rather than vendor-led. Selection follows the requirement, not a reseller agreement — these are the platforms our engineers work in day to day.

↳ Hover a platform for detail

03 — Services

What weactually do.

Six disciplines, one engineering practice. Most engagements draw on three or four of them — design, build, secure, then run.

Discuss a requirement

  • SPINELEAFACCESS

    Campus, branch and wide-area networks that carry production traffic without drama.

    • Deterministic failover paths, tested not assumed
    • Documented capacity headroom per link
    • Single source of truth for addressing and VLANs
    View service

Our platforms
04 — The stack

Every layeraccounted for.

This is the shape of what we build. Traffic enters at the edge, is inspected before it reaches anything valuable, crosses a segmented core, and is served from compute you can fail over. Nothing here is hypothetical — it is the reference architecture behind most of our engagements.

Traffic simulation

MODE
STEADY STATE
DROPPED AT EDGE
0
CORE INTEGRITY
100%

  1. Internet Edge

    01

    INGRESS / EGRESS

    Redundant carrier links, BGP policy and DDoS absorption. Everything that reaches you arrives here first.

    • CARRIER A
    • CARRIER B
    • EDGE ROUTER

  2. Security Layer

    02

    INSPECTION & POLICY

    Next-generation firewalls, IPS and TLS inspection. Traffic is classified, matched against policy, and either forwarded or dropped.

    • NGFW CLUSTER
    • IPS
    • PROXY / TLS

  3. Core Network

    03

    TRANSPORT & SEGMENTATION

    Routed core and segmented fabric. Zones are separated by policy so a compromise in one does not become a compromise in all.

    • CORE SWITCH
    • SEGMENT: CORP
    • SEGMENT: OT

  4. Cloud & Data Centre

    04

    COMPUTE & STORAGE

    Hybrid compute, storage and replication. Workloads run where they belong, with recovery paths rehearsed in advance.

    • PRIVATE DC
    • PUBLIC CLOUD
    • REPLICATION

  5. Applications

    05

    SERVICES & INTEGRATION

    Business platforms, APIs and automation. The integration layer that turns infrastructure into something people use.

    • ERP / LOB
    • APIS
    • AUTOMATION

  6. Users, Branches & Devices

    06

    CONSUMPTION

    Head office, branches, remote users and machines. Identity-aware access from wherever the work happens.

    • HQ
    • BRANCH
    • REMOTE / IOT
05 — Solutions

Platforms we built,problems we solve.

Nobody buys infrastructure. They buy a branch that opens on time, an audit that closes, a night without a call. Some of those answers we have built into platforms of our own; the rest we engineer for each client.

Platforms we build and operate01 / 02

BranchConnect

Every branch on one private network.

A multi-tenant branch connectivity platform built on WireGuard. Cameras at every branch reach the head-office NVR, IP phones register to the head-office PBX, and branch-to-branch traffic goes direct — without a leased line at each site.

bc.emalite.comProduct briefPDF
Reference architecture

Control plane

Portal · API · Policy

OWNS INTENT — NOT IN THE TRAFFIC PATH

↑ SIGNALLING · TELEMETRY ONLY

  • HEAD OFFICEGATEWAY

    NVR · PBX

  • DIRECT WIREGUARD
    BRANCHGATEWAY

    CAMERAS · POS

  • DIRECT WIREGUARD
    BRANCHGATEWAY

    PHONES · USERS

↳ RELAY FALLBACK ONLY WHERE CGNAT OR SYMMETRIC NAT PREVENTS A DIRECT TUNNEL

  1. 01

    Control plane, not traffic path

    The platform owns intent — customers, branches, routing policy, monitoring, billing. It does not sit in the data path. Branch traffic is peer-to-peer wherever the network allows it, so adding branches does not add load to a central box.

  2. 02

    Direct first, relay only when it must

    Gateways negotiate a direct, NAT-traversed WireGuard tunnel and use it while the handshake stays fresh. Where a symmetric NAT or a CGNAT edge makes that impossible, traffic falls back to a relay automatically — and relayed volume is measured as its own metric rather than inferred.

  3. 03

    Isolation that is structural

    Each tenant gets its own WireGuard interface, UDP port and routing table, terminated so a routing miss cannot fall through to another tenant. Application-layer checks sit on top of that, not in place of it.

  4. 04

    A branch comes online in minutes

    Create the branch, generate a single-use activation token, and run one command on the gateway. It generates its own keypair locally — the private key never leaves the device — enrols, pulls its configuration and brings the tunnel up. No hand-written config, no port chosen by a human.

What the customer gets.

  • Every branch camera visible on the head-office NVR
  • IP phones registered to the head-office PBX, wherever the branch is
  • Branch-to-branch and branch-to-HQ without a leased line per site
  • Per-branch subscription billing, monthly or annual
  • Live health per gateway — link state, latency, jitter, loss, path

Platform

Built, hosted and operated by EmaLite.

We wrote it because the alternative for a distributed business was a leased line at every site or a VPN somebody had to hand-configure. Deployed as a platform, a branch comes online in minutes.

  • WIREGUARD
  • MULTI-TENANT
  • NAT TRAVERSAL
  • ZERO-TOUCH ENROLMENT
  • PER-TENANT ROUTING
  • TELEMETRY & ALERTING
Visit BranchConnectRequest a walkthrough
Problems we are asked to solve
  1. 01

    Connect distributed operations.

    Branches, plants and remote teams on one policy-consistent network. Application-aware SD-WAN with failover that is tested, not theoretical.

    • SD-WAN
    • BRANCH NETWORKING
    • SECURE REMOTE ACCESS
  2. 02

    Secure critical infrastructure.

    Segmentation, inspection and identity-aware access designed around where your data actually lives — with evidence the controls hold.

    • ZERO TRUST
    • SEGMENTATION
    • SOC INTEGRATION
  3. 03

    Modernise legacy environments.

    Aging estates migrated in sequenced waves. Every wave has a rollback, a test plan and a measured downtime window.

    • MIGRATION
    • HYBRID CLOUD
    • LIFECYCLE
  4. 04

    Automate repetitive operations.

    Manual provisioning, checks and reporting replaced with configuration as code, orchestration and drift detection.

    • CONFIG AS CODE
    • ORCHESTRATION
    • OBSERVABILITY
  5. 05

    Build scalable digital platforms.

    Integration layers, internal portals and APIs engineered to carry production load and grow without a rewrite.

    • INTEGRATION
    • APIS
    • INTERNAL TOOLS
06 — Industries

Where theconstraints differ.

The architecture is the same discipline everywhere. What changes is the constraint that dominates it — a regulator, a clinical shift, a trading window, a plant floor.
ENTERPRISE

Multi-site estates with one operating standard.

Large organisations rarely suffer from a lack of technology — they suffer from six versions of it. We consolidate onto one architecture, one policy model and one set of as-built records.

  • STANDARDISED ARCHITECTURE
  • CONSOLIDATED OPERATIONS
  • PREDICTABLE COST
07 — Ecosystem

Nothing hereworks alone.

A change in one domain lands in three others. We design across the whole graph, which is why security is not a phase and analytics is not an afterthought.

CORENetworkSecurityCloudInfrastructureApplicationsAutomationAnalytics

Domain

Network

The transport layer everything else depends on — routed, switched, wireless and wide-area.

Depends on

Technology portfolio

What we build on

The platforms we design, deploy and operate, grouped by the job each one does. Selection follows the requirement rather than a reseller agreement, and nothing here is a claim to any vendor's partner programme — it is a statement of what our engineers work in.

38 platforms · 8 capability groups

Identity & Access

Who exists, what they may reach, and the standing privileges that make a breach expensive rather than contained.

  • SailPoint

    Identity governance: joiners, movers, leavers and access certification

  • One Identity

    Account lifecycle and entitlement management across directories

  • Delinea

    Privileged access, credential vaulting and session recording

  • Quest

    Active Directory management, migration and recovery

  • Thales

    Hardware security modules, key management and strong authentication

Data Security & Governance

Knowing what the data is before deciding how it may move. Classification first, then the controls that act on it.

  • Forcepoint

    Data loss prevention across endpoint, network and cloud

  • Boldon James

    User-driven classification and labelling at the point of creation

  • Getvisibility

    Automated discovery and classification of unstructured data

  • Proofpoint

    Email security, phishing defence and information protection

  • Symantec

    Endpoint protection, encryption and web security

  • Exclaimer

    Centrally governed email signatures and disclaimers

Threat Detection & Response

Seeing an incident while it is still an incident. Telemetry, detection and the response that follows from it.

  • Splunk

    SIEM, log analytics and the data layer under a SOC

  • SentinelOne

    Endpoint detection and response with automated containment

  • Vectra AI

    Network detection and response for east-west and identity attacks

  • Tenable

    Vulnerability management and exposure assessment

  • OPSWAT

    File sanitisation and secure transfer across network boundaries

  • Kaspersky

    Endpoint protection and threat intelligence

Network & Application Security

Inspection and policy at the boundaries that carry production traffic, and in front of the applications behind them.

  • Palo Alto Networks

    Next-generation firewalls, threat prevention and SASE

  • Fortinet

    Next-generation firewalls and secure SD-WAN

  • F5

    Application delivery, load balancing and web application firewalling

Backup & Cyber Recovery

Copies that survive the event that destroyed the originals, and a restore somebody has actually performed.

  • Veeam

    Backup and replication for virtual, physical and cloud workloads

  • Rubrik

    Immutable backup with ransomware detection and rapid recovery

  • Acronis

    Integrated backup, disaster recovery and endpoint protection

  • Veritas

    Enterprise backup, archiving and data compliance at scale

Cloud & Platform

The capacity the rest of it runs on, public and private, treated as one estate rather than two.

  • Microsoft

    Azure, Microsoft 365, Entra identity and the collaboration stack

  • AWS

    Public cloud infrastructure, migration and landing zones

  • VMware

    Virtualisation and the software-defined data centre

  • Red Hat

    Enterprise Linux, OpenShift and automation with Ansible

Business Applications & IT Operations

The platforms a service desk runs on, and the business applications that sit above the infrastructure.

  • ManageEngine

    ITSM, endpoint management and IT operations monitoring

  • Zoho

    Business applications: CRM, finance, HR and workflow

  • NetSupport

    Remote support, classroom and endpoint management

Communication & Collaboration

Voice, contact centre and the room and desk hardware people actually touch.

  • Genesys

    Contact centre and customer experience orchestration

  • Ribbon

    Session border controllers and voice network security

  • Asterisk

    Open-source telephony and custom voice applications

  • Yealink

    IP phones, meeting room systems and video endpoints

  • Poly

    Conferencing hardware, headsets and room audio

  • Jabra

    Professional headsets and personal video devices

  • Logitech

    Meeting room video, cameras and peripherals

08 — Selected work

Engagements,not brochures.

Real projects. Client names are withheld under confidentiality — what is described is the work: the architecture, the technology and what was handed over at the end of it.

EDUCATION01 / 04

CISCO ACI · VXLAN / BGP EVPN · DATA CENTRE

A university data centre rebuilt as a policy fabric

Challenge
A campus data centre where every new application meant another VLAN, another firewall rule and another undocumented dependency. Growth was outpacing the team's ability to keep track of what talked to what.
Solution
A spine-leaf fabric on Cisco ACI, with VXLAN carrying the overlay and BGP EVPN distributing reachability. Policy moved out of per-device configuration and into APIC, so what an application is allowed to reach is now a contract you can read rather than a rule buried in a rule base. Designed, built and handed over with the as-built records to match.
  • CISCO ACI
  • APIC
  • VXLAN
  • BGP EVPN
  • SPINE-LEAF
  • AS-BUILT

ACI

Fabric and policy model

EVPN

Overlay control plane

HLD + LLD

Documented and handed over

GOVERNMENT02 / 04

CISCO ACI · DATA CENTRE BUILD · PROFESSIONAL SERVICES

A data centre for a programme that cannot move its dates

Challenge
A national development programme building data centre capacity against a calendar that does not negotiate. The architecture had to be defensible to reviewers who were not in the room when it was drawn.
Solution
Cisco ACI fabric designed, staged and commissioned, with the underlay, overlay and policy model documented at low-level detail before a single device was racked. Acceptance testing against the design, not against whether traffic happened to pass.
  • CISCO ACI
  • APIC
  • VXLAN
  • BGP
  • COMMISSIONING
  • ACCEPTANCE TESTING

Fabric

Designed and commissioned

LLD

Interface-level detail

Tested

Accepted against the design

INDUSTRIAL03 / 04

CISCO SECURITY · SEGMENTATION · PROFESSIONAL SERVICES

Security architecture for a manufacturer with plants to protect

Challenge
A large manufacturing estate where the corporate network and the systems running production had grown into each other. Visibility existed in places; a boundary did not.
Solution
Cisco security platforms designed and deployed around where the data and the processes actually sit — inspection at the boundaries that matter, segmentation between zones, and policy written so a change request can be answered without guessing what it breaks.
  • CISCO SECURITY
  • SEGMENTATION
  • NGFW
  • POLICY DESIGN
  • INSPECTION

Segmented

Zones with a real boundary

Inspected

Policy at the edges that count

Documented

Changes you can reason about

BANKING & FINANCE04 / 04

HUAWEI SD-ACCESS · CAMPUS NETWORK · PASSIVE INFRASTRUCTURE

A bank's campus, from the cable tray up

Challenge
A bank needing a campus network where access is decided by who the user is rather than which port they happened to plug into — and needing the physical layer underneath it built properly at the same time.
Solution
Huawei SD-Access designed and deployed for identity-based access and policy-driven segmentation across the campus, on structured cabling and containment we installed and certified ourselves. One party accountable from the patch panel to the policy.
  • HUAWEI SD-ACCESS
  • CAMPUS FABRIC
  • IDENTITY-BASED ACCESS
  • STRUCTURED CABLING
  • CERTIFICATION

SD-Access

Identity-driven campus

Passive

Cabling installed and certified

One party

Accountable end to end

09 — Principles

Five commitmentswe design against.

  1. 01

    Engineered

    Designs start from the requirement, the traffic profile and the constraint — not from a vendor's reference architecture. If we cannot explain why a component is there, it does not go in.

  2. 02

    Secure

    Segmentation, inspection and identity are part of the first design review, not a hardening phase afterwards. Security that arrives late is security that gets value-engineered out.

  3. 03

    Scalable

    Capacity headroom is calculated and written down. Growth should mean adding a module, not repeating the project in three years.

  4. 04

    Automated

    Anything performed by hand more than twice becomes a template, a script or a pipeline. Consistency is a security control as much as an efficiency one.

  5. 05

    Supported

    Handover includes as-built documentation, runbooks and a named escalation path. The relationship is measured in years of operation, not weeks of installation.

10 — Process

How an engagementactually runs.

Six stages, each with its own deliverables and an exit that has to be signed off before the next begins. No stage is skipped because the deadline moved.

  1. 01

    Discover

    Requirements, constraints and the current estate as it actually is — measured, not described.

    • INFRASTRUCTURE AUDIT
    • TRAFFIC & CAPACITY BASELINE
    • RISK REGISTER
  2. 02

    Design

    High-level architecture and technology selection, reviewed against the requirement before anything is bought.

    • HIGH-LEVEL DESIGN
    • TECHNOLOGY SELECTION
    • BILL OF MATERIALS
  3. 03

    Engineer

    Low-level design, configuration standards and a build validated in a staging path.

    • LOW-LEVEL DESIGN
    • CONFIG STANDARDS
    • LAB VALIDATION
  4. 04

    Implement

    Sequenced deployment with defined maintenance windows, acceptance tests and rollback at every step.

    • CUT-OVER PLAN
    • ACCEPTANCE TESTING
    • ROLLBACK PROCEDURE
  5. 05

    Secure

    Policy applied, controls verified, and the whole design documented to the standard you report against.

    • POLICY BASELINE
    • CONTROL VERIFICATION
    • AS-BUILT RECORDS
  6. 06

    Optimise

    Monitoring in place, capacity reviewed on a cycle, and improvements fed back into the design.

    • MONITORING & ALERTING
    • CAPACITY REVIEWS
    • IMPROVEMENT ROADMAP
Accepting engagements

Let's buildwhat's next.

Tell us what you are trying to solve. You will get an engineer in the conversation, not a form response — what we would build, what it would take, and where we think you do not need us.

Start a conversation
hello@emalite.com+966 92 003 5691