SafeRock IT manages Windows, Android, Mac and iPhone to the same standard for Moroccan companies. We prepare the technical part of your CNDP filings and the evidence your clients and auditors ask for. A team in Rabat and Casablanca, with engineering experience gained in the USA, for Morocco first, then the EU, Africa and the Gulf.
According to figures presented to Parliament by the minister in charge of the National Defence Administration, the DGSSI recorded 644 cyberattacks in 2024 and 879 in 2025. Here are six points we check first.
Cameras, GPS trackers, HR software, access control and MDM process your employees' data: depending on the tool, Law 09 08 requires a declaration or an authorisation before use.
We list what each tool collects and prepare the technical part of your filing.
The CNDP excludes the management of employee attendance time as a purpose for biometric processing (deliberation 478 2013).
We review your attendance tools and propose a badge or an app.
Law 09 08 (Article 23) requires measures against the accidental loss of data.
Encryption, locking and remote wipe on Windows, Android, Mac and iPhone, backed by evidence.
Its support ended on 14 October 2025; Extended Security Updates are paid for businesses. About a quarter of Windows web traffic in Morocco still comes from Windows 10 (StatCounter, August 2026).
We inventory your PCs and plan your move to Windows 11.
Tenants created before 22 October 2019 do not always have the security defaults, which include MFA for everyone and the blocking of legacy authentication.
We audit Microsoft 365, Google Workspace or Okta.
By contract, it also covers providers who work on the systems of public administrations and infrastructure of vital importance: an inventory, an access review at least once a year, a leaver procedure, a mobile device policy.
We prepare the evidence they ask for.
Windows, Android, Mac and iPhone enrolled, encrypted and patched to the same standard, with Intune, Android Enterprise, Jamf or your MDM.
Entra ID, Okta or Google Workspace; SSO, MFA, named accounts, automated joiners and leavers.
CIS configurations, patching, tested backups, secured Microsoft 365 and Google Workspace.
From the technical part of your CNDP filing to supplier questionnaires and the ISO 27001 audit.
From first line to engineering, in French, English, Spanish and Arabic.
Roadmaps, tool selection, part time IT leadership.
We deploy and run your device management platform, and place its data and backups in the location you choose.
Your MDM database and backups stay on servers in Morocco; only technical flows, which we document for your CNDP filing, leave the country.
In an EU country recognised by the CNDP, we prepare the transfer notification with you.
For your subsidiaries in Africa or the Gulf, following the local rule; for Moroccan data hosted outside the countries recognised by the CNDP, a CNDP authorisation or a legal exception is required.
On your premises or in your cloud, with the access you grant us.
Some enrolment and notification services are still provided by the operating system vendors; we document these flows.
Morocco first, then your markets.
Three frameworks to know: Law 09 08, Law 05 20 and the rules of Bank Al Maghrib.
GDPR clauses, NIS2 questionnaires: what your European clients expect from a provider in Morocco.
This US law requires providers of electronic communication services or remote computing services that are subject to US jurisdiction to respond to warrants and orders from US authorities for data they possess or control, wherever that data is stored. Article 48 of the GDPR governs these requests: a judgment of a court or a decision of an administrative authority of a third country is recognised or enforceable only if it is based on an international agreement, such as a mutual legal assistance treaty, without prejudice to the other grounds for transfer under the GDPR. The EU US Data Privacy Framework remains valid; an appeal is pending before the Court of Justice of the EU.
One law and one authority per country; several regulate hosting data outside the country.
Saudi Arabia and the United Arab Emirates: recent laws, which also cover foreign companies that process residents' data.
ISO 27001:2013 certificates stopped being valid on 31 October 2025. We prepare your move to the 2022 version; the certification body issues the certification.
We harden your Windows, Android, Mac and iPhone devices against the CIS Benchmarks and the CIS Controls, and measure the gaps.
To sell in the USA: we prepare the technical controls and the evidence; the SOC 2 report is issued by an independent accounting firm licensed in the USA (CPA).
Information up to date as of 1 October 2026. General information, not legal advice.
Reports on devices, patches, encryption and access.
Adapted to your company.
Of your assets and your access.
Signed with you.
User support, passwords and MFA, device preparation.
Request a quoteHelpdesk, plus advanced troubleshooting, checks on the security rules applied to devices, patching and a monthly report.
Request a quoteManaged IT, plus automation, architecture and preparation for certification.
Request a quoteEach plan is sized after a free discovery call. A migration or an audit preparation can be done without a support contract.
Your devices and your obligations.
Devices, identities, access, providers.
A pilot, then the switchover.
Monitoring, patching, monthly reports.
In the workplace, video surveillance requires a prior declaration and vehicle geolocation a standard declaration, with retention limited to 3 months for images and one year for location data; some cases, such as healthcare establishments, require an authorisation. For the MDM, we work with you to describe what it collects, so that the right formality can be chosen. You submit the filing, as the data controller.
No. We prepare your company for the audit: gap analysis, technical measures, policies and evidence. The certification body you choose issues the certification.
Yes, from Morocco: the same standard for devices and access, the formalities identified for each country, including for our team's access from Morocco, and your MDM hosted in the region when local rules require it.
In French, English, Spanish and Arabic, by our team in Rabat and Casablanca. Response times are those set in your contract.
Describe your devices, your tools and your hosting constraints. An engineer will reply, in French, English, Spanish or Arabic.
Fields marked with * are required.