Custom software development · Riyadh
Custom Software Development Company for Riyadh
We build CRM, ERP and custom backend systems for companies in Riyadh, Jeddah and across the Kingdom. We work remotely from Ahmedabad, India, on Saudi hours. There is no QalbIT office in Riyadh, and this page explains exactly what that changes, including the two things Saudi law requires you to check before hiring any vendor outside the Kingdom.
Most vendor pages selling into Saudi Arabia name ZATCA and PDPL and stop there. This one shows the mechanics.
2018
Building software since
5.0
Clutch rating
50+
Clients served
5.0
Clutch rating
Get your free estimate
Three quick questions: scope, approach and a price range back within 48 hours. No sales call required first.
Definition
What a remote software partner actually does for a Riyadh company
QalbIT builds custom software for Riyadh companies as a remote engineering partner, not a local firm. Saudi buyers face two hard constraints: ZATCA Phase 2 e-invoicing, whose Wave 25 threshold of SAR 187,500 reaches almost every VAT-registered business by 1 February 2027, and PDPL Article 29, which governs moving personal data outside the Kingdom. QalbIT designs to both. Delivery is remote from Ahmedabad, India, on Riyadh working hours.
The distinction that matters isn’t technical. It’s legal and operational.
A local Riyadh agency sits inside the Kingdom. Your data stays put, your contract is Saudi law, and someone can be in your office by Tuesday. A remote partner sits outside it. That changes three things: how personal data moves, how the working week lines up, and who carries the compliance obligation.
None of those three is automatically a problem. All three have known answers. What matters is whether your vendor tells you about them before the contract or after the first audit.
We are the second kind of vendor and we are saying so on the page.
At a glance
Core focus
Custom software, CRM, ERP, backends and APIs
Engagements
First builds · legacy rebuilds · module extensions · integrations
Delivery
Remote from India on Riyadh hours, Sunday–Thursday overlap
Saudi position
No local entity. Processor outside the Kingdom under PDPL
Definition
Local agency vs global consultancy vs remote engineering partner
Three options that get compared on price when they should be compared on fit.
Local Riyadh agency
Registered in the Kingdom, Arabic-first, someone on site. Your data never leaves. Best when the work is continuous, stakeholder-heavy, or touches government procurement through Etimad.
Global consultancy
Programme-scale delivery with an in-Kingdom presence and a rate card to match. Best when the project is a multi-year transformation with a board-level sponsor.
Remote engineering partner
A small senior team building a defined system, working your hours from outside the Kingdom. No local entity, so the data-transfer question is real and has to be answered in the contract. Best when you want the software built properly and you already know what it must do.
We are the third. We will say plainly when one of the first two is the better call for you.
Fit
When a remote partner is the right call, and when it isn’t
Most vendor pages selling into Saudi Arabia only argue one side. Here is the honest version.
Hire a remote partner when
- You need a specific system built well, and you can describe what it has to do.
- Your internal team can own decisions, so a two-and-a-half hour time offset costs you nothing.
- The work is a defined build or a defined rebuild, not an open-ended programme.
- You want the source code and the roadmap in your own hands afterwards.
- Your data-protection position is manageable: business data, controlled personal data, or personal data your legal team is willing to cover with the required safeguards.
Hire locally instead when
- The system will hold sensitive personal data as PDPL defines it: health data, biometric or genetic data, criminal records. Keep that inside the Kingdom.
- You are bidding for government work through Etimad where in-Kingdom delivery is a condition.
- Day-to-day delivery has to run in Arabic across your whole stakeholder group, not just at the interface layer.
- You need people physically present through a floor rollout or a plant cutover.
- Your procurement rules require a Saudi commercial registration from the contracting party.
We turn down Saudi projects that fall in the second list. A remote build where a local firm was the right answer is an expensive route to the same destination, and in the first case, a legal problem as well.
Next step
Not sure whether to hire locally?
Send us what the system needs to do and what data it will hold. We will tell you honestly which side of that line you are on, including when the answer is “hire someone in Riyadh.”
Comparison
Remote partner vs local agency vs global consultancy
Every row below is a real difference, including the ones we lose. Rates are deliberately absent: the decision is not a rate comparison and we will not pretend it is. We will run this against your actual scope and data profile.
| Local Riyadh agency | Global consultancy | QalbIT (remote partner) | |
|---|---|---|---|
| Physical Riyadh office | Yes | Usually | No |
| Arabic-first delivery | Yes | Varies | No · English delivery, Arabic in the product |
| PDPL role | Controller or processor, in-Kingdom | Processor, usually in-Kingdom | Processor outside the Kingdom · safeguards required |
| Data residency | In-Kingdom by default | In-Kingdom available | In-Kingdom hosting, remote engineering |
| ZATCA Fatoora integration | Common | Common | Yes |
| Working-week overlap | Full | Full | Sunday–Thursday, 2.5-hour offset from India |
| Etimad government bids | Eligible | Usually eligible | Not eligible without a local entity |
| Source code ownership | Varies | Varies | Yours, full repository |
| Team size on your account | Varies | Large, layered | Small and senior, founder-accessible |
01
The “No” rows are the point.
A comparison table where one vendor wins every row is marketing. Three of the rows above are reasons to hire someone else, and we would rather you find them here than in month four.
02
Data residency and delivery location are different questions.
Your system can run on in-Kingdom infrastructure while the engineers sit elsewhere. That distinction does most of the work in a PDPL conversation, and a lot of vendors blur it.
03
The time offset is smaller than it looks.
Riyadh runs UTC+3, we run UTC+5:30. That is two and a half hours, and the Saudi Sunday–Thursday week overlaps ours on four days out of five.
04
Etimad eligibility is binary.
If your procurement runs through the government portal and requires a Saudi commercial registration, no amount of engineering quality substitutes for it. Ask us early and we will tell you immediately.
What we build
Custom software we build for Saudi companies
Systems that talk to each other, so an order moves through sales, stock, finance and compliance without anyone re-keying it.
CRM
Custom CRM development
Pipelines built around how your team actually sells, not a vendor’s template. Arabic and English field support, role-scoped access, and clean handoff into invoicing where the CRM touches billing.
ERP
Custom ERP modules and extensions
Inventory, purchase, production and finance as connected modules. Most Saudi work starts as an extension to what you already run rather than a replacement.
Portals
B2B portals and customer portals
Supplier, dealer and customer portals that sit on top of the system you already own, with permissions that survive an audit.
Reporting
Internal tools and reporting
Operational dashboards and reporting layers for owners and managers who currently ask someone to pull a number.
Backend
Custom backends and APIs
Laravel, Node.js and NestJS services, integrations, queues and scheduled jobs. The layer that makes the rest possible.
SaaS
SaaS platforms and MVPs
Multi-tenant products for Saudi founders and for established companies productising something they already run internally.
Cost
How much does custom software development cost in Saudi Arabia?
Custom software development cost in Saudi Arabia is driven by scope, integration count and compliance requirements rather than by headcount or hourly rates. A ZATCA-integrated invoicing layer, a PDPL-compliant data architecture and a legacy migration are each separate cost drivers. We scope before quoting and estimate phase one on a fixed basis.
We don’t publish a price range, and we’d suggest treating any firm that does with some caution.
Search this and you will find ranges spanning $10,000 to $500,000. That spread is not information. A two-module CRM for a Riyadh distributor and a multi-entity ERP with Fatoora clearance are not the same project, and no range covers both honestly.
What we do instead is a scoping call, a process map, and a fixed-scope estimate for phase one before you commit to anything beyond discovery. Below is exactly what moves that number, so you can sanity-check any quote you receive, ours included.
Try the software development cost calculatorWhat moves the number
Scope of phase one
The largest single driver. One system built properly beats three built thinly. Most first phases cover two connected modules.
Integration count and quality
Each connected system adds scope, and not equally. A modern REST API with OAuth is straightforward. A legacy system with no event support needs a middleware and reconciliation layer.
ZATCA integration depth
Reporting simplified invoices is not the same job as clearing standard invoices. Clearance means CSID onboarding, XAdES signing, hash chaining and a failure-handling path. Price it as its own workstream.
Data protection architecture
Where personal data lives, what crosses the border, and what has to be tokenised at the boundary. Near-free to design at the start. Expensive to retrofit.
Arabic in the product
Bilingual interface, right-to-left layout, Arabic-correct invoice output and sorting. Real engineering, frequently underestimated.
Data migration depth
Migrating masters and opening balances is routine. Migrating years of transactional history with reconciliation against the old system is a project in its own right.
How we work with Riyadh teams
A delivery process built around a 2.5-hour offset
The offset is small. The working week is not the same. We plan around both instead of pretending neither exists.
Discovery and process mapping
Walk through how work moves through your business today, who touches it, and where it breaks. Identify the highest-pain system for phase one and the data-protection profile for the whole build.
Process map, system roadmap, realistic phase-one estimate, and a written data-transfer position.
1–2 weeks
Architecture and data design
Design the data model, screens and integration contracts. Decide what is hosted in-Kingdom, what crosses the border, and what never leaves.
Approved data model, screen designs, integration plan, hosting and residency decision.
2–3 weeks
Build phase one
Develop in weekly increments, demoing with your real records, parties and documents, not dummy data. Demos land in your Sunday–Thursday week.
Working modules validated against real operational scenarios.
6–14 weeks, scope-dependent
Migration, training and parallel run
Migrate masters and opening balances, train supervisors, and run the new system alongside the existing one until the numbers reconcile.
Confident go-live with reconciled data and trained users.
2–4 weeks
Stabilise, extend, roll out next
Tune performance, add reports and automations, then build the next system on the roadmap as adoption settles.
A system that grows with your operation rather than a one-time delivery.
Ongoing, month-to-month
The Saudi working week runs Sunday to Thursday. Riyadh is UTC+3 and our team is UTC+5:30: a two-and-a-half hour offset, with four of your five working days fully overlapping ours. Thursday afternoon and Friday–Saturday are handled asynchronously with written updates rather than pretended away.
Book a scoping call
Where we fit best
Saudi projects we take on
These are the engagements that work well remotely. The ones that don’t are listed higher up the page.
First build
Replacing spreadsheets with a real system
Companies running operations on spreadsheets and disconnected tools who need core CRM, inventory or purchase workflows built properly the first time. For trading, distribution and services businesses.
Modernisation
Rebuilding software you have outgrown
Old desktop or early web systems rebuilt as modern web applications without losing years of data or retraining everyone overnight. For companies stuck on unsupported systems.
Compliance
ZATCA and PDPL retrofit
Bringing an existing system to Fatoora clearance and restructuring where personal data sits. Often the deadline is what starts the project. For companies with a Wave 25 notification.
Integration
Extending systems you already own
Custom modules, portals and dashboards on top of an existing ERP or accounting product. This is where most of our operational-software work sits today, including custom modules and dashboards built for a trading and distribution business, connecting tools that were never designed to talk to each other. For companies extending what they already run.
Industries
Sectors we build for in Riyadh and across the Kingdom
Operational software is industry-shaped. These are the sectors where the process knowledge transfers.
Trading and distribution
Multi-location stock, transfers and allocation, dispatch planning, proof of delivery, consignment. The complexity is rarely in any single warehouse. It is in reconciling stock across all of them in real time.
Manufacturing and processing
Bills of materials, work orders, job work, wastage and batch costing. Multi-stage production where the cost of a finished unit depends on decisions made three steps earlier.
Professional services and contracting
Project billing, milestone tracking, retention, subcontractor management and the approval chains that go with them.
Retail and hospitality
Multi-branch operations, high B2C invoice volume, and simplified-invoice reporting to ZATCA within the required window.
Next step
Your process is the reason the standard product doesn’t fit.
That is usually why a custom build gets considered at all. Tell us what that process is and we will tell you whether it justifies the project.
Saudi compliance
Building software for Saudi Arabia: ZATCA, PDPL and data residency
These are the two regulations that decide whether a system is usable in the Kingdom, and the two questions a foreign vendor has to answer before you sign anything.
ZATCA e-invoicing (Fatoora)
Phase 2 requires your system to connect directly to ZATCA’s Fatoora platform. Standard B2B and B2G invoices are cleared before you send them to the customer; simplified B2C invoices are reported afterwards. Invoices must be UBL 2.1 XML carrying a UUID, a cryptographic stamp and a QR code. Wave 25, announced on 24 July 2026, covers taxpayers whose VAT-subject revenue exceeded SAR 187,500 in any of 2022, 2023, 2024 or 2025, with integration required by 1 February 2027. That threshold is half of Wave 24’s SAR 375,000 and matches Saudi Arabia’s voluntary VAT registration floor, which makes Wave 25 effectively the bottom of the ladder. Penalties for non-compliance run from SAR 5,000 to SAR 50,000. Where integrations fail: CSID onboarding, XAdES signature validity, and the previous-invoice-hash chain breaking after a rejected clearance, which silently invalidates everything downstream. Sources: ZATCA Wave 25 e-invoicing announcement, zatca.gov.sa · Zakat, Tax and Customs Authority.
Phase 2 · Wave 25
PDPL and cross-border data
Saudi Arabia’s Personal Data Protection Law was enacted by Royal Decree M/19, amended by M/148, and became fully enforceable on 14 September 2024. It applies extraterritorially: an organisation outside the Kingdom that processes personal data of people inside it is in scope. That includes us. Article 29 governs transferring personal data outside the Kingdom. SDAIA’s Regulation on Personal Data Transfer Outside the Kingdom, issued August 2024, permits it under approved safeguards including Saudi Standard Contractual Clauses, with a risk assessment where those apply. Sensitive data (health, biometric, genetic, criminal records) carries tighter restrictions. In practice you are the controller and we are the processor. The transfer has to be justified, documented and contracted, not assumed. Sources: Regulation on Personal Data Transfer Outside the Kingdom, v2.0, August 2024, dgp.sdaia.gov.sa · Saudi Data & AI Authority.
Royal Decree M/19
Vision 2030 context
Saudi Arabia’s digital economy reached approximately SAR 495 billion, contributing 15% of national GDP, with the ICT market surpassing SAR 180 billion by 2024. The Kingdom ranked first globally in the ITU’s 2025 ICT Development Index. Sources: Ministry of Communications and Information Technology · Communications, Space and Technology Commission.
We build systems that emit compliant output natively rather than bolting a compliance module onto software that resists it. If a Wave 25 notification is driving your timeline, that date is where we start planning backwards from.
Working with us
Hiring a vendor outside the Kingdom: the honest version
Every foreign vendor selling into Saudi Arabia has the same four exposures. Most of them do not put the list on their website. Here it is.
Data transfer
You are the controller. Every transfer of personal data to us needs a lawful basis under Article 29 and documented safeguards. This is contract work, done once, before the build.
Sensitive data
Health, biometric, genetic and criminal-record data carries tighter restrictions. If your system holds it, plan for in-Kingdom processing regardless of who writes the code.
Government procurement
Etimad tenders frequently require a Saudi commercial registration from the contracting party. We do not have one.
Physical presence
Nobody from our team will be in your office on Tuesday. Floor rollouts and plant cutovers need local hands, and we will say so before you sign.
Everything else
Payment gateways, e-invoicing service providers, accounting products, logistics providers, banking APIs, BI tools.
Integrations
None of that is a reason to avoid a remote partner. It is a reason to handle the contract properly at the start rather than assuming it away. We say this before the estimate, not after.
Tech stack
Technology we use for Saudi builds
Business systems live for a decade. We choose proven technology your future team, internal or external, can maintain.
Backend and business logic
- Laravel (PHP 8.x) for modular business systems with strong audit trails.
- NestJS (TypeScript) where event-driven flows and heavy integrations dominate.
- Queues and schedulers for syncs, alerts and report generation.
Frontend and usability
- Next.js and React with keyboard-first data entry and fast text views.
- Bilingual Arabic and English interfaces with correct right-to-left layout.
- Role-based dashboards for owners, managers and operators.
Data and integrations
- PostgreSQL and MySQL with strict constraints for financial integrity.
- ZATCA Fatoora clearance and reporting APIs.
- Integrations with accounting products, payment gateways and logistics providers.
Security and residency
- Role- and location-based permissions with full audit logging.
- In-Kingdom hosting options where residency is required.
- Automated backups, staged deployments, monitoring and alerting.
Running an existing ERP, an accounting product, or spreadsheets-plus-email today? We can integrate and extend before we replace: the migration path is part of the plan, not an afterthought.
Outcomes
What the project should actually change
Not projections. These are the operational changes the build is meant to produce, and how you would know whether yours did.
| What changes | How you’d measure it |
|---|---|
| One source of truth across branches and systems | Variance between system records and physical count |
| Compliance output is generated, not assembled | Hours per filing period |
| Invoices clear ZATCA first time | Rejected-clearance rate and hash-chain breaks |
| Approvals are enforced, not remembered | Share of transactions with a complete audit trail |
| Arabic output is correct without manual fixing | Documents requiring rework before sending |
| Owners see position without asking anyone | Time from question to answer |
A note on sourcing
A note on sourcing
We don’t quote a headline failure rate for software projects. The widely circulated figures attributing 55–75% failure to Gartner have no traceable primary source, and we won’t repeat them to make a point. Where we cite a number on this page, the source and date are next to it.
Why QalbIT
Why work with us
Eight years building operational software
120+ engagements delivered across web, mobile and platform work, with 50+ clients. Clutch 5.0, Google 4.9, Upwork Top Rated. We deliver into the GCC today as a white-label engineering partner to a regional agency, and our Saudi-facing work is built on that same operational-software experience.
We say what we are
No Riyadh office, no local entity, no implied presence. The compliance section above exists because we would rather lose a deal at the scoping call than at the audit.
You own the code
Full source ownership, documented, in your repository. No licence, no per-seat fee, no restriction on hiring a different team later.
Senior team, founder-led
A small senior team with direct access to the people writing the code. You won’t be handed to an account manager who relays questions to engineers you never meet.
We’ll tell you to hire locally
When a Riyadh firm is genuinely the better answer, we say so on the first call. It costs us a project and saves you a year.
QalbIT did a great job turning my idea into a real product. What I really appreciate is how well they understand my requirements, even when I'm not fully sure how to explain or finalize things. They listen patiently, guide me when I'm stuck, and always try to find the right solution. I really enjoy working with their team and I'm definitely looking forward to continuing our work together in the future.
FAQs · Custom software development in Saudi Arabia
Frequently asked questions from Saudi teams
These are the questions founders, operations heads and finance teams actually ask when they compare a remote partner with a local agency.
Talk to the teamNext step
Let’s scope the first system.
Tell us how work moves through your business today. We will map the process, identify which system earns its place first, and give you an honest estimate with a phased plan. If a Riyadh firm is the better answer, we will tell you that instead. Typically a reply within 24–48 hours, with questions rather than a brochure.
Further reading
- Custom CRM vs Salesforce, HubSpot & Zoho: Which One Actually Fits Your Business?Build or buy your CRM? We compare custom CRM development against Salesforce, HubSpot and Zoho on real 2026 pricing, three-year cost of ownership for…Jul 12, 2026
- Custom ERP vs Odoo vs SAP: What Growing Businesses Should Choose in 2026Every SME outgrowing spreadsheets faces three doors: Odoo, SAP, or custom. Here’s the honest 2026 comparison — real licence prices, five-year math…Jul 17, 2026