To choose a software company in Saudi Arabia with confidence, get written proof of three things before you sign: it understands the Personal Data Protection Law and e-invoicing where they apply to you, its contract transfers source code ownership to you, and its quote is itemized against realistic numbers. For reference, HBS 2026 prices start from 15,000 SAR for a mobile app, 22,500 SAR for a custom ERP or CRM, and 3,750 SAR for a company website. This guide covers the Saudi regulatory checks, the contract clauses that protect you, local versus remote teams, a scoring table for your shortlist, red flags, and the questions to ask before signing. The general criteria for any market are in our guide to the 8 criteria for choosing a software company; this one covers only what is specific to Saudi Arabia.
Which regulatory checks should a software company in Saudi Arabia pass?
Four checks tell you whether a company fits a Saudi project: personal data protection, e-invoicing if your system issues invoices, the Essential Cybersecurity Controls if your organization is in scope, and mada if you accept payments.
| Check | Applies to you if | What to get in writing |
|---|---|---|
| Personal data protection (SDAIA) | Your system collects data on individuals in the Kingdom | Where data is stored, who can access it, how it is deleted, and a breach notification plan |
| E-invoicing (ZATCA) | Your system issues tax invoices | FATOORA integration, tested before launch |
| Essential Cybersecurity Controls (NCA) | A government entity, its affiliate, or an operator of critical national infrastructure | A contractual commitment to your cybersecurity requirements and policies |
| mada and the payment gateway | Your app or store accepts payments | mada support for online payments and a merchant account in your name |
The Personal Data Protection Law
Article 2 of the law text published by SDAIA applies it to any processing of personal data in the Kingdom, and to processing of residents' data by any party outside it. Article 8 matters most to you: as the Controller, you may only select Processors that provide the necessary guarantees, and you must monitor their compliance. Choosing a software company is a compliance decision before it is a technical one. Fines reach five million riyals under Article 36. SDAIA's National Data Governance Platform lets entities report a personal data breach within 72 hours of becoming aware of it, so ask: how will I learn of a breach before that window closes? If hosting or support sits outside the Kingdom, ask the company to explain the transfer conditions in Article 29.
E-invoicing and the FATOORA platform
If your system will issue tax invoices, such as an ERP, an online store or a booking app, e-invoicing applies. Phase one started on 4 December 2021 and phase two on 1 January 2023, rolled out in waves. Phase two requires the taxpayer's invoicing system to integrate with ZATCA's FATOORA platform, and ZATCA notifies taxpayers of their wave at least six months in advance. Do not stop at asking whether the company is on ZATCA's list: ZATCA says its Solution Providers Directory is a guiding list, not an approval of the solutions, and that what counts is whether your system meets the requirements. Ask to see the integration work with a test invoice before launch. For connecting invoices to your accounts, see our guide to finance automation and e-invoicing.
The Essential Cybersecurity Controls
These controls do not bind every company. ECC-2:2024 applies to government agencies in the Kingdom and their affiliated companies and entities, plus private sector entities that own, operate or host Critical National Infrastructure; the NCA encourages all other entities to apply them. If you are in scope, your third-party contracts must include non-disclosure and secure removal of your data at the end of service, incident communication procedures, and an obligation to apply your cybersecurity policies. If the company will provide managed cybersecurity services, its monitoring and operations centers that use remote access must be fully located in the Kingdom. Data localization controls have moved from this document to the National Data Management Office at SDAIA, so check with the NDMO before deciding where to host.
mada and payment gateways
If your app or store takes payments, mada support is a basic requirement. mada is a national payment system owned by the Saudi Central Bank since 1990 that lets cards pay on e-commerce sites, and electronic payments reached 85% of retail payments in 2025, up from 79% in 2024. Ask: which gateway will you integrate, does it support mada, and who owns the merchant account? The right answer to the last one: you do.
Which clauses should your contract with a software company include?
Eight clauses decide who owns what and who pays when; missing any of them means carrying a risk you have not priced:
- Source code ownership: code, designs and databases transfer to you on payment, delivered in a repository in your name, not the company's.
- Intellectual property and licensed components: a list of the libraries and paid plugins the system relies on, and whether the company keeps rights to a framework it reuses with other clients.
- Third-party code escrow: if the code is not in your repository from day one, an up-to-date copy deposited with an independent party and released to you if the company stops operating.
- Service Level Agreement (SLA): response time by severity, target availability, and what happens when they are missed.
- Support and warranty period: how long bugs are fixed free after launch, and the monthly support price after that, in writing now.
- Change requests: a written process to estimate any out-of-scope change and get your approval before work starts.
- Milestones and payment schedule: payments tied to deliverables you test yourself, not to the calendar.
- Exit and data return: your data handed over in a usable format and securely deleted when the relationship ends, which the cybersecurity controls require of entities in their scope.
Is the best software company in Riyadh the one closest to your office?
Not necessarily: proximity makes meetings and workshops easier, but results depend on clear responsibilities, shared working hours, and where your data lives and who can access it.
| Model | Where it wins | What you pay for | Best for |
|---|---|---|---|
| Local office in Saudi Arabia | In-person meetings and direct familiarity with local entities | Higher operating costs that usually show in the price | Government entities and projects needing frequent on-site presence |
| Fully remote team | Lower price and a wider choice of talent | A possible time gap and questions about where data sits | A clearly scoped product with written requirements |
| Hybrid model | A project manager close to you and developers in a nearby time zone | Discipline in documentation and communication | Most mid-sized private companies |
HBS is a Cairo-based company serving clients in Saudi Arabia, so we will say it plainly: a remote team works well when hosting, the repository and app store accounts are in your name, and one project manager answers during your working hours. If your organization is within the cybersecurity controls, read the managed cybersecurity services condition above first.
How much does hiring a software company in Saudi Arabia cost in 2026?
At HBS 2026 prices, a mobile app starts from 15,000 SAR, a custom ERP or CRM from 22,500 SAR, and a company website from 3,750 SAR; these are starting prices, and the final quote follows a free discovery call.
| Service and package | From (SAR) | Typical timeline | Best for |
|---|---|---|---|
| Starter app (MVP) with core screens and a simple admin | 15,000 | 6 to 8 weeks | Testing an idea in the market |
| Growth app with user accounts, payments, an admin dashboard and integrations | 34,000 | 3 to 4 months | An established business selling through the app |
| Enterprise app with complex logic, multiple roles and heavy integrations | 67,500 | 5+ months, phased | Multi-sided platforms |
| Starter ERP or CRM with one or two core modules | 22,500 | 2 to 3 months | Replacing Excel files in one department |
| Growth system with several modules, integrations and reporting | 52,500 | 4 to 6 months | A company with several departments and branches |
| Enterprise system | 105,000 | 6+ months, phased | Large multi-entity operations |
| Corporate website, 5 to 7 pages | 3,750 | 2 to 3 weeks | A fast digital presence |
| Custom-designed bilingual website, 10 to 15 pages | 9,000 | 4 to 6 weeks | A company that wants its site to bring in clients |
| Advanced custom build (Next.js and integrations) | 22,500 | 2 to 3 months | A website that is a core business asset |
Prices are valid as of October 2026 and exclude VAT, charged at 15% on supplies subject to the standard rate per ZATCA's professional services guideline. Website packages are detailed in our website design cost guide for Saudi Arabia, and apps on our mobile app development service page.
| Inside the build price | Outside the build price (paid separately) |
|---|---|
| Design and development within the agreed scope | VAT |
| Admin panel as per the package | App store fees: 99 USD per year for the Apple Developer Program and a one-time 25 USD Google Play registration |
| Integrations named in the quote | Hosting, servers and domains |
| Testing and launch | Payment gateway fees, paid plugins or themes, and licensed stock media |
What pushes the price of your project up or down?
Scope, integrations and compliance move the price more than anything else:
- User types and permissions: a customer, a sales rep, a manager and an accountant are four experiences, not one.
- Integrations: FATOORA, the payment gateway, shipping companies, WhatsApp, and the systems you already run.
- Compliance: privacy impact assessments, audit logs, hosting requirements, and controls for government entities.
- Language and direction: an Arabic and English interface designed right-to-left from the start.
- Data migration: moving years of Excel files or a legacy system takes cleaning and testing.
- Platforms: iOS and Android together, one platform, or a web dashboard only.
- Clarity of requirements: a ready requirements document lowers the price; discovering scope mid-build raises it.
- Phased delivery: launching a first version, then extending it, lowers the first payment and the risk.
How do you compare the software companies on your shortlist?
Score each company from 1 to 5 on every criterion, multiply by the weight, and pick the highest total, provided it scores at least 3 on compliance and contract terms:
| Criterion | Weight | Evidence to ask for |
|---|---|---|
| Understanding of Saudi regulatory requirements | 20% | Specific written answers on data, invoicing and payments |
| Contract terms | 20% | A draft contract covering code ownership, escrow and exit |
| Verifiable past work | 15% | Published apps and clients you contact yourself |
| Clarity of the quote | 15% | Itemized lines, milestones and payments |
| Post-launch support | 15% | An SLA with written response times |
| Team and communication | 10% | Names of the people on your project and contact hours |
| Experience with Arabic interfaces | 5% | Samples of right-to-left interfaces |
Example: a company scoring 4 on compliance, 5 on contract terms and 3 on everything else totals 3.6 out of 5, and it beats a cheaper company that scored 2 on compliance, whatever that company's total.
What are the red flags in a suspiciously cheap quote?
A cheap quote is a risk when it is cheap because it leaves out something you will need later. You will see quotes far below our prices; compare them line by line and the gap usually sits in one of these signs:
- A single number with no breakdown of items, milestones or timeline.
- No mention of code ownership, or handover tied to a long support contract.
- A final price before any question about invoices, personal data or payments.
- Hosting, app store accounts and the merchant account in the company's name, not yours.
- A large upfront payment not tied to any deliverable.
- "E-invoicing compliant" with no working integration shown.
- Permanent support with no conditions and no written response times.
- A ready-made template presented as a system built from scratch.
Which questions should you ask a software company before you sign?
Ten questions that reveal in one meeting whether the company understands the Saudi market or is selling you a generic quote:
- Where will my customers' personal data be stored, who can access it, and how is it deleted when the contract ends?
- If a data breach happens, how and when will I find out?
- How will you prove the FATOORA integration before launch?
- Is my organization within the scope of the Essential Cybersecurity Controls, and how will you commit to my requirements in the contract?
- Which payment gateway, does it support mada, and whose name is the merchant account in?
- When does the source code transfer to me, and into which repository?
- Which licensed components does the system depend on, and who pays for renewals?
- Who, by name, will work on my project, and who is my project manager?
- What is the warranty period after launch, and what does monthly support cost after that?
- How are change requests priced, and who approves them?
Do you want a partner who answers these questions in writing before you pay?
HBS Group builds systems, apps and websites for clients in Egypt and Saudi Arabia, and we are glad to answer this guide's questions in writing before you sign. Our 2026 prices start from 15,000 SAR for apps and 22,500 SAR for ERP and CRM systems; the final quote comes after a free discovery call on your scope and regulatory requirements, and excludes taxes and third-party costs. Explore our software development service, or contact us to book your free call and find out exactly what your project will cost.
