How to choose a software company in Saudi Arabia
A checklist that ranks nobody: registration, the clauses Saudi entities expect, source-code ownership, Arabic quality and tax on foreign vendors.
To choose a software company in Saudi Arabia, check five things before you compare prices: who you are legally contracting with, whether the contract covers confidentiality, data removal and incident notice, who owns the source code and the app accounts, how good the Arabic is, and what tax applies if the company is abroad. A vendor that answers all five clearly is safer than a cheaper one that cannot. This checklist ranks nobody.
Last checked: 6 November 2026
Check who you are actually contracting with
- A Saudi company should give you its commercial registration (CR) number, and the name on the CR, the contract and the invoices should match.
- A foreign company should show its registration in its home country, and the contract should name that company, not a person's private account.
- A freelancer can suit a small job, but ask who takes over if they are unavailable.
Then ask for work you can check yourself: a live system, an app you can download, or a past client you can call. Directories such as Clutch weigh verified reviews most heavily. Our general guide on choosing a software company without being a technical person explains how to judge a demo.
Put the security clauses in the contract
Saudi Arabia's National Cybersecurity Authority (NCA) already lists the minimum clauses for contracts with third parties. Control 4-1-2 of its Essential Cybersecurity Controls (ECC-2:2024) asks for:
- non-disclosure, and secure removal of your data when the service ends;
- a procedure for communicating cybersecurity incidents;
- the vendor applying your own cybersecurity requirements.
The ECC binds government bodies and operators of critical national infrastructure; other businesses are only "strongly encouraged" to follow it. Even so, these clauses are a sensible baseline for any company.
If the system holds personal data, the Personal Data Protection Law (PDPL) has been in force since 14 September 2023, and breaches must be reported to SDAIA within 72 hours. Your vendor must tell you fast enough to meet that, and should say where the data will be hosted. SDAIA has consulted on draft amendments that would require storing personal data in the Kingdom; they are still a draft, not law.
Own your source code, accounts and data
- IP and source-code assignment. The contract should say that the code, designs and documentation made for you belong to you once paid for, and that you receive the source code, not only a running system. Write it down; do not assume it.
- App store accounts. Your mobile app should be published under your own Apple and Google developer accounts, with the vendor added as a team member. An app published under the vendor's account is hard to move.
- Domain, hosting and paid services. Register them in your company's name and keep the admin logins.
- Handover. Agree on what you receive at the end: the code repository, a database export and deployment notes.
Our list of nine things to check in a software development contract goes through the rest of the contract clause by clause.
Test the Arabic, not just the translation
In Saudi Arabia, Arabic is often a requirement rather than a feature. ZATCA requires the human-readable tax invoice to be in Arabic, with other languages optional. The National Arabic Language Policy, approved in 2026, is not a standalone enforcement tool, but it encourages Arabic in contracts, invoices and communications.
Ask to see a screen the vendor has built in Arabic and check that:
- the layout really runs right to left, including tables, menus and forms;
- invoices and reports print correctly in Arabic;
- search works with Arabic names and their spelling variants;
- the text reads as proper Arabic, not machine translation.
If your system issues invoices, it must also follow ZATCA's e-invoicing rules; see our guide to ZATCA Phase 2 integration for a custom POS or ERP. ZATCA does not certify software, and it says its Solution Providers Directory is not an approval, so "ZATCA-approved" on a sales page is not a credential.
Local or remote: what actually changes
A company in Riyadh or Jeddah can visit your premises, which matters for hardware installation and on-site training. A remote team can cost less and work well if the process is clear:
- Working days. The Saudi weekend is Friday and Saturday, so check how much of your week the vendor is reachable. Cairo, for example, works on Riyadh time from late April to late October and one hour behind it in winter.
- Regular demos. Ask for working software every one or two weeks. Long silences are one of the patterns in why software projects fail.
- Government buyers. Since early 2024, government bodies have been restricted from contracting with foreign firms that have no regional headquarters in the Kingdom. Contracts of SAR 1 million or less are exempt, and an exemption service runs on Etimad.
Tax when the vendor is abroad
This is general information, not tax advice; confirm the details with your accountant.
| Item | What applies | Who handles it |
|---|---|---|
| VAT at 15% | Reverse charge on services from a non-resident supplier | The Saudi VAT-registered client self-accounts for it |
| Withholding tax | 5% on technical and consulting services; licence-type payments can be royalties at 15% | The client deducts it from the payment |
| Tax treaty | A treaty with the vendor's country may change the rate | Your tax adviser |
| E-invoicing | ZATCA's rules cover taxpayers resident in the Kingdom | A foreign vendor's invoice is generally not a FATOORA e-invoice |
ZATCA's guideline treats software development, maintenance, support and training as technical services when separable from the software. Agree in the quote whether the price is before or after withholding.
A one-page checklist
| Question | A good answer | A warning sign |
|---|---|---|
| Who signs the contract? | A registered company, named on contract and invoices | A personal account, or a name that changes |
| Who owns the code? | You do, with the source code handed over | "We license it to you" |
| Whose app store account? | Yours, with the vendor added | The vendor's |
| What happens to your data at the end? | Returned and securely deleted | No answer |
| Is the price fixed? | A written quote for a written scope | An open hourly estimate |
KF Tech Solutions is a software studio in Cairo, founded in 2020. We build custom software, websites, mobile apps, POS and ERP systems and WhatsApp chatbots, and we work with businesses in Egypt and the Gulf; our Saudi Arabia page explains how. Projects start from $200 (about SAR 750 / AED 735); the final price depends on scope, with a fixed written quote after a free call. If you are budgeting for an app, see app development cost in Saudi Arabia.
Common questions
What is the best software company in Saudi Arabia?
There is no single best one. The right company fits your project, accepts the clauses above and shows work you can verify. Be wary of "top 10" lists that do not explain their ranking.
Should I choose a Saudi company or a foreign one?
Choose a local company if you need people on site often, or if you are a government body affected by the regional headquarters rule. For most private businesses, a remote team works when the contract, the shared working hours and the demo schedule are clear.
Do I have to deduct withholding tax when paying a foreign vendor?
In general, payments to a non-resident for technical services carry 5% withholding tax, deducted by the Saudi payer. A tax treaty or the exact nature of the payment can change this, so check with your accountant.
Is a "ZATCA-approved" software company safer?
ZATCA does not approve or certify software; its directory is a guiding list. Ask instead to see the system clear and report invoices in ZATCA's test environment.
If you want a second opinion on a quote or a contract, send us your brief or book a free call.
Sources
- NCA, Essential Cybersecurity Controls ECC-2:2024
- ZATCA, General Guideline for Withholding Tax
- ZATCA, Guideline on Imports and Exports under VAT
- ZATCA, E-Invoicing Detailed Guideline
- ZATCA, Solution Providers Directory
- PwC Tax Summaries, Saudi Arabia: other taxes
- DLA Piper, Data protection laws: Saudi Arabia
- Clyde & Co, SDAIA publishes draft amendments to the PDPL
- CMS, Saudi Arabia's National Arabic Language Policy
- Asharq Al-Awsat, contracting exceptions for firms without a regional HQ
- Crowell, Saudi Arabia changes weekend to Friday–Saturday
- Clutch, software developers in Saudi Arabia
Keep reading
Newsletter
Occasional notes on software, automation and running a better business. No spam.