Next.js and SaaS development for Riyadh, Saudi Arabia
Web app development in Riyadh: Arabic first, with Nafath and mada built in
My team takes on web app development in Riyadh for founders who must put the app in front of users on day one: React and Next.js apps that run right to left in Arabic, sign people in with Nafath, take mada payments and hand invoices to ZATCA's Fatoora platform. I'm Maniruzzaman Jubayer, building from Dhaka on the same Sunday to Thursday week as you, with 7 hours of your working day shared.
Right to left and data residency go into the first commit, not the last.
Free 30 min intro call, Sunday to Thursday · Written scope · One fixed quote
Teams shipping fintech, health and SaaS products work with me
- Years leading a design team
- 3+
- Products shipped
- 50+
- Behance gallery features
- 22
- Clutch rating
- 5.0
Product designer and design lead, with a senior team behind me
Building a web app for Saudi users: four gaps I close before launch
The UN's 2024 Local Online Services Index placed Riyadh third of 193 cities, behind only Madrid and Tallinn. Your users already know what a good Saudi web service feels like, so these gaps show at once.
Problem 01
Arabic flipped with a stylesheet at the end
Many React apps hard-code left and right, so the Arabic build mirrors badly: arrows point back, tables misalign and numbers jump. My developers set the direction on the html element, write spacing as logical CSS properties and isolate mixed Arabic and Latin text, so both languages hold.
Problem 02
A Nafath login that ends at a spinner
Nafath asks the person to pick a matching number in its app, so the web page has to wait, check back and recover. My team builds that waiting screen, the expired and rejected states and a fallback for anyone without Nafath, then wires it through your identity provider.
Problem 03
Hosting chosen before the data rules
The PDPL lets personal data leave the Kingdom only for set purposes and under conditions, and SDAIA's transfer regulation asks for a risk assessment before, for example, sensitive data goes abroad continuously. I map what every table holds first, then host with you where that data has to live.
Problem 04
Invoices the Fatoora platform will not accept
ZATCA's wave 25 brings businesses with more than SAR 187,500 of VAT-able revenue in any year since 2022 onto Fatoora by 1 February 2027, and B2B invoices must be cleared before the buyer sees them. My team connects your billing to your e-invoicing solution and tracks each invoice's status.
Work picked for the sectors Riyadh is building
An AI-powered investment dashboard, an AI app for finding a doctor and booking care, and a micro-task platform for teams and workers, all designed under my lead. They match three sectors growing fast in the Kingdom, finance, health and business software, and my developers build interfaces like these in React.
Product design · Fintech
Nexfolio
Portfolio management, market forecasts and AI insights in a web app made for modern investors.
View case study →
Product design · Healthcare
CareUp
A mobile healthcare app, from user research and wireframes to the identity and final UI.
View case study →
Product design · SaaS
OpsLoop
A two-sided platform for labelling, QA and content tasks, designed for both the teams and the workers.
View case study →Not sure where your users' data is allowed to live? Let's map it first.
Marhaba, book a callNext.js development for Riyadh: what my team builds into a Saudi web app
Six things written into the scope before any code, so Arabic, identity, payments, tax and hosting never turn up as surprises in the last sprint.
Right to left in the code itself
The dir and lang attributes set per route, logical properties instead of left and right, bdi around names and numbers, icons mirrored only where meaning flips, and Next.js routes for Arabic and English with matching metadata.
Nafath sign-in with every state
The national ID or Iqama field, the number to match, checking back while the person approves in the app, and expired, rejected and fallback paths, connected through the identity provider you already use.
mada checkout through your gateway
HyperPay, Moyasar, Tap or the gateway you hold, with mada cards, Apple Pay and 3D Secure redirects handled, and pending, failed and refunded states your support team can explain to a customer.
Billing that talks to ZATCA
Invoice and credit note screens, webhooks that pass each invoice to your e-invoicing solution, a cleared or reported status beside every line, and the QR code shown where your customer expects it.
Hosting and data mapped to the PDPL
A written data map, the database, files and backups in a Saudi cloud region where they must stay, consent records, and data requests answered inside the 30 days the implementing regulation sets.
Security your auditors can follow
HTTPS everywhere, a web application firewall, separate front end, API and database tiers, sign-in factors set by risk, and breach logs detailed enough to notify SDAIA within 72 hours.
How a web app build runs for a Riyadh team
Four steps, planned around your Sunday to Thursday week, with the price fixed before the first sprint.
- 01
Free 30 minute intro call
A Google Meet on a weekday that suits Riyadh. Tell me who signs in, what they pay with and where their data must stay. By the end you know, honestly, if my team is right for it.
- 02
Written scope and one fixed quote
The scope lists the Arabic and English screens, the Nafath and payment states, the hosting region and the ZATCA hand-off, then prices the whole build once. No retainer, no surprise invoices.
- 03
Build sprints with a living data map
My developers work in your repository in weekly sprints, Arabic and English side by side, with a preview link on every pull request and a data map that grows with each table we add.
- 04
Go-live in your Saudi region, then handover
We deploy to the region you chose, move payments from test to live keys with you, run a last right to left and security pass, then hand over code, docs and accounts in your company's name.
The practical details for teams in Riyadh
- Languages
- Arabic and English built in one codebase; meetings in English
- Clock
- Dhaka runs 3 hours ahead of Riyadh, so 7 hours of your working day overlaps mine
- Working week
- Sunday to Thursday for both of us, with Friday and Saturday off
- Stack
- TypeScript, React and Next.js, deployed to the cloud region your data rules call for
- Ways to talk
- calls on Google Meet, one Slack channel we both use, and review notes on every pull request
Web and SaaS development for the sectors growing in Riyadh
Figures come from the Vision 2030 Annual Report 2025 and each sector's regulator. Every picture is a screen from one of our own projects in that field, never a Saudi client.
Fintech under SAMA
Vision 2030's 2025 report counts 301 fintech firms, and digital payments now carry 85% of retail transactions. SAMA's cyber framework asks banks, insurers and finance companies for secure coding standards and a documented authorisation matrix.
Healthcare and insurance
Saudi providers and insurers exchange eligibility checks, pre-authorisations and claims through nphies, the Council of Health Insurance platform. Patient portals and clinic tools need those steps built in, plus Arabic booking and careful consent.
Logistics and delivery
Riyadh's Special Integrated Logistics Zone opened beside King Khalid International Airport in October 2022. Logistics web apps need live tracking, Arabic addresses, dispatcher dashboards and pages that stay quick for drivers on mobile data.
SaaS and business software
Wave 25 pulls Saudi businesses above SAR 187,500 of VAT-able revenue onto Fatoora, so smaller customers now need compliant invoices too. B2B SaaS here needs that billing hand-off, bilingual tables and roles that mirror layered sign-off.
Real estate and property
Riyadh rents are frozen for five years from 25 September 2025, and every lease must be registered on Ejar. Property web apps need records that match Ejar, Arabic listings with maps, and Hijri and Gregorian dates together.
AI products
PIF launched HUMAIN in Riyadh in May 2025 to build AI from data centres up to an Arabic-first model. AI web apps here need answers that stream right to left, sources people can check and plain notices about data use.
Working with my team from Riyadh, day to day
Remote from Dhaka, but inside your week, your regulators and your users' language.
You talk to me and the developers
No account manager in the middle. The developers who write your React code answer you directly in Slack and on calls, and I lead every weekly review myself.
One weekend, three hours apart
Saudi Arabia moved its weekend to Friday and Saturday in 2013, and Bangladesh rests on the same two days. Your Sunday to Thursday is our working week, 7 hours of your day overlaps ours, and calls are booked in Riyadh time.
Everything written and tracked
Figma for screens, your repository for code, decisions in writing. A Slack update lands every 48 hours, and each weekly call shows working software in Arabic and English, never slides.
Saudi systems are on my checklist
Nafath, mada and your gateway, ZATCA's Fatoora platform, the PDPL and its transfer rules, the NCA's controls, Hijri dates and Arabic search sit on my checklist before we write a line, so nobody on your side has to teach me the basics.
A Saudi web app three ways: a new hire, a freelancer or my team
Each route has a fair case. This is how they compare on the points that matter most for a Saudi web app.
| What you get | With me | In-house hire | Freelancer |
|---|---|---|---|
| Begins without recruitment or relocation | Yes | No | Yes |
| Arabic right to left built into the components | Yes | Sometimes | Sometimes |
| Nafath, mada and the ZATCA hand-off written into the scope | Yes | Sometimes | Sometimes |
| Hosting planned around the PDPL transfer rules | Yes | Sometimes | Sometimes |
| Designers and front-end developers on one senior team | Yes | No | No |
| A single fixed price for the full build | Yes | No | Sometimes |
| At a desk in Riyadh from Sunday to Thursday | No | Yes | Sometimes |
Who I build web apps for in Riyadh
Four kinds of team bring their build to me from the Kingdom. If one of them sounds like you, a 30 minute call settles whether we suit each other.
Funded startups with a launch date
You raised, the date is set and the app must work in Arabic from day one. My team builds the first version with Nafath and mada in place, then hands it cleanly to the engineers you hire next.
Fintech and regulated teams
If SAMA's framework or the NCA's controls apply to you, my developers work to your security team's standard: secure coding, an authorisation matrix, audit logs and a written record of every access rule.
Government-linked and enterprise teams
The NCA's essential controls bind government agencies and their companies, and the Kingdom now runs 490 government digital platforms. I work inside your review chain and document each decision so security and compliance can sign off.
Regional headquarters setting up in Riyadh
Vision 2030's 2025 report counts 700 regional headquarters, up from 44 in 2021. If your product began elsewhere, I adapt sign-in, payments, invoices and hosting for Saudi users while keeping one codebase for every market.
Other services for teams in Riyadh
If the Arabic screens are not designed yet, start with my product design work for Riyadh, and the same team builds what it drew.
What founders say about building with me
Working with Jubayer and the team has been a blast. Their creativity has honestly taken our platform to new heights. Incredibly professional and so proud to work with, we’re over the moon with their results, and we can’t wait to team up with them again.
I highly recommend Jubayer for any design project. He quickly grasps complex concepts, excels in standard design practices, and responds promptly.
Working with Jubayer on our website was fantastic from start to finish. He took the time to understand our vision and provided valuable insights.
Guides for teams building web apps in Saudi Arabia
Long reads on Nafath, costs in riyals and Arabic interfaces, with every source listed.
Web app development in Riyadh: questions Saudi founders ask
Complete answers, so you can judge the fit before we speak.
What drives the cost of a web app built for Riyadh?
Scope, not a day rate. The number of screens and user roles, Arabic and English layouts, Nafath sign-in, the payment gateway, the ZATCA hand-off and the hosting region move it most. After a free 30 minute call I write the scope down and quote the whole build once, with no retainer. For market prices of design work, see my guide to UI/UX design costs in Riyadh, with rates in riyals and VAT.
Are you a web development company in Riyadh or a freelance developer?
Neither, exactly. I'm Maniruzzaman Jubayer, a senior designer who leads a team of designers and React and Next.js developers, working remotely from Dhaka. My team has no Riyadh office and is not registered as a Saudi company. You get a freelancer's directness, because you talk to me and the developers, and one team for design, build, hosting and handover.
Can my web app keep Saudi users' data inside the Kingdom?
Yes. Google Cloud runs a region in Dammam, and Oracle runs regions in Riyadh and Jeddah. Microsoft says its Saudi Arabia East region opens in November 2026, and AWS says its Saudi region launches in December 2026. My team puts the database, file storage and backups in the region you choose, and keeps logs and analytics there too wherever your data map says they must stay.
Can our app send personal data outside Saudi Arabia?
Often, under conditions your lawyer confirms. Article 29 of the PDPL and SDAIA's transfer regulation allow transfers for set purposes, such as serving the person, where protection is adequate or safeguards such as standard contractual clauses apply. Some cases need a risk assessment first, such as sending sensitive data abroad continuously. I list every service that touches personal data, from email to analytics, so that assessment rests on facts.
How does Nafath integration work in a web app?
The person enters a national ID or Iqama number, a number appears on screen, and they approve the matching number in the Nafath app on their phone while the page waits and checks back. My team builds that waiting screen, the timeouts and the failure and fallback paths, and connects them through your identity provider. Each screen and fallback is laid out in my Nafath integration guide.
Does ZATCA's wave 25 reach our SaaS customers?
If they sold more than SAR 187,500 subject to VAT in any year from 2022 to 2025, yes: they must integrate with Fatoora by 1 February 2027. Standard B2B invoices go to Fatoora as XML and come back cleared with a cryptographic stamp and QR code, while simplified B2C invoices are reported within 24 hours. My team builds the billing side; your accountant owns the tax rules.
How do you build Arabic right to left in React?
In the markup first. We set dir and lang on the html element for each route, use logical properties such as margin-inline-start instead of left and right, wrap names and numbers in bdi, and set dir to auto on fields where people type either language. Then we test every component in both directions, because a mirrored clock or play icon is a bug, not a feature.
Can you build search that works properly in Arabic?
Yes. Arabic search fails when it treats the different forms of alif as different letters, or trips over diacritics and the ta marbuta. My developers normalise both the query and the index, match with and without diacritics, accept Arabic and Western digits, and test with real product, street and district names in Arabic before launch.
Do the NCA's cybersecurity controls apply to our web app?
They bind government agencies, their affiliated companies and operators of critical national infrastructure, and the NCA encourages everyone else to follow them. The PDPL's implementing regulation also points data controllers to NCA controls or recognised best practice. For external web apps the controls ask for a web application firewall, a multi-tier architecture, HTTPS and sign-in sized to the risk, which my team builds by default.