Web Application Development in Saudi Arabia: A Portal Guide

Customer requests sit in a WhatsApp group, approvals live in a spreadsheet, documents are in one employee's inbox, and clients call every other day to ask where their order is. That is the point where a company website stops being enough, and web application development in Saudi Arabia starts to pay off: one system that runs in the browser, where each user signs in with their own permissions and the data lives in one place.

This guide explains the difference between a website, a web app and a portal, the portals businesses most often need, how a build runs, which integrations matter, the security and data-protection basics, and what drives the cost, including our starting price.

What is the difference between a website, a web app and a portal?

A website presents your business and brings in customers. A web app gets work done: requests, approvals, reports. A portal is a web app for one defined group, such as clients, staff or suppliers, where each user sees only what belongs to them. All three run in the browser with nothing to install.

Many projects combine all three: a public website that brings in the request, a portal where the client follows it, and a dashboard where your team runs the work.

Which portals do Saudi businesses need most?

Most portals start from a question that eats your team's time. If clients, staff or suppliers ask the same thing every day, there is a portal waiting to be built.

Signs that you need a portal

• One or more employees spend a large part of the day answering status questions.
• The same numbers are entered twice: in a spreadsheet, then in the accounting system.
• You can't tell who approved a request, or when, without searching through messages.
• Every new hire needs weeks to learn where things are kept.

Client portals

Clients sign in to submit a request, follow its status, upload documents and download invoices and contracts. They suit service and consulting firms, contracting and maintenance companies, property management offices and any business that hears "where is my order?" too often.

Staff and internal operations portals

Leave, purchase and custody requests, approval paths between managers and finance, and field-team tasks with photos and locations. The value is a clear record of who asked, who approved and when.

Supplier and partner portals

Suppliers see purchase orders, confirm delivery dates and upload invoices, so there are fewer calls and messages, and fewer quantity mistakes.

Admin dashboards and reporting

One screen that turns daily data into the numbers you manage by: open and late orders, sales and team performance. In the Al Hamdan Delivery System we built, an admin dashboard works alongside a customer app and a driver app on Android and iOS, keeping operations in one place. For Al Hamdan we also built Hoopoe Paints & Hardware, an online platform for browsing and ordering products. You can see our work on the portfolio page.

How does a web app or portal project run?

A good project doesn't start with code. It starts by mapping the current process as it really runs, then choosing the part worth automating first. Our web app and portal development service works in four stages:

1. Discovery workshop: we map your current workflow, document roles and permissions, and decide what to automate first.
2. Prototype: a clickable prototype you approve before any code is written. It is the cheapest moment to change your mind. Our UI/UX guide for Arabic apps shows how to test one.
3. Phased development: short releases you review and test as we go, instead of one big hand-over at the end.
4. Launch and training: data migration from the old spreadsheets, team training and post-launch support.

Tip: start with one painful, repetitive process, such as tracking client requests, and launch it as version one. How your team actually uses it will tell you more about phase two than any planning meeting.

What should you prepare for the discovery workshop?

• The spreadsheets, paper forms and message threads you use today.
• A list of roles: who enters data, who approves and who only views.
• The reports management needs each week or month.
• The current systems you must connect to, with links to their documentation.

Which integrations does a web system usually need?

A system is worth far more when it talks to the tools you already use instead of becoming one more island. Most connections run through APIs, and the effort depends on how well the other side is documented.

If your system will issue tax invoices, read our guide to ZATCA e-invoicing Phase 2 first, to see who must integrate and when.

Which security basics should no portal skip?

A portal opens your data to people outside your office, so security is part of the design, not an add-on. The OWASP Top 10:2025, the global reference list of the most critical web application risks, ranks broken access control first: a user seeing data that isn't theirs, or changing what they shouldn't.

• Check permissions on the server: hiding a button isn't enough. Every request is checked against its user before it runs.
• Two-factor login for admins: admin accounts are the most valuable target.
• Encryption: encrypted connections always, and encryption for sensitive stored data.
• Tested backups: a backup you have never restored is not a backup.
• Audit logs: who signed in, who changed what and when, so you can trace any dispute or incident.
• Updated libraries: the same list ranks software supply chain failures third, so an outdated library is an open door.
• Safe error messages: never show users details of your server or database.

What does the PDPL say about security?

The PDPL Implementing Regulations require controllers to apply the National Cybersecurity Authority's controls, or recognised cybersecurity best practice where they are not bound by NCA controls (Article 23). Article 24 requires notifying the regulator within 72 hours of becoming aware of a breach that may harm personal data or the people it belongs to. The texts are published in the knowledge centre of SDAIA's National Data Governance Platform.

In draft amendments open for consultation until 5 November 2026, SDAIA proposes notification of any breach within 72 hours, without a harm assessment, and storing personal data inside the Kingdom, according to Clyde & Co's summary. These are proposals, not adopted rules, but audit logs and an incident-response plan make them far easier to meet.

Where is the data stored, and who owns the system after hand-over?

We recommend hosting web systems inside the Kingdom, with encryption, backups and restricted access, and we set up and monitor the infrastructure. Cloud accounts and the domain stay in your company's name. To compare hosting options, see our guide to web hosting in Saudi Arabia.

The contract sets out who owns the source code. In our custom projects, code ownership passes to you after final payment, unless agreed otherwise. Ask for this in writing in any quote you receive, together with technical documentation that lets another team carry on.

How much does a web app or portal cost?

Manzomia's web app and portal development starts from SAR 34,900, one-time, before 15% VAT. That is SAR 40,135 with VAT. After the discovery workshop, your written quote fixes the first version's scope, price and timeline.

From there, the price moves with the number of roles and approval paths, the number of integrations and the quality of their documentation, how much data must move from old systems, the reports you need, and the languages. Payments follow delivery milestones: 30% to start, 40% at the mid-point and 30% on delivery.

When don't you need a custom system at all?

If a ready-made tool covers your process with small adjustments, start with it. A custom system earns its cost when the process itself sets you apart from competitors, or when off-the-shelf tools force you to work their way instead of yours. If you need one system across several departments, or a product you will sell on subscription, our custom SaaS and ERP systems service may fit better.

Ready to turn your process into a web system?

Manzomia is a foreign-owned, MISA-licensed company in Riyadh. Our founder has more than nine years of building web and mobile products, and apps he launched reached more than 50 million users. We also run our own cloud system, Manzomia, at manzomia.com.

Book a free 30-minute consultation and tell us which process you want to automate, or request a written quote. We will propose a clear first-version scope with price and timeline.