Web Development Company in Riyadh

Cost is a function of the build itself: a bilingual Arabic and English marketing site for a Riyadh business, or a PIF mega-project portal or a major retail e-commerce build. Scope drivers include Next.js build with i18n RTL and LTR, Sanity or Strapi CMS, AWS me-central-2 Dammam hosting, PDPL data-flow documentation, and WCAG 2.1 AA accessibility testing. Riyadh rates sit below Dubai for equivalent scope because we deliver from Edmonton and Chandigarh on AST hours with the same procurement-grade documentation.

Arabic-first means we design wireframes with RTL flow first, write Najdi Arabic copy in the native register (not Egyptian or Levantine, which feel wrong in Riyadh), and let English locale parity follow rather than lead. Tailwind is configured with logical CSS properties (margin-inline-start, padding-inline-end, inset-inline-start) so the same component renders correctly in both directions without forked styles. Iconography is reviewed for direction (arrows, progress indicators, chevrons), font stacks pair Noto Sans Arabic or IBM Plex Sans Arabic with Inter, and Hijri-Gregorian dual calendars are surfaced wherever culturally expected (event dates, government correspondence). Translation-first sites read as foreign in Riyadh; we have rebuilt several from competitors who shipped that way.

The Personal Data Protection Law (PDPL) became fully effective September 2024 with SDAIA as enforcement authority. Saudi residents have rights of access, rectification, erasure, portability, and objection. Cross-border transfer requires legitimate grounds (consent, contract, or SDAIA approval). Every site we ship in Riyadh includes a PDPL-aligned consent banner (granular by purpose, never dark-patterned), a privacy notice in Arabic and English aligned with NDMO four-tier classification, and a data-subject rights workflow wired into the contact form or admin panel. Personal data lands inside AWS me-central-2 Dammam or me-south-1 Bahrain by default, and we document the data flow in a Record of Processing Activities (ROPA) suitable for SDAIA inspection.

Absher is the Ministry of Interior identity portal used by every adult resident of Saudi Arabia; Tawakkalna is the NIC platform now handling health and event credentials; Nusuk is the Ministry of Hajj pilgrimage portal. Direct integration is restricted to government-authorised partners, but the UX patterns those apps set (National ID lookup with Iqama support for residents, OTP via STC, Mobily, Zain KSA SMS gateways, biometric fallback for high-value transactions) are the patterns Saudi users now expect everywhere. We replicate the authentication ergonomics with our own identity flow using AWS Cognito or Auth0 inside me-central-2, deferring to Absher only where the client is in scope for direct integration through MCIT or SDAIA partner channels.

Yes. NEOM, Red Sea Global, Diriyah Gate Development Authority, ROSHN, Qiddiya, and AlUla Royal Commission portals share a common pattern: bilingual immersive marketing, investor relations subsites, sustainability disclosures (Saudi Green Initiative aligned), media room with high-res asset distribution, careers portal integrated with Workday or SAP SuccessFactors, and a stakeholder gate for institutional partners. We have shipped against this pattern with full Arabic-first RTL, English locale parity, Sanity CMS for bilingual editorial workflow, AWS me-central-2 Dammam hosting with CloudFront edge, Core Web Vitals green on Saudi mobile networks, and the SDAIA accessibility evidence procurement teams require.

AWS me-central-2 (Dammam, GA 2024) is the primary on-soil Saudi region and the default for PDPL-sensitive workloads. AWS me-south-1 (Bahrain, GA 2019) is the established GCC region and acceptable for CITC CCRF tier 1 and tier 2 workloads where on-soil is preferred but not mandatory. Microsoft Azure Saudi Arabia regions are in progress and Google Cloud Dammam has been announced; we will rebuild residency targets when those reach GA. For NDMO confidential or secret tier workloads, sovereign Saudi data centres (Mobily Bayanat, STC Center3, NourNet) provide the regulated tier we deploy into. Encryption uses AWS KMS customer-managed keys, with the option to bring-your-own-key for SAMA-supervised financial services.

STC, Mobily, and Zain KSA cover the Kingdom with strong 5G in Riyadh, Jeddah, Dammam, Mecca, and Medina, but 4G is still the realistic baseline outside major cities and inside large compounds. Our performance budget targets a mid-range Galaxy A series device on a 4G connection, not a Riyadh corporate fibre line: Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200ms, Cumulative Layout Shift under 0.1, total JavaScript payload under 200KB on first paint. CloudFront edge in Riyadh and Jeddah handles static delivery. Arabic webfonts subset to Saudi-relevant glyph ranges, and we serve AVIF and WebP images with width-based responsive sources. We test on real STC and Mobily SIMs, not Lighthouse synthetic only.

Yes. SDAIA and the Digital Government Authority cite WCAG 2.1 AA as the alignment target for Saudi public-sector and PIF subsidiary web work. Every Riyadh build leaves with an automated axe-core report, a manual NVDA and VoiceOver pass with Arabic screen reader testing (NVDA with Arabic locale is the practical default), keyboard navigation validation in both RTL and LTR contexts, and an Accessibility Conformance Report suitable for SDAIA inspection. WCAG 2.2 is on the roadmap; we already test against the additional AA criteria (focus appearance, dragging movements, target size) so the site stays compliant when Saudi adoption catches up to the newer revision.