Your customers moved online. Your website hasn’t caught up.
Websites and web apps for Saudi businesses: Arabic first, built to follow the Kingdom's data protection law (PDPL), and secured by a team that breaks into systems for a living. Riyadh and Jeddah, across the Kingdom.
Built for Saudi Arabia
In Saudi Arabia, your website is where personal details come in: every form, checkout and login collects the names, phone numbers and national IDs that the Personal Data Protection Law (PDPL), issued under Royal Decree M/19 (2021, amended 2023), exists to protect. With Vision 2030 pushing everyday payments onto digital rails, a Saudi website is no longer a brochure: it is a system holding real people's data. IKZERO builds that in from the first line of code: permission asked properly, only the data you genuinely need, and security designed in rather than added the week before launch.
The Kingdom's Data Law (PDPL), Built In
- Built to Royal Decree M/19 and the SDAIA regulator's rules
- Permission that is clear, recorded, and easy to take back
- Only collect what you need, with a lawful reason for it
- Privacy notices, and a way to handle people's requests
Arabic-First & Bilingual
- Arabic right-to-left layouts built from scratch, not retrofitted
- Arabic and English content planned in from the start
- Correct fonts, numerals, and date formats
- Copy written by people who know the market, not machine-translated
Kingdom Hosting & Data Residency
- Hosting inside the Kingdom, or nearby in the region
- Safeguards when data leaves the Kingdom, built to SDAIA's transfer regulation
- Quick to load in Riyadh, Jeddah and Dammam
- Data encrypted on the move and in storage (in transit and at rest)
Local Payments & Commerce
- mada, the national card scheme run under SAMA
- Apple Pay, STC Pay, Visa and Mastercard
- Buy now, pay later with Tabby and Tamara
- Prices and invoices in Saudi riyals (SAR)
What We Build
Websites
- Built on Next.js, with a simple screen for editing your own content
- Loads fast on a phone: Core Web Vitals above 90, the speed score Google measures
- Findable on Google, and usable by people with disabilities (SEO and WCAG 2.1 AA)
- You can see what visitors do, and test what works better
Web Apps and Portals
- Software your customers log into and pay for
- Dashboards and portals for staff or customers
- Sign-in, with each person seeing only what their job allows
- Locked-down connections to your other systems
Online Shops
- A shop built to load fast and be easy to buy from
- Card payments handled to the PCI DSS card-industry rules
- Every page tuned for speed, because slow pages lose sales
- A checkout that makes life hard for card fraudsters
Security Built In
- Covered against the ten most common web attacks (the OWASP Top 10)
- Servers set up tight from day one
- The outside code we use is checked for known holes
- We try to break in ourselves before you go live
How We Engage
Discover
We agree the goals, the audience and the must-haves, and how someone might attack it.
Design
We make it look right, feel quick, and work properly on a phone.
Build
We build it with the security checks running on every change.
Launch
We try to break in, fix what we find, put it live, and keep watching.
We use AI to move faster on the build and the words. Then we attack the result the same way we would attack any client's site, so what we hand over has already survived us.
Human-led, AI-accelerated: every finding is validated by a certified expert.Frequently Asked Questions
How do you build for Saudi Arabia's PDPL?
If your site collects personal data from people in Saudi Arabia (names, phone numbers, national IDs, emails or card details), we build it around the Personal Data Protection Law (PDPL), issued under Royal Decree M/19 (2021, amended 2023) and overseen by SDAIA. Permission, privacy notices and careful data handling go into the site from the start, so they are structural rather than an afterthought.
How does consent and cookie handling work under the PDPL?
For Saudi sites we ask for clear, explicit permission before collecting or using personal data: permission tied to one stated purpose, recorded, and as easy to take back as it was to give. In practice that means a proper consent banner for optional cookies and analytics, separate tick-boxes on forms, and collecting only the data you genuinely need. All of it is built to what the PDPL asks for, and is off until the visitor agrees.
Can my site store or transfer data outside Saudi Arabia?
It can. We offer hosting inside the Kingdom and in the wider region, and we design your data flows around SDAIA's Regulation on Personal Data Transfer Outside the Kingdom: the safeguards it names, such as standard contractual clauses or binding common rules, a clear lawful basis, and the risk assessment it calls for in the cases it lists.
Does my website have to be in Arabic?
Arabic is the official language of the Kingdom and what people expect from customer-facing and government-adjacent services, so we build Arabic first with proper right-to-left layouts and, where it helps, an Arabic and English structure. On accessibility, we build to line up with the Digital Government Authority's (DGA) web accessibility guidance and WCAG AA: the same bar whether the work is public sector or private.
Which payment methods should a Saudi e-commerce site support, and can you price in SAR?
For the Saudi market we recommend mada, the national card scheme supervised by the Saudi Central Bank (SAMA) through Saudi Payments, alongside Apple Pay, STC Pay, Visa and Mastercard, and buy-now-pay-later options like Tabby and Tamara. Prices, checkout and invoices are all handled in Saudi riyals (SAR). We work with businesses in Riyadh, Jeddah, Dammam and across the Kingdom.
Ready to build a secure, PDPL-ready website in Saudi Arabia?
Tell us about your project. We will plan an Arabic-first, mada-ready site or web app, built secure and in line with SDAIA's PDPL rules from day one, for businesses in Riyadh, Jeddah, Dammam and across the Kingdom.
Get My Website Quote