Saudi Arabia · Global delivery09:00–15:30 ASTSAR or USD
Engineering for Saudi companies.
Saudi digital investment is running well ahead of local engineering supply, and regulatory expectations have tightened at the same rate. Both facts favour a supplier that can keep data in the Kingdom, contract under PDPL, and share six and a half hours of your working day.
Working with Saudi Arabia
Hours, money,
and paperwork.
The three things that decide whether a cross-border engagement works. Everything here is specific to Saudi Arabia.
Time overlap
09:00–15:30 AST
Arabia Standard Time is two and a half hours behind IST. Your 09:00 is our 11:30, and our day closes at your 15:30, which gives six and a half hours of shared working day with the last part of your afternoon outside it. That is enough for same-day iteration. Because we work Monday to Friday and much of the Kingdom works Sunday to Thursday, the engagement fixes which days carry the shared window and which run asynchronously, so a Sunday deadline is never a surprise.
Currency and tax
SAR or USD
Quoted and invoiced in riyals or US dollars. Services exported from India carry no tax at source, so the invoice shows the fee alone. As a non-resident supplier we do not charge Saudi VAT; you account for it under the reverse charge where applicable. Withholding tax may also apply, so its rate and treatment are confirmed in the agreement before the first invoice.
Data protection
- Governing law
- Personal Data Protection Law (PDPL) and its implementing regulations
- Authority
- Saudi Data and AI Authority (SDAIA)
- Our role
- Processor, on your instructions
Named sub-processors, written consent before any addition.
PDPL sets a default expectation of in-Kingdom processing for personal data, with transfers permitted only on defined grounds. We treat residency as an architectural constraint from the first phase, contract as processor on your instructions, and name every sub-processor. Where a sector regulator imposes additional requirements, such as SAMA for financial services or NCA for cybersecurity controls, those are scoped explicitly before build.
City by city
Local hours and
local rules.
The shared working window in local time, and any rule that applies in a city on top of the national ones.
Riyadh
Saudi Arabia
09:00–15:30 AST
Arabia Standard Time
Government bodies and operators of critical national infrastructure also apply the NCA's Essential Cybersecurity Controls to their suppliers.
Jeddah
Saudi Arabia
09:00–15:30 AST
Arabia Standard Time
National rules apply, with no city-specific additions.
Dammam
Saudi Arabia
09:00–15:30 AST
Arabia Standard Time
NCA controls apply where the client operates critical national infrastructure, which is common in the Eastern Province's energy sector.
What your procurement will ask
Answered
before you ask.
The questions procurement teams in Saudi Arabia typically ask, with our answers. Where we do not hold something, the answer says so.
In-Kingdom data residency
Supported and designed for. Cloud regions inside the Kingdom are available, and residency is written into the agreement. Where personal data cannot leave, the architecture reflects that from the diagnose phase, including where build and test environments sit.
NCA Essential Cybersecurity Controls alignment
Our ISO 27001:2022 information security management system maps substantially onto the ECC control families, and we provide that mapping as a document. We do not claim NCA compliance, which is a determination for your own assessor.
Local presence and Saudization
We have no local presence and make no contribution to Saudization targets. For work requiring an in-Kingdom supplier or a Saudization contribution, we can work as a subcontracted engineering capability behind a local prime, or we decline.
Arabic-first product work
Right-to-left interfaces, Arabic typography and bilingual data models are engineered properly. Arabic content authorship is commissioned from a specialist named in the engagement.
Certificate numbers, accreditation status and the verification route are published on our trust page. Check them without asking us.
Work we take on in Saudi Arabia
Common problems
we build for.
Common work for teams in Saudi Arabia. If one of these is yours, send us a brief.
Vision 2030 programme delivery
Platform work inside larger transformation programmes, where the constraint is engineering capacity against a fixed political timeline and an audit expectation.
Logistics and industrial operations
Freight, warehousing and plant-floor visibility, where the data exists but no system reads it. We are building our own logistics platform, AxleOne, so the domain is familiar.
Data platforms and applied AI
Consolidating fragmented operational data into something a decision can be made from, with in-Kingdom residency and traceable model outputs.
Why we suit teams in Saudi Arabia
- In-Kingdom residency treated as an architectural constraint from the first phase, including where build and test environments sit.
- ISO 27001:2022 mapped to NCA Essential Cybersecurity Controls, supplied as a document for your assessor.
- Six and a half hours of shared working day, which matters more than it sounds on a programme with weekly political reporting.
We have no in-Kingdom entity, no local office and no contribution to Saudization targets. For prime contracts that require any of those, we can only take part as a subcontracted engineering capability. We do not claim NCA or SAMA compliance; we supply control mappings and your assessor decides.
Saudi Arabia · Questions
Asked from
Saudi Arabia.
General questions about pricing, process, IP and security are answered on the FAQ page.
- Can you keep our data inside Saudi Arabia?
- Yes, we can keep your data inside Saudi Arabia, and we plan for it from the start of the engagement. Cloud regions inside the Kingdom are available, residency is written into the agreement, and the architecture reflects the constraint from the diagnose phase, including where build and test environments sit. Transfers outside the Kingdom happen only on grounds permitted by PDPL and agreed in writing.
- Are you compliant with NCA Essential Cybersecurity Controls?
- We do not claim NCA compliance, because that determination belongs to your own assessor or a licensed consultancy. We hold ISO 27001:2022, which maps substantially onto the ECC control families, and we supply that mapping as a document for the assessment.
- Do you have a presence in the Kingdom?
- No, we have no presence in the Kingdom. We are an Indian LLP with no in-Kingdom entity, office or Saudization contribution. For prime contracts requiring a local supplier, we can work as a subcontracted engineering capability behind a local prime. Where that structure is not possible, we decline the work.
Other markets
Where else
we work.
Working hours, currency and data protection, covered for every market we serve.
Working with Saudi Arabia.
Contracted in SAR or USD, governed by Personal Data Protection Law (PDPL) and its implementing regulations, delivered inside the 09:00–15:30 AST overlap window.
Cognimit Technologies LLP · Monday to Friday, 10:00–18:00 IST · IST (UTC+5:30)