Skip to content
Shahid Malla

Trusted by businesses in Saudi Arabia

Trusted Remote AI and Web Developer for Saudi Arabia

I am Shahid Malla, a remote developer in India who builds AI agents, WhatsApp and website chatbots, web apps, CRMs and WHMCS systems for businesses in Saudi Arabia. India is 2.5 hours ahead of Riyadh, so we share most of the working day. I build in English, supply the treaty paperwork your accountant asks for, and quote a fixed price or $55-$65 per hour.

Free scoping call of about 30 minutes · written quote within one business day · two weeks of support after delivery

By Shahid Malla, AI agent and AI chat developer, full-stack developer · Updated

Why Saudi businesses trust me: proof you can check

Before you send a purchase order abroad, check the record. Each figure opens the public profile or portfolio behind it, with reviews written by clients who paid for the work.

Verify me on: LinkedIn · GitHub · Fiverr · Upwork · Google Business Profile

What can a Saudi business hire me to build?

Customer-facing AI first: WhatsApp is how many Saudi customers reach a business, so most projects start with a chatbot or agent on it.

WorkA typical Saudi projectDetails
WhatsApp AI chatbotsA number that answers product, booking and order questions in English, books or quotes, and passes the conversation to staffWhatsApp AI chatbot development
AI agentsAn agent that reads incoming requests, checks your CRM or ERP and drafts the reply or task for a person to approveAI agent development
Web apps and CRMA customer portal, booking system or sales CRM, hosted in the Kingdom if neededCRM development
WHMCSmada and STC Pay gateways, .sa domain fields and a link to a ZATCA e-invoicing providerHire a WHMCS developer

How much of the Saudi working day do we share?

Almost all of it from Monday to Thursday. Saudi Arabia is on UTC+3 and India on UTC+5:30, neither changes its clocks, so the gap is always 2 hours 30 minutes.

Riyadh, Jeddah or DammamIndiaShared?
SundaySunday, my day offMessages answered Monday morning unless agreed otherwise
Monday to Thursday, 9:00-17:0011:30-19:30Yes, in full
FridayWorking dayYour weekend; I work on tasks that need no answer from you

How is my invoice taxed in Saudi Arabia?

Two taxes can touch a payment from a Saudi company to me: VAT under the reverse charge, and withholding tax. The points below summarize ZATCA's own publications; your accountant applies them.

  • VAT, 15%. A VAT-registered Saudi buyer accounts for it under the reverse charge. My invoice carries none.
  • Withholding tax, domestic rule. ZATCA's rate table lists 5% on technical and consulting services to a non-resident, wherever performed, and 15% on royalties. Whether custom development counts as a service or a royalty depends on the contract's IP terms; my standard terms assign the custom code to you, rather than licensing it.
  • The India-Saudi treaty. The treaty has no article on fees for technical services, and ZATCA's January 2025 circular on treaty relief reads the business-profits article as taxing services performed remotely, without a permanent establishment in the Kingdom, only in the provider's country. Royalties under the treaty are capped at 10%.
  • The paperwork. Relief needs my tax residency certificate from India and ZATCA's treaty form, authenticated or apostilled, plus an undertaking signed by you. It is claimed at source or by refund after withholding.

So my quote for a Saudi client always states whether the price is gross or net of withholding tax, and I start the residency certificate early because it takes time to issue.

What does the PDPL mean for a chatbot or CRM built from India?

The Personal Data Protection Law applies to processing of data about people in the Kingdom even when it happens abroad, so it covers me working on your system. It took effect on 14 September 2023 and has been fully enforceable since 14 September 2024. In practice:

  • The system collects only what the task needs, and an agent keeps personal data out of AI prompts unless the answer depends on it.
  • Data sits in a Saudi region when your rules require it, and I work on it remotely rather than copying it out.
  • I sign a processing agreement with the transfer safeguards SDAIA's transfer regulation names, such as standard contractual clauses, when data does leave the Kingdom.

Watch one change. SDAIA opened a consultation, running from 6 October to 5 November 2026, on draft amendments that would require controllers to store personal data inside the Kingdom. It is a draft, not law, but a build planned now should be able to move into a Saudi region without rework, and mine are.

No binding AI law applies yet. SDAIA's AI Ethics Principles of 2023 and its generative AI guidelines of January 2024 set expectations: tell users they are talking to an AI, keep a person accountable, and log decisions. My chatbots do all three by default.

Can WHMCS meet ZATCA's e-invoicing waves?

Not by itself, but it can be connected. ZATCA's Wave 25, announced on 24 July 2026, covers taxpayers whose VAT-taxable revenue passed SAR 187,500 in any year from 2022 to 2025, who must integrate with the Fatoora platform by 1 February 2027. Later waves are announced at least six months ahead. Every visible field on the invoice must be in Arabic, with other languages allowed beside it, so a hosting company on WHMCS needs an approved e-invoicing solution that produces the compliant invoice. I connect WHMCS to that provider's API as a custom module; the provider generates the Arabic invoice, and I do not design Arabic layouts.

Which gateways and domains work for Saudi customers?

Local gateways, because Stripe does not serve businesses based in Saudi Arabia.

GatewayNotes
MoyasarSaudi company with a SAMA payments license; mada, cards and Apple Pay
HyperPay, TapServe the Kingdom; no WHMCS module on their own sites, so a custom gateway module is needed
PayTabsWHMCS plugin; mada, STC Pay and Apple Pay
TabbyBuy now, pay later, licensed by SAMA

Saudi domains are limited to applicants tied to the Kingdom, and .com.sa needs a commercial registration or a locally registered trade name or trademark, so a WHMCS store selling them needs extra order fields.

What Saudi experience can you check?

I was Technical Lead at Fada.cloud, a cloud provider serving Jordan and Saudi Arabia, working on billing, workload isolation and operations tools. That role has ended. I now have clients in Saudi Arabia who are not named here. My multi-tenant product ElyAgents, with WhatsApp, payment and lead integrations, is in the portfolio. For the UAE, my UAE page covers its rules, and Qatar is on my Gulf page.

When should you hire someone else?

  • You need an Arabic or right-to-left website or app interface.
  • A tender requires a locally registered company, in-Kingdom staff or local content quotas.
  • Your NCA classification requires all work to be done inside the Kingdom.
  • You need a large team at once. I am one developer.

Disclosure: I am CTO at ElySpace, a freelance developer for Marmaids LLC, and founder of WHMCSPilot and MagizAI, and I was Technical Lead at Fada.cloud. Tax, e-invoicing, privacy and payment points summarize ZATCA, SDAIA, the India-Saudi tax treaty, Meta, the cloud providers and the gateway vendors, plus law-firm summaries of the SDAIA consultation, as read on 31 October 2026. They are not legal or tax advice.

Who this is for

  • Saudi companies that want a WhatsApp or website AI chatbot answering customers in English and handing off to staff
  • Businesses that need an AI agent or CRM working with the systems they already run
  • Saudi hosting companies on WHMCS that need mada, STC Pay and ZATCA e-invoicing connected
  • Startups that need a web app or SaaS product built and handed over with the code in their name

What is included

  • A free scoping call of about 30 minutes in your working day, then a written scope and fixed quote within one business day
  • A quote that states whether the price is gross or net of Saudi withholding tax
  • My Indian tax residency certificate for the treaty claim, when your accountant asks for it
  • Hosting in a Saudi cloud region when your data has to stay in the Kingdom
  • WhatsApp, Meta billing, model and cloud accounts opened in your company's name
  • Code in your repository, deployment notes and two weeks of support after delivery

How the work runs

  1. 1

    Scoping call

    About 30 minutes on the problem, the systems involved, where data must stay and how the invoice will be taxed. A written scope and fixed quote follow within one business day.

  2. 2

    Quote and tax paperwork

    The quote lists scope, price, payment stages and code ownership, and says whether it is gross or net of withholding tax. I send the treaty documents your accountant needs.

  3. 3

    Build on staging

    I build on a staging copy, review every change myself and send a written update each working day. We talk live in the hours our days overlap.

  4. 4

    Pilot

    A few staff use the chatbot, agent or system on real cases first, and we adjust answers and hand-off points before customers see it.

  5. 5

    Launch and handover

    Production launch, the repository, notes and a walkthrough call, then two weeks of support.

Frequently asked questions

Do you work Sunday to Thursday?

I work Monday to Friday, so we share Monday to Thursday in full. For Sunday, the quote says how messages are handled, usually a reply by the start of Monday. I do not schedule a production release on a day your team is off, and during Ramadan we move the call slot to fit shorter working hours.

Does Saudi withholding tax apply to your invoice?

ZATCA's domestic rate is 5% on technical and consulting services paid to a non-resident, even when the work is done abroad. The India-Saudi tax treaty has no technical-services article, and ZATCA's own circular reads the business-profits article as taxing remote services only where the provider lives. Treaty relief needs paperwork, which I supply; your accountant decides.

Can you build our site in Arabic?

No. I build English websites, web apps and chatbots, and I do not design or build Arabic or right-to-left interfaces. If your customers need Arabic, a local agency is the better choice for the front end, and I can still build the API, agent or billing system behind it.

Which payment gateway should a Saudi business use?

Not Stripe, which does not serve Saudi-based businesses. Moyasar, HyperPay, Tap and PayTabs all serve the Kingdom and take mada, Apple Pay and, with some, STC Pay. PayTabs offers a WHMCS plugin; the others need a third-party or custom module. I pick with you based on fees and the methods your customers use.

What does a WhatsApp chatbot cost per message in Saudi Arabia?

Meta's 1 October 2026 rate card charges $0.0107 per service reply or utility message to a +966 number after 1,000 free service messages a month per number, and $0.0576 per marketing message. So 10,000 replies a month cost about $96 in Meta fees, before the AI model. Meta has offered billing in Saudi riyals since April 2026.

Can our data stay in Saudi Arabia?

Yes. Google Cloud runs a region in Dammam and Oracle runs regions in Jeddah and Riyadh. Microsoft and AWS had announced Saudi regions for late 2026 that were not yet open on 31 October 2026. I set the database, files and backups in the region you choose and work on them remotely.

Related services