Services · Mobile app development · Document management apps

Document management software shaped around Saudi records, Arabic files and national rules.

Codeeo designs and builds custom document management systems for Saudi organisations that have outgrown shared drives, paper registries and email attachments. Our document management software development Saudi Arabia clients rely on covers Arabic first search, version control, approval routing, retention rules and audit trails, hosted inside the Kingdom when your policy requires it. Every contract, invoice, permit and personnel file gets one owner, one current version and a clear record of who opened, changed or approved it.

For groups operating in several regions, one platform can serve every branch under a single permission model. Our team of 80+ works from Dubai, Riyadh and Karachi, and has delivered 200+ projects across the UAE and the US.

Built for
Saudi companies, semi-government bodies and multi-branch groups that need controlled, auditable document handling across the Kingdom.
Typical timeline
Set after discovery, once document volumes, integrations and migration scope are known, and written into the plan before design begins.
What you own
Source code, database, file storage and administrator accounts, all held in your own cloud tenancy or data centre.
Rated
4.7 / 5 from 23 Google reviews

200+ companies servedFrom a first store to an ADX listed developer

Modon
Majid Al Futtaim
HP
Belkin
Dulsco Group
OneClickDrive
Hanayen
HMS
Clocksprings
Ghezlan

What the platform covers

The controls Saudi organisations ask for first.

Document rules in the Kingdom come from several national bodies at once. The Personal Data Protection Law, supervised by SDAIA, governs how personal records are collected, kept and shared. The National Cybersecurity Authority sets the Essential Cybersecurity Controls that many entities must meet, and the National Data Management Office publishes data classification standards that government bodies and their suppliers follow. ZATCA requires e-invoices issued through Fatoora to be stored and retrievable. NCAR, the national records authority, supervises how government records are classified, kept and destroyed. A useful system turns these obligations into everyday behaviour: a classification label chosen at upload, a retention clock that starts automatically, an access log nobody can edit. The modules below are the ones Saudi clients most often place in a first release, and the order reflects how they usually depend on each other.

Explain your project
  • Classification at the point of upload

    Each file is tagged with a sensitivity level that mirrors the national classification tiers, from public through restricted to secret. The label controls who can view, download, print or share it, and changing a label is itself logged, so classification decisions can be reviewed during an internal or external audit. Before the first release, we also review which departments create the most files and which teams search for them most often, because that tells us where adoption will succeed or stall.

    Sensitive files are protected by default rather than by memory.

  • Personal data register

    Records holding personal data are flagged, linked to a lawful purpose and grouped by data subject. When an employee or customer asks to see, correct or remove their information, staff can find every related file in one search and respond within the deadlines your privacy officer sets. Where staff are unsure whether a file falls under these rules, a short guided question at upload helps them choose correctly.

    PDPL requests are answered from facts, not guesswork.

  • Arabic OCR and bilingual search

    Scanned letters, contracts and certificates are converted to searchable text in Arabic and English. Search handles different spellings of the same name, diacritics and mixed language documents, and results respect the user's permissions so nobody discovers a file they should not open.

    Old paper archives become findable in seconds.

  • E-invoice archive for Fatoora

    Invoices generated by your ERP or billing system are stored with their XML, QR data and PDF copy, linked to the customer, contract and payment. Finance can retrieve any invoice by number, buyer VAT number or date when ZATCA or an auditor asks for it.

    Tax records stay complete and easy to produce.

  • Nafath sign-in and approvals

    Where your organisation is approved to integrate with Nafath, users can sign in and confirm approvals with their national digital identity. For internal staff we also support Microsoft Entra ID or your existing single sign-on, with step-up confirmation for high-risk actions such as deleting or releasing restricted files. Approval delegations for leave periods are recorded too, so a signature by a deputy is traceable to the person who granted the authority.

    Approvals carry a verified identity behind them.

  • Hijri and Gregorian retention schedules

    Retention periods can be calculated in either calendar, matching how your policies and contracts are written. When a period ends, the system proposes destruction or transfer, routes it for approval and keeps a certificate of what was removed, by whom and under which rule.

    Nothing is kept forever by accident, or destroyed early.

  • Outgoing and incoming correspondence registry

    Many Saudi organisations still number every official letter in a sadir and warid register. We digitise that register: each letter receives its reference, is linked to the related file, and is routed to the responsible department with a due date and a reminder before it lapses. Department heads see their open items on one screen and can reassign letters when a colleague is away.

    Official correspondence never sits unanswered in an inbox.

  • Branch and regional permissions

    A group with offices in the Central, Western and Eastern regions can share one platform while each branch sees only its own workspace. Head office receives consolidated reporting, and cross-branch sharing requires an explicit grant that expires when the task is complete.

    One system across the Kingdom without one big open folder.

  • In-Kingdom hosting and recovery

    We deploy to the cloud region or local data centre your policy names, with encrypted storage, tested backups and a documented recovery procedure. Hosting choices are made with your security team against the NCA controls that apply to you, not decided by our default.

    Data residency and recovery are settled before go-live.

  • Mobile capture for field and branch staff

    A companion app for iOS and Android lets staff photograph a signed delivery note, a site permit or an identity copy, crop and enhance it, choose the category and submit it straight into the correct workspace. Files are never stored in the phone gallery, and uploads queue safely when coverage drops on the road between cities.

    Paper captured where it is signed, not weeks later at head office.

Who this is for

Four situations that bring Saudi organisations to us.

Document management projects in the Kingdom rarely start from a blank page. There is usually a legacy archive, a set of national obligations and a growing organisation that has stopped finding things. Some clients arrive after a failed audit, others after a key employee left and nobody could locate the signed originals. The starting point decides what goes into the first release, so we treat each of these situations differently and say plainly when a smaller fix would serve you better than a new platform.

01

A group with branches in several regions

Head office in one city, operations in two or three others, and every branch keeping files its own way. We design a shared structure for folders, metadata and naming, then let each branch work inside it. Consolidated search and reporting give management a single view, while branch managers keep control of their own staff access. Training is run branch by branch so local habits are respected.

Agreeing the shared structure early saves months of clean-up later.

02

A supplier to government entities

Companies that hold government data under contract are often asked to show how they classify, protect and eventually return or destroy it. We build the classification, access logging and disposal certificates that let you answer those questions with evidence rather than a policy document nobody follows.

03

A business preparing for PDPL scrutiny

HR files, customer records and identity copies tend to sit in many places. We map where personal data lives, move it into controlled workspaces, link each record to its purpose and give your privacy officer tools to handle access and deletion requests. The result is a system that supports your compliance work, not a promise of compliance on its own. We also review where identity copies are stored and reduce the number of people who can open them.

Your legal adviser still owns the interpretation of the law.

04

An organisation replacing an ageing DMS

Older packaged systems often handle Arabic poorly, cannot connect to newer platforms and are expensive to extend. We plan a migration that carries over files, versions and audit history, run the old and new systems in parallel for a period you choose, and retire the old one only after the data has been checked. Users keep working throughout, and the cut-over date is chosen around your busy periods rather than ours.

Six stages from scattered files to one controlled system.

  1. 01Records inventoryWe list where documents live today, who creates them, which ones carry personal or classified data, and which national or contractual rules apply to each group of records.
  2. 02Classification and retention designYour categories, sensitivity levels and retention periods are written into a schedule that the software will enforce, reviewed with your legal and compliance owners before build.
  3. 03Architecture and hostingStorage, search, identity and integrations are chosen together, with the hosting location and NCA control mapping agreed with your security team.
  4. 04Build in short releasesUpload, search and permissions come first, followed by workflows, correspondence and retention, each shown to your users before the next part starts.
  5. 05Migration and verificationLegacy files are moved in batches with checksums, metadata mapping and spot checks, so you can prove nothing was lost or altered on the way in.
  6. 06Regional rollout and supportBranches go live one at a time with training in Arabic and English, then usage data and support tickets guide the next round of improvements.

Technology

What we build this with.

We choose the stack to suit your hosting rules and your in-house skills: typically a web application with mobile access, object storage with encryption, a search engine tuned for Arabic, and connectors to Microsoft 365, ERP and HR systems.

01Mobile

  • Swift
  • Kotlin
  • Flutter
  • React Native

02Data and cloud

  • PostgreSQL
  • MySQL
  • MongoDB
  • AWS
  • Azure
  • Docker

03Marketing and tracking

  • GA4
  • Google Tag Manager
  • Search Console
  • Meta Pixel
  • Looker Studio

Questions Saudi organisations ask before building a document system.

Storage, search, permissions, workflows and retention, built around Saudi rules.

A typical first release covers secure upload with classification, Arabic and English search, version control, role based access, approval workflows and an audit log. Retention schedules, a correspondence registry, e-invoice archiving and integrations with ERP or HR systems are added according to priority. We agree the order in discovery so the first version solves the problem that hurts most.

Tell us what the business needs. We will tell you what to build first.

Schedule a free consultation and get a written recommendation, with costs, before you commit to anything.

Get in touch

PROVEN RESULTS

4.7 / 5from 23 Google reviews