Reach users inside the apps they already open daily

People use the term super-app for two quite different projects. The first is building a mini program that runs inside a host app someone else operates. You follow that platform's framework, design guidelines and review rules, and you get access to its users, login and often its payment. The effort is smaller, closer to a focused web-style app than a full mobile build, and a first mini program often takes 6 to 12 weeks.

The second is building the host itself: the container app, the mini program runtime, the developer portal and the governance layer. This is a platform project. It suits a bank, a telecom, a retail group or a government-linked entity that wants a single front door for many services. Expect 20 to 36 weeks for a first working platform with a handful of internal mini programs.

We help you decide which job you actually have. Many companies ask for the second when the first would reach customers sooner and at a fraction of the cost.

A host app that runs other people's code must isolate it. Each mini program should run in a restricted runtime with declared permissions, controlled access to user data, and no ability to read another mini program's storage. Every call to a sensitive API, such as location, contacts or payment, passes through the host and is logged. This is what lets you open the platform to partners without handing them the keys.

Payments are the center of most super-apps. Settlement, refunds, splits between your company and partners, and reconciliation reports all need to be designed up front. Card flows should go through a gateway that supports mada. If the platform holds customer balances or moves money between parties, check the model against the requirements of the Saudi Central Bank (SAMA) before you build, since licensing questions can change the architecture.

User data crossing between mini programs raises Personal Data Protection Law (PDPL) questions about consent and purpose. We design consent screens per mini program and keep a log of what each one was allowed to read, in line with guidance from SDAIA.

A platform handling identity and payments should be hosted in-Kingdom where your sector expects it. We can deploy on a Saudi cloud region, aligned with the cloud rules of the Communications, Space and Technology Commission (CST) and the cybersecurity controls of the National Cybersecurity Authority (NCA ECC) where they apply to you.

Arabic is a first-class requirement. The container, the developer tools and the templates give every mini program right-to-left layouts, Arabic numerals and bilingual strings by default, so a partner does not have to solve it again.

Governance matters as much as code. You need a review process for new mini programs, a way to suspend one instantly, version rollback, and clear ownership of support tickets. We build those controls into the platform and document the process, so the ecosystem stays under your control as it grows. You own the platform source code and the developer documentation on delivery.