Custom software development in Dubai

When building is justified, when buying is, and the decisions that separate a system you can change from one you replace.

The question that decides build or buy

Custom software is justified when the way you do something is the reason customers choose you, and no product on the market does it that way. That is a narrower condition than it sounds, and most projects that fail the test fail it obviously once it is asked plainly.

If the process is ordinary and you want it cheaper, buy software. If the process is ordinary and you want it to look like yours, buy software and configure it. If the process is genuinely yours, and bending it to fit a product would remove the thing that makes it work, that is the case for building.

There is a second legitimate case that gets less attention: integration between systems that will never be replaced. A business running an ERP, a logistics provider's API and a payment gateway often needs a layer that belongs to it rather than to any of the three. That layer is custom software, and it is usually smaller than people expect.

What custom actually means

It does not mean writing everything. A competent custom build is mostly assembled from things nobody should write again: an identity and session layer, a database, a queue, a storage service, a payment provider's SDK. The custom part is the model of your business and the rules that act on it.

That distinction matters commercially. When a proposal describes building an authentication system, a notification system and a file storage system, you are paying to rebuild solved problems, and each one is a place where a security mistake can be made that would not have been made by the service you declined to use. The questions worth asking are which parts are being bought, which are being written, and why each thing in the written column is there.

Bilingual from the schema up

In this market an application usually has to work in English and Arabic, and the expensive mistake is treating that as an interface concern. It reaches the data model. A product name, a status label, a rejection reason and an emailed receipt all exist in two languages, and a schema with one name column has already decided that they do not.

The parts that catch teams who have not done this before are rarely the layout. They are names that do not split into first and last the way a form assumes, addresses that do not match a Western shape, documents that must render correctly in both directions, and sorting that is not alphabetical in the sense the default collation means. Each is cheap to design in and expensive to add. The front end half of this is covered in our post on Arabic website development.

Personal data, and what the law currently says

Federal Decree-Law No. 45 of 2021, the Personal Data Protection Law, has been in force since 2 January 2022. Its executive regulations have still not been published, which means the detailed obligations are not yet settled. Treat any vendor who hands you a definitive compliance checklist with suspicion, and treat any vendor who tells you the law does not matter the same way.

What is sensible to build regardless, because it is good engineering and will satisfy most of whatever arrives: know what personal data the system holds and why, be able to export or delete a person's records without a developer writing a one-off script, log who accessed what, and keep a list of every third party the data reaches. Systems that can do those four things adapt to new rules. Systems that cannot get rebuilt.

If the application sells to consumers, Federal Decree-Law No. 14 of 2023 on modern technology-based trade and Federal Law No. 15 of 2020 on consumer protection both apply to what the interface must tell the customer, and tax inclusive price display is a data question before it is a display question.

The integrations specific to this market

A UAE application usually touches a short list of things that an offshore team has not met before, and each one is a scheduling risk rather than a technical one, because access takes longer than implementation.

• National digital identity through UAE PASS, where the work is onboarding and approval rather than the integration itself.
• Payment gateways, where the question that decides your architecture is not the fee but which currencies settle, how refunds behave and what happens to a payment that is authorised and never captured.
• Logistics and delivery providers, whose APIs differ in quality and whose status models rarely match each other, so a normalising layer is almost always needed.
• Government and free zone portals, where the integration is sometimes a file in a defined format rather than an API, and the format is the specification.

Get the access requests started in the first week. The most common reason a UAE build misses a date is not engineering; it is waiting for credentials that nobody applied for until the feature was ready.

How the team is shaped

A custom build of ordinary size needs fewer people than most proposals suggest, and the ones it needs are senior. The shape that works is a small number of engineers who can each take a problem from the data model to production, one person accountable for the architecture, and someone who tests adversarially rather than confirming the happy path.

Adding people to a project that is behind makes it later, which is an old observation that keeps being rediscovered at expense. The useful lever is narrowing what the first release must do, not widening the team.

We publish what engineering capacity costs by US metro, with the employment and wage figures taken from published government data rather than estimated, on our locations pages. The technology pages under hire developers cover the stacks this work is normally built on.

Scoping that produces a real estimate

An estimate is only as good as the artefacts behind it. Three of them do most of the work, and a vendor who cannot produce them has not understood the project well enough to price it.

A domain model

The nouns of your business and how they relate. Not a screen list. If two people in your company disagree about what a word means, the software will encode one of them and the argument will resurface as a bug.

The state machines

An order, an application, a request: each moves through states, and the transitions nobody writes down are where the defects live. What happens to a cancelled thing that was already paid for is a design decision, not an edge case.

The integration list, with access status

Every external system, what it is for, and whether anyone has actually applied for credentials. This column is where schedules die.

Note what is absent from that list: a feature count. Counting features produces an estimate that is precise and wrong, because the cost sits in the relationships between them.

How these projects actually fail

Rarely through a technical failure. The recurring causes are mundane and visible early if anyone is looking.

• A first release defined as everything, so nothing reaches real users for long enough that the requirements change underneath it.
• No single person empowered to decide. Committees produce software that satisfies a meeting rather than a user.
• Integrations treated as a late task, discovered to need approvals nobody started.
• No environment anyone can actually run, so the people who should be giving feedback are reviewing screenshots.
• A handover that was never specified, leaving the client with running software and no ability to change it.

The last of those deserves naming in the contract rather than hoping for. Who holds the repository, the cloud account and the domain, and what exactly is delivered at the end, are questions with better answers before a project than during a dispute.

Frequently asked questions

When is custom software actually worth building?

When the way you do something is a reason customers choose you and no product does it that way. If the process is ordinary and you want it cheaper or branded, buy and configure instead. A second real case is an integration layer between systems that will never be replaced, and that is usually smaller than people expect.

Does custom mean writing everything from scratch?

No, and a proposal that implies it is a warning. Identity, storage, queues and payment handling should be bought. The custom part is the model of your business and the rules that act on it. Ask which parts are being bought, which written, and why each written item is there.

How does Arabic affect a custom build?

It reaches the data model, not just the interface. Names, statuses, rejection reasons and emailed documents all exist in two languages, so a schema with a single name column has already made the wrong decision. Names that do not split into first and last, addresses that do not match a Western shape and sorting that is not alphabetical are the parts that catch teams new to the market.

What does the UAE data protection law require of an application?

Federal Decree-Law No. 45 of 2021 has been in force since 2 January 2022, but its executive regulations are still unpublished, so the detailed obligations are unsettled. Build so you know what personal data you hold and why, can export or delete a person's records without a one-off script, log access, and can list every third party the data reaches.

What most often delays a software project in the UAE?

Waiting for credentials. Access to national digital identity, payment gateways and government or free zone portals takes longer to obtain than to implement, and teams routinely apply only once the feature is built. Start the access requests in the first week.

What should a scoping exercise produce?

A domain model, the state machines for anything that moves through states, and an integration list with the access status of each item. Not a feature count, which gives an estimate that is precise and wrong, because the cost sits in the relationships between features.