BUILT FOR THE GCC

Run your business by talking to it.

Invoices, expenses, payroll — handled. Wafy is the AI assistant for small businesses that does the data entry, keeps you compliant, and tells you what to do next, so you can spend your time on the business instead of the paperwork.

No credit card required · Bilingual English & العربية · Designed for your phone

Saudi-readyZATCA Phase 2Bilingual EN / ARMobile-first

WHY WAFY

Stay compliant without hiring a compliance team

Tax and labour rules across the GCC keep changing. Most accounting apps treat the local rules as an afterthought. Wafy treats them as the default. The AI handles the data entry, runs the numbers, and flags anything that needs your attention — so you can focus on running the business.

Built for small teams

No 30-tab spreadsheets. No six-month rollout. Sign up, answer a few questions, and send your first invoice today.

AI does the boring parts

Drop a supplier PDF or paste a customer email. Wafy reads it, fills in the right fields, and queues a clean record for you to approve.

English, Arabic, mobile-first

Every screen works in English and Arabic with proper right-to-left layout. Designed for your phone, not just your laptop.

WHAT DO YOU WANT TO DO?

One place for everything that runs your business

Wafy is not a sales tool with bolted-on accounting, or accounting with bolted-on payroll. Every part shares the same customers, numbers, and permissions — so nothing falls between the cracks.

Send invoices and get paid

ZATCA ready

Create invoices in seconds, send them to customers, and track who has paid. The Saudi tax authority gets a properly signed copy automatically.

Track money in and out

Record what you owe to suppliers, what customers owe you, and what you have actually paid. Wafy keeps a clean set of books in the background.

Manage customers and deals

Keep all your customers, conversations, and open deals in one place. Drag deals through your pipeline and never lose a lead.

Quote, confirm, invoice

Send price offers, lock in terms before delivery, and turn the accepted ones into proper invoices — without retyping anything.

Close the month with confidence

Invoices, expenses, payroll, and bank activity flow into one tidy ledger. When the month ends you see a checklist of what is left to do.

File your VAT return

KSA + UAE

Wafy assembles your VAT return from the numbers it already has. You review, finalise, file on the portal, and record the reference — done.

Match your bank statement

Upload your bank statement and Wafy suggests which transactions match which invoices, bills, or payments. You confirm, it reconciles.

Send customer statements

Generate a clean account statement for any customer — opening balance, what happened in the period, what is still owed, and how old it is.

Hand off to your accountant

One click bundles your VAT report, supplier balances, bank reconciliation, and ledger exports into a tidy pack your accountant can review.

Hire and pay your team

Employee records, attendance, leave, and a directory — all in one place and ready for Saudi labour rules from day one.

Run payroll the Saudi way

Saudi labour law

Monthly payroll that already knows about GOSI, end-of-service, and the deductions Saudi employers have to handle. Calculates, posts, links to the bank payment.

Reports that fit your job

Different roles see different reports. Owners see the business, accountants see the books, HR sees the team — nobody sees what they should not.

Get set up in an afternoon

A guided walkthrough captures your company details, sets up your accounts, invites your team, and ships you straight to your first invoice.

Settings that stay out of your way

Tell Wafy your country, currency, modules, and who is allowed to do what. After that, settings stay out of your way.

Behind the scenes (for us)

A super-admin view we use to monitor the service, integration events, webhooks, and background jobs. We keep Wafy reliable for you.

COMPLIANCE, HONESTLY

Built for the GCC tax landscape

We do not exaggerate. Here is what Wafy actually does today, what is in flight, and what is not in scope.

Saudi Arabia

Live

ZATCA Phase 2 standard + simplified e-invoicing
Hash chain + signed XML + invoice counter (ICV)
Customer VAT 15-digit format validation
GOSI 9.75% / 11.75% with SAR 45k cap
EOSI calculator (Articles 84 + 85)
VAT return draft per ZATCA box layout
Live submission with simulation default

United Arab Emirates

Active for invoicing & VAT prep

TRN-aware customer and vendor validation
AED currency default for UAE tenants
FTA VAT201-aligned box mapping in returns
Reverse-charge, zero-rated, and exempt categories
Manual portal reference recording for filing

GCC e-invoicing

Roadmap

Bahrain (BH) — config-only, not yet live
Oman (OM) — config-only, not yet live
Qatar (QA) — config-only, not yet live
Kuwait (KW) — config-only, not yet live
UAE FTA Accredited Service Provider — planned

What Wafy does NOT do

Honest

We do not file VAT returns directly with FTA or ZATCA
Filing is manual — Wafy generates packs and stores your portal reference
ZATCA live mode requires real PCSID + sandbox certification
Other GCC countries are config-only until those tax authorities publish stable APIs

AI THAT EARNS ITS KEEP

AI agents wired into the workflow, not bolted on

Wafy's AI is built into the AP flow, the CRM, and the dashboard. It reads documents, drafts outreach, qualifies leads, and explains your numbers — always with a human approval step before anything ships.

AI Inbox

Inbound documents — vendor PDFs, customer emails, expense receipts — land in the inbox. Wafy extracts structured data, scores confidence, and presents a clean draft for one-click approval.

Document extraction with bounded JSON output
Confidence thresholds gate auto-acceptance
Provider-agnostic via Vercel AI Gateway

Agent Console

Five focused agents — qualification, lead research, outreach copy, reporting, dispatch — each with a constrained scope, schema, and audit trail.

Per-agent policy controls
Tenant-scoped run history
Cost and latency tracked per dispatch

Wafy Chat

A floating assistant that knows your tenant data. Ask it 'what is overdue?' or 'how is pipeline this month?' — it routes to the right report and explains the answer.

Role-aware — never leaks data outside the user's permissions
Tools, not just text — can navigate, link, and trigger actions
Disabled per-tenant if AI features are not enabled

FOR YOUR TEAM

Five roles, designed for how SMEs actually divide work

Role-based access control is not a checkbox. Every API endpoint, every database query, every UI screen respects the role boundary. Tested with 60+ enforcement specs.

Owner

Run the business

Full reach: dashboards, finance, HR, sales, settings, audits. Owners can promote admins and set tenant-wide compliance regime.

All modules
Promote ADMIN role
Set country / regime / readiness
Lock and unlock fiscal periods

Admin

Operate the platform

Same operational reach as Owner, scoped under the Owner's direction. Manages users, certificates, integrations, and tenant settings.

User management
ZATCA cert upload + EGS units
Module enablement
Period close + lock

Accountant

Close the books

Bookkeeping-focused: vendors, bills, payments, bank rec, VAT, period close, journals, reports — but no HR PII or payroll runs.

Finance + bookkeeping
VAT returns + period close
Bank reconciliation + matching
Read-only dashboards
Blocked: attendance, employees, payroll runs

HR Manager

Manage the team

Employees, attendance, leave policies and balances, HR reports. Cannot see invoicing, finance, or sales.

Employees + team directory
Attendance + leave policies
Leave approvals (optimistic locking)
HR reports
Blocked: invoices, finance, payroll runs

Employee

Do the work

Personal home (My Work), invoices they created, leave requests, deals they own. Strict tenant + creator isolation everywhere.

My Work dashboard
Their own invoices only (created_by guard)
Their own deals
Submit leave requests
Clock in / out

SECURITY & DATA SAFETY

Built like the regulator is watching

GCC data residency. Tenant isolation enforced at every layer. Audit-driven hardening across migrations, routers, jobs, and services.

Tenant isolation, schema-deep

Every business table has tenant_id NOT NULL. Every UPDATE / DELETE includes tenant_id in WHERE. Schema-level CHECK constraints reject malformed status enums.

JWT with app_metadata roles

Roles live in app_metadata (admin-only writable), never user_metadata. JWT validated on every protected endpoint and middleware request.

AES-256-GCM for secrets

ZATCA private keys, binary security tokens, and CSID secrets are encrypted with HKDF-derived keys + authenticated GCM. Never returned to non-admins.

Aggressive observability redaction

Every payload going into the admin observability ledger is redacted for cookies, Bearer tokens, signed XML, PEM blocks, and 12+ secret-key patterns.

Period locks, race-safe

Overpayment guards run inside SELECT FOR UPDATE transactions. Period close re-validates blockers before flipping the period. No phantom unbalanced journals.

Status integrity, even on failure

ZATCA acceptance is persisted before artifact uploads. A storage outage never flips a cleared invoice to failed — the regulator's record stays the source of truth.

PRICING

Free while we are in early access

We are onboarding founding tenants across the GCC. No credit card. Real ZATCA submissions in simulation mode. When we turn on paid plans, founding tenants keep a permanent discount.

Claim a founding tenant slot Talk to founder

COMMON QUESTIONS

Frequently asked

Do I need an accountant to use Wafy?

No. Wafy is designed so the owner can run the day-to-day on their own — sending invoices, recording expenses, paying staff. Most founders bring in an accountant once a month or once a quarter to review the books. Wafy gives them a one-click pack with everything they need.

Will Wafy file my tax return for me?

Not yet. Wafy calculates your VAT return and locks the numbers in a snapshot. You file on the tax authority portal yourself and then paste the reference back into Wafy. We will switch to auto-filing once Saudi and UAE publish stable APIs we'd trust to use.

Is Wafy connected to the Saudi tax authority?

Yes. Wafy signs your invoices and can submit them live to the Saudi tax authority. While you are getting comfortable, Wafy stays in test mode by default — real submission is one switch away.

Can I use Wafy if my business is outside Saudi Arabia?

UAE — yes, today. Bahrain, Oman, Qatar, and Kuwait — soon. We built Wafy so the data model knows about all six GCC countries, but we wait for each country's tax authority to publish stable rules before we turn live submission on.

Is my data safe?

Yes. Your data is fully separated from every other business on Wafy — at the database, in every query, and at every API. Sensitive details like tax certificates are encrypted. We test all of this before every release and run security audits regularly.

What happens to my data if I want to leave?

You own your data. You can export everything — invoices, expenses, payroll, bank activity, the whole accounting ledger — as CSV files that open in Excel or Google Sheets. The accountant pack is a one-click bundle of all of it. Ask us and we can also hand you a direct database export.

Do I have to use the AI? What if I just want to type things in myself?

The AI is optional. Every screen works the same way without it — manual invoices, manual expenses, manual reconciliation. Turn the AI on when you want a helper, turn it off when you don't. Your choice, per business.

Does Wafy work in Arabic?

Yes. Every screen works in English and Arabic, with proper right-to-left layout, the right Arabic font, and notifications that read in the correct direction.

Can I run my business from my phone?

Yes. Every screen is built for the phone first. Owners send invoices, approve expenses, and check the dashboard from anywhere. A native mobile app is on the way; the web app is already fully usable today.

READY WHEN YOU ARE