What to ask before buying business software in Saudi Arabia

What exactly is in the scope, in writing?

A demo shows the best path through a product. A scope shows what you are actually buying. Ask for a written list of modules, the number and type of users, integrations, data migration, training, and the languages in which screens and documents are delivered.

Then ask what is excluded. Exclusions explain most of the gap between two proposals that look alike. Common ones are data migration, integration with an existing accounting system, custom reports and training for branch staff.

• Modules and users: which modules, for how many users, in which roles.
• Data you bring across: what is migrated, from which systems, and who cleans it.
• Integrations: every system the software must exchange data with, named.
• Documents: which invoices, statements and letters it produces, and in which languages.
• Not included: a written list, not a verbal assurance.

Where will our data live, and who can reach it?

Location and access are two separate questions. Location is the country and the facility: a data centre in the Kingdom, servers in your own office, or a global cloud region. Access is who at the vendor and who at your company can open the data, and what is logged when they do.

The Personal Data Protection Law (PDPL) restricts how personal data is collected, stored and transferred outside the Kingdom, and some sectors add rules of their own. You do not need to become a lawyer, but the vendor must state where your deployment runs and write it into the agreement. The guide on hosting in the Kingdom or on your own servers explains how to decide.

Ask which country and facility hold the data, whether it shares a database with other customers or runs as your own deployment, who at the vendor holds administrator access and how that access is removed when someone leaves, and what is recorded in the audit trail.

Does it work in Arabic and with e-invoicing in the product itself?

"Supports Arabic" can mean anything from a translated menu to right-to-left screens, Arabic search and bilingual documents. Ask to see a sales invoice, a statement and a purchase order issued in Arabic, and to search for a name using a different spelling of the same letters. The guide on Arabic-first software lists what to test.

For e-invoicing, ask which ZATCA requirements the product is built to work with, which stages are covered, and what is in your scope. A general claim of compliance with no written scope is a statement, not a fact. ZATCA publishes its requirements and applies them in stages, so the answer should name what applies to your company.

Can we take our data out, and in what form?

Software gets replaced, and suppliers change. Ask what a full export looks like: which formats, whether attachments, history and the audit trail are included, whether it is part of the standard product or a paid extra, and how long you keep access after the agreement ends.

A practical test: ask for an export of a sample dataset during the evaluation and open it in a spreadsheet. If it is unreadable there, it will be unreadable later.

Who supports it after go-live, and how?

Support is a service with named channels, hours and response targets, not a feeling. Ask for them in writing: how problems are reported, in which languages, on which days (most Saudi companies work Sunday to Thursday), and who fixes a defect versus who explains a feature.

• Is support run by the team that built the system, or by a separate reseller?
• How are updates delivered, and can you postpone one?
• What happens to a critical fault outside working hours?
• What does support cover, and what is charged separately?

What does the price depend on, and what changes it?

Business software is rarely a single number. Ask for the price drivers as a list: users, modules, hosting, data migration, integrations, training and support level. Then ask what happens to the price when each one changes, so you know the cost of adding a branch or more users before you need to.

An itemised proposal makes two vendors comparable; a single total does not. The guide on how a fixed-scope proposal works shows how to line two of them up.

How will we know it works before we pay for the next stage?

Ask for milestones that each end in something you can test with your own data, and for acceptance criteria written before the work starts. "The system is delivered" is not a test. "Your finance team posts last month's invoices and the totals match your ledger" is.

Warning signs worth noting

• A price with no written scope behind it.
• A demo that never shows a document of yours.
• "Unlimited" anything: users, storage, support.
• No named person or channel for support.
• Hosting described only as "the cloud".
• No answer on how you would leave.