Evaluate a website vendor on eight criteria: security posture, data-protection terms, defined SLAs, delivery method, commercial transparency, company standing, ownership terms and exit terms — each evidenced in writing, scored identically for every bidder. A portfolio and a sales call cannot answer the questions your security reviewer and procurement policy will ask.
The short answer: the evaluation scorecard in brief (8 criteria)
One, security: access control, patching, backups and incident handling, answered specifically. Two, data protection: PDPL roles and processor terms settled before signing. Three, service levels: uptime, response and resolution defined with measurement and remedies. Four, delivery: a named method, staging, approvals and testing evidence. Five, commercials: itemised pricing with no undefined extras. Six, standing: a valid UAE trade licence, local invoicing and contactable references. Seven, ownership: domain, code, content and data transfer to you. Eight, exit: handover duties and assistance if you leave.
Why enterprise buying is different: what SME advice leaves out
Small businesses buy a website on portfolio and price. Larger firms cannot. A website vendor may host customer data and hold administrator access to a revenue channel — so the purchase runs through security review, legal and procurement, not just marketing.
SME agency-choice guides, including our guide to choosing a web design agency in Dubai, stop at design quality and price. They never ask who can access production or where backups live. Regulated firms face an additional layer: ADGM's FSRA has implemented cyber risk management amendments, with compliance required from 31 January 2026, under which regulated firms remain responsible for the cyber risk their third-party IT service providers introduce.
The security review: questions a website vendor should be able to answer
Ask in writing, and score specificity. Who holds administrator, hosting and DNS access, and is multi-factor authentication enforced on every account? How are the CMS, plugins and server patched, and how quickly are critical updates applied? Where are backups kept, how often do they run, and when was a restore last tested? If credentials leak or the site is defaced, who is notified, how fast, and what is the vendor's part in your incident process? Which subcontractors touch the site, and under what controls?
Strong answers name tools, frequencies and people. Weak answers offer assurances: "security is our priority" is not a control. Buyers ask whether a vendor holds ISO/IEC 27001 certification; a yes with a certificate is easy to score — but treat it as one input beside the operational answers, never a substitute for them, and never let a vendor imply a certification it has not shown you.
Data protection in the UAE: PDPL and data-processor terms to settle up front
A website collects personal data by default: enquiry forms, analytics, chat transcripts, customer accounts. Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), your firm will usually be the controller — the party that decides why and how data is processed — and the website vendor a processor acting on your instructions. The law expects controllers to appoint processors that provide sufficient guarantees of appropriate technical and organisational measures, and the processing terms should set out the scope, subject matter, purpose and nature of the processing, the types of personal data and the categories of people it concerns.
Settle these before signing: where the site and its backups are hosted, and whether data leaves the UAE; which vendor staff and subprocessors can access personal data; how the vendor supports access, correction and deletion requests; how quickly it must tell you about a personal-data breach; and what happens to the data at exit — the processor should delete or return it when processing ends. Put the answers in the contract or a data-processing addendum, and have counsel confirm the wording.
SLAs that mean something: uptime, response, resolution — defined, not promised
Most website SLAs fail on definitions, not intentions. Uptime needs a measurement source, a window and exclusions: 99.9% measured by an independent monitor over a calendar month, excluding agreed maintenance, is a commitment; "high availability" is a slogan. Response needs severity levels: who replies, within what time, for a site-down incident versus a content typo. Resolution — or a workaround — needs its own clock per severity, because a fast reply that leads nowhere is worse than a slower fix.
Add the remedies: service credits or fee reductions when targets are missed, a monthly report against the targets, and a termination right for repeated failure. Ask every bidder for these terms in writing. A vendor that publishes fixed terms elsewhere — WebStackRank, for example, publishes fixed starter prices and a fixed-price structure — should put support commitments in a schedule too. If a term is not written, score it as absent.
Procurement mechanics: RFP scoring, POs, payment terms and approvals
Run the paperwork as deliberately as the security review. Issue the same questions to every bidder — our web development RFP template supplies the document — and fix the scoring weights before proposals arrive, so the evaluation cannot drift toward the best presenter. Require a UAE trade licence, local invoicing that matches your purchase-order process, and a total price broken into comparable items. Commercial anchors are easy to check when a vendor publishes them: WebStackRank's published model, for instance, is starter packages at AED 990, AED 2,490 and AED 4,990 with 50% deposit to begin and 50% at launch, listed on its pricing page.
Agree the approval chain: who signs off designs, who accepts milestones, and what counts as acceptance for payment. Large firms lose more time to undefined acceptance than to development. Record change control — how a change is priced and approved before work starts.
Ownership, access and exit: the terms to lock before you sign
Ownership terms decide how painful a future change of vendor will be, so lock them at the start. The contract should state that the domain is registered to your firm, that administrator access to hosting, CMS and analytics belongs to you, and that intellectual property in the site, code and content transfers to you on final payment. WebStackRank's published terms transfer full ownership — IP, code and domain — on final payment; require the equivalent from any vendor.
Exit terms go further: handover of files, credentials, documentation and data exports in usable formats, a defined assistance period, and deletion of your data from vendor systems. Our website handover and ownership checklist lists the artefacts to request at transition.
The scorecard: a weighted evaluation table you can reuse
Score each criterion 0–5 per vendor, multiply by the weight, and require written evidence for high scores.
| Criterion | Weight | Evidence to require |
|---|---|---|
| Security posture | 20% | Written answers on access, patching, backups, incidents |
| Data protection (PDPL) | 15% | Processor terms, hosting locations, subprocessor list |
| SLA definitions | 15% | Uptime measure, severity clocks, credits, reporting |
| Delivery method | 10% | Process, staging, testing and approval evidence |
| Commercial transparency | 15% | Itemised price, change control, payment terms |
| Company standing | 10% | Trade licence, local invoicing, contactable references |
| Ownership terms | 10% | Domain, access and IP transfer wording |
| Exit and handover | 5% | Handover duties, assistance period, data deletion |
Set a minimum score for security and data protection regardless of the total: a cheap vendor that fails either one is not a bargain to accept.
Red flags in enterprise vendor selection
- Security questions answered with slogans instead of named controls, tools or frequencies.
- Refusal to sign data-processor terms, or no clear answer on where data is hosted.
- An SLA with percentages but no measurement method, severity levels or remedies.
- The domain registered in the vendor's name, or administrator access withheld from you.
- No UAE trade licence, no local invoicing, or references you are not allowed to contact.
- Pressure to skip procurement steps "to save time".
Common mistakes
The first is scoring the presentation instead of the evidence: the best meeting rarely predicts the best vendor. The second is asking security questions after commercial selection, when switching is impossible. The third is accepting SLA percentages without definitions, then discovering during an outage that nothing enforceable was agreed. Firms forget the exit on day one, and weight price so heavily that the scorecard ratifies the cheapest bid.
FAQ
What should a website vendor security questionnaire cover?
Access control and multi-factor authentication, patching and update practice, backup location and tested restores, incident notification duties, subcontractor use, and any certifications held. Ask for written, specific answers — named tools, frequencies and responsibilities — and score vague assurances as missing controls.
What SLA terms should an enterprise website contract define?
A measurable uptime commitment with its monitoring source and exclusions, response times by severity, resolution or workaround times by severity, remedies such as service credits, regular performance reporting, and a termination right for repeated failure. If a term is not defined in writing, treat it as not offered.
What PDPL questions should we ask a website vendor?
Ask where the site and backups are hosted, whether personal data leaves the UAE, which staff and subprocessors can access it, how the vendor supports access and deletion requests, how fast it reports a breach, and how data is returned or deleted at exit. Record the answers in the contract or a data-processing addendum.
Should we require ISO 27001 from a website vendor?
It is a reasonable criterion to ask about, and a certificate is easy to verify, but it should sit beside operational answers about access, patching and backups rather than replace them. Never accept an implied certification: if a vendor does not show a certificate, score the criterion as unmet.
What exit and handover terms should be agreed before signing?
Handover of files, credentials, documentation and data exports in usable formats, a defined assistance period, transfer of the domain and administrator access, and deletion of your data from the vendor's systems afterwards. Agreeing these at the start makes any later transition routine instead of adversarial.
Run your evaluation with a vendor who answers in writing (CTA)
Bring us your scorecard. WebStackRank will answer your security, data and commercial questions in writing against the same criteria you apply to every bidder: our published terms already state fixed starter prices, 50% deposit to begin and 50% at launch, an itemised proposal within 24 business hours, and full ownership transfer on final payment. Start through our web development consulting service and attach your criteria.
