The Question Behind the Question
When a Saudi company asks whether its ERP should run in the cloud or on its own servers, the question usually hides three others. How much will each option really cost over five years? Which option keeps us compliant with Saudi rules on data, cybersecurity and e-invoicing? And who will keep the system running at 2 a.m. on the last day of the quarter when something breaks?
A decade ago the answer often defaulted to on-premise, because cloud hosting inside the Kingdom was limited and regulators had not yet set clear rules. That has changed. The cloud computing regulatory framework now classifies data and sets hosting expectations, the National Cybersecurity Authority has issued dedicated cloud controls, the Personal Data Protection Law is fully enforced, and major providers have opened local regions (Google Cloud, for example, opened its Dammam region in November 2023). Phase 2 e-invoicing also connects every invoicing system directly to ZATCA, which changes how much integration work an in-house environment must carry.
This guide explains why so many Saudi companies are moving from on-premise to cloud ERP, walks through a transparent cost comparison you can adapt to your own figures, sets out the regulatory points that actually decide the matter, and describes the cases where keeping servers in-house still makes sense.
Definitions First
The labels are used loosely, so it helps to be precise:
- On-premise: you buy licences, install the software on servers you own or rent in your own data room, and your team or a contractor runs backups, patches, upgrades and security.
- Hosted (private cloud): the same licensed software runs on servers in a data centre, often dedicated to you, but you still own the upgrade and configuration decisions.
- SaaS cloud ERP: you subscribe to the system. The vendor runs the infrastructure, applies updates and handles backups, and you access it through a browser or mobile app.
Most of the debate in the Saudi mid-market is between the first and the third. Hosted private cloud sits in the middle and is common in larger groups that want control over upgrade timing.
Why Saudi Companies Are Switching
Hardware and people costs keep rising
An on-premise ERP needs servers, storage, networking, power protection, cooling, backup hardware and a second site or arrangement for disaster recovery. Each of these has a replacement cycle. More importantly, it needs people who know how to run them, and experienced infrastructure and database administrators are in high demand. For a company with 50 to 200 users, carrying that expertise in-house is expensive relative to the system it supports.
Government integrations multiply
An ERP in the Kingdom no longer lives alone. It connects to ZATCA for e-invoicing, to banks for salary transfer files, and, depending on the company, to platforms such as Mudad, Muqeem or Qiwa. Phase 2 e-invoicing requires each invoice-generating unit to be onboarded with its own cryptographic stamp identifier and to send standard invoices for real-time clearance. When ZATCA updates specifications, a SaaS vendor applies the change once for all customers; an on-premise customer must schedule, test and deploy it locally.
Branches and remote access
Companies with branches in Riyadh, Jeddah and Dammam, or with sales teams in the field, need secure access from anywhere. On-premise systems can do this, but they require VPNs, firewall rules and careful hardening. Cloud ERP is built for browser and mobile access from the start.
Upgrades stop being projects
Many on-premise systems fall several versions behind because each upgrade is a project with its own budget, testing and downtime. Over time, the company runs software that no longer receives security patches. SaaS updates arrive continuously, so the system stays current without a separate upgrade budget.
A Transparent Five-Year Cost Comparison
Published TCO figures vary widely and are often produced by vendors. The fairer approach is to build your own. The table below is a hypothetical model for a company with 60 users, using round numbers to show the structure. Replace every line with your own quotes.
| Cost line (5 years, SAR) | On-premise | SaaS cloud |
|---|---|---|
| Software licences (one-time) plus annual maintenance | 420,000 | 0 |
| Subscription | 0 | 540,000 |
| Servers, storage, network, UPS (with one refresh) | 260,000 | 0 |
| Database and operating system licences, backup software | 90,000 | Included |
| Disaster recovery arrangement | 120,000 | Included |
| Infrastructure staff or managed service (share of time) | 450,000 | 60,000 |
| Power, cooling, space | 60,000 | 0 |
| Implementation and data migration | 200,000 | 160,000 |
| Version upgrade project (once in 5 years) | 120,000 | Included |
| Total | 1,720,000 | 760,000 |
In this illustration the cloud option costs less than half, mainly because staff, hardware and recovery costs disappear. But notice how sensitive the result is. If your company already employs a strong IT team that would stay regardless, the staff line for on-premise shrinks. If you plan to grow from 60 to 200 users, a per-user subscription grows with you, which is why pricing models matter. Some vendors, Tranquil among them, offer a per-module fee with unlimited users for larger companies, which changes the arithmetic for fast-growing firms. See our full guide to total cost of ownership for the method.
Costs people forget
- Internet resilience: cloud ERP depends on connectivity, so budget for a second line at key sites.
- Exit costs: confirm in the contract that you can export your data in a usable format if you leave.
- Customisation: heavy custom code on-premise becomes a cost at every upgrade; in SaaS it must be done through supported extensions and APIs.
- Training: required either way, and usually underestimated.
Five Criteria That Decide the Matter
1. Data classification and residency
Saudi Arabia's Cloud Computing Regulatory Framework, issued by the regulator now known as the Communications, Space and Technology Commission, distinguishes government data from non-government data and classifies government data by sensitivity. Government data may not be hosted or processed outside the Kingdom. For private companies, the main constraints come from the Personal Data Protection Law: transfers of personal data outside the Kingdom are allowed only under conditions, such as adequacy decisions or appropriate safeguards, and some transfers need a risk assessment. Sector regulators may add rules of their own, for example for financial institutions supervised by SAMA.
The practical step is to ask any cloud vendor exactly where your production data, backups and support access sit. In-Kingdom hosting simplifies most of these questions.
2. Cybersecurity obligations
The National Cybersecurity Authority's Essential Cybersecurity Controls apply to government entities, their companies and private organisations that operate critical national infrastructure. The NCA has also issued Cloud Cybersecurity Controls (CCC-2:2024) for cloud providers and cloud customers in scope. If your company falls within these frameworks, your ERP choice must support the required controls, and a provider that already aligns its service with them saves a great deal of work. If you are outside scope, the controls are still a useful benchmark.
Security is not automatically better in either model. A well-run on-premise environment can be very secure; a poorly configured cloud account can be very exposed. What changes is who carries each task. In SaaS, the vendor handles infrastructure patching, encryption at rest and physical security; you remain responsible for user access, passwords, approvals and segregation of duties. Our article on ERP cybersecurity and PDPL lists the controls in detail.
3. Scalability
Adding a branch, a company or 40 seasonal users is a configuration change in cloud ERP. On-premise, it may mean more server capacity, more licences and network work at the new site. For businesses with seasonal peaks, such as retail around Ramadan or contractors during project starts, this flexibility has real value.
4. Business continuity
Two measures matter: how much data you can afford to lose (recovery point objective) and how long you can be down (recovery time objective). On-premise, these depend on your backup routine and whether you have a tested secondary site. Many companies have nightly backups but have never practised a full restore. With SaaS, ask for the vendor's stated objectives, how backups are stored and how often recovery is tested, and make sure the answers are written into the service agreement.
5. Control and customisation
On-premise gives full control over timing: you decide when to upgrade and can modify code. That is a genuine advantage for companies with unusual processes. SaaS trades some of that control for continuous updates. A good cloud ERP compensates with configurable screens, reports, approval workflows and APIs, so you adapt the system without forking its code.
When On-Premise Still Makes Sense
- Classified or highly sensitive data where a regulator or contract requires infrastructure under your direct control.
- Sites with poor connectivity, such as remote industrial or mining locations, where the ERP must keep working offline.
- Deep integration with shop-floor systems that need very low latency on a local network.
- Heavy, unique customisation that would be impractical to rebuild through extensions.
- Recent large investment in hardware and licences that still has years of useful life.
Even then, a hybrid model is common: core finance and HR in the cloud, with a local system for the plant floor that synchronises with it. Our article on hybrid ERP covers that design.
How to Migrate Without Disrupting the Business
- Inventory what you have: modules, users, custom reports, integrations and the data volume in each area.
- Decide what to bring: open balances and master data always; detailed history only as far back as you need operationally. The Commercial Books Law requires records to be retained for ten years and VAT rules require at least six years for most records, so archive older history in a readable form even if it does not move to the new system.
- Clean before you move: duplicate customers, inactive items and wrong account mappings migrate just as easily as good data.
- Plan the e-invoicing cut-over: onboard the new invoicing units with ZATCA, test in the simulation environment, and choose a clean switch date so invoice counters and hash chains start correctly.
- Run a parallel period: one month of parallel processing for key outputs such as trial balance, payroll and VAT return catches mapping errors before go-live.
- Train by role: accountants, storekeepers and approvers need different sessions.
Our detailed guide to cloud ERP migration in Saudi Arabia expands each step.
Questions to Ask Any Cloud ERP Vendor
- Where are production data and backups hosted, and who can access them from outside the Kingdom?
- Which ZATCA phases does the system support, and how are specification changes delivered?
- What are the stated availability, recovery point and recovery time commitments?
- How are user roles, approvals and audit logs configured?
- Can we export all our data in standard formats at any time?
- What does pricing look like when we double our users or add a company?
- What training and post-go-live support is included?
A Quick Decision Matrix
Score each factor for your own company. If most answers fall in the cloud column, the burden of proof sits with on-premise, and vice versa.
| Factor | Points toward cloud | Points toward on-premise |
|---|---|---|
| IT team | Small or none | Experienced team already in place |
| Growth | New branches or users expected | Stable size for years |
| Data | Commercial and personal data, in-Kingdom hosting available | Classified data or contractual control requirements |
| Connectivity | Reliable internet at all sites | Remote sites that must work offline |
| Processes | Standard, adaptable through configuration | Highly unique, heavily customised |
| Existing assets | Servers due for replacement | Recent hardware with years of life left |
Where Tranquil Fits
Tranquil is a cloud ERP built for Saudi companies, covering financial accounting, ZATCA e-invoicing with Phase 1 and Phase 2 compliance and real-time integration, inventory, sales, purchasing, HR, payroll, projects, contracting, asset and property management, and POS. Pricing is per user for small firms, or a flat fee per module with unlimited users for companies of 50 users or more, and the team provides customisation of screens, reports, approvals and API integrations along with certified training. See pricing or the accounting and finance solution for details.
Frequently Asked Questions
Is cloud ERP allowed for private companies in Saudi Arabia?
Yes. Private companies can use cloud ERP, subject to the Personal Data Protection Law's conditions on transferring personal data abroad and any sector-specific rules. Government data has stricter rules and may not leave the Kingdom.
Is cloud ERP cheaper than on-premise?
Often, over five years, because hardware, infrastructure staff and disaster recovery costs largely disappear. But the result depends on your user count, growth plans and existing IT team, so build the comparison with your own quotes.
Is my data safer on my own servers?
Not automatically. Security depends on how well the environment is run. In SaaS the vendor handles infrastructure security, while you stay responsible for user access and internal controls.
How long does migration from on-premise to cloud take?
For a mid-sized company it is typically measured in weeks to a few months, depending on modules, data quality and integrations. Data cleansing and e-invoicing onboarding are usually the steps that set the pace.
Can cloud ERP work with ZATCA Phase 2?
Yes, provided the system supports onboarding, clearance of standard invoices and reporting of simplified invoices. Tranquil supports Phase 1 and Phase 2 with real-time ZATCA integration. Contact the Tranquil team to plan your move.