The honest framing

A large share of firms selling software development from a Dubai address do not write the code in Dubai. The engineers sit in India, Pakistan, Egypt, Jordan or Eastern Europe. The Dubai end is a sales office, a partner's desk and a licence.

There is nothing wrong with that model. There is something wrong with hiding it.

Our own position first. Accucia Softwares Pvt. Ltd. is based in Pune, India, founded in 2018, which is eight years. We have delivered 730+ projects for 500+ clients worldwide across 25+ industry verticals. We hold no UAE trade licence, and we have no Dubai office, UAE address, TRN or local team. We are not going to imply otherwise in a proposal.

What we do have is delivery history in the region under our own name. EPIC ME Technical Works LLC in the United Arab Emirates, Triolift in Saudi Arabia and Gulf Integrated Vertical Solutions in Bahrain are all clients who have cleared us to name them.

Ask every vendor on your shortlist where the code is written before you ask anything else. The one who tells you first is usually telling you the truth about the rest.

What a UAE entity actually buys you, and what it does not

A local entity is worth having for a specific set of reasons. It is not a proxy for engineering quality or accountability.

A UAE entity gives you: eligibility for a National In-Country Value certificate, which participating government and semi-government buyers score during tender awards.

It does not give you: any guarantee that the engineers are actually based in the UAE.

A UAE entity gives you: a local invoice with a TRN and 5% VAT charged in-country, so there is no reverse-charge entry on your side.

It does not give you: a named person who answers when a release breaks.

A UAE entity gives you: a UAE bank account and simpler payment routing.

It does not give you: contracted response times you can enforce.

A UAE entity gives you: a physical address inside the jurisdiction for service of notices.

It does not give you: control over where your source code and production data sit.

A UAE entity gives you: easier onboarding on some government supplier registers.

It does not give you: assignment of intellectual property. That is a contract clause, not a licence.

The In-Country Value programme is run by the Ministry of Industry and Advanced Technology, and certified suppliers "gain advantages during the awarding of tenders and contracts based on their ICV score". If you are bidding into federal or semi-government procurement, shortlist licensed UAE suppliers. For a private company buying an ERP or a custom application, it changes very little.

The accountability structure that matters more

Five things decide whether an offshore engagement survives its second year. None of them is an address.

Named engineers. Ask for the names of the people on your account, their roles and their notice periods. A vendor who will not name them is planning to rotate them.

A contactable escalation path. One person, one mobile number, one email that reach a human during your working day, plus a second name above them. Put both in the statement of work.

Response times written in Gulf Standard Time. Not "business hours". Not "promptly". A severity one acknowledgement inside 60 minutes between 09:00 and 18:00 GST is a sentence you can hold someone to.

Where code and data physically sit. We deploy in-region on request on AWS, Azure or Google Cloud Platform, with the region chosen to meet your requirement and infrastructure billed to you at cost, or to your own on-premise servers. Whichever you choose should be written down before kickoff.

A mutual non-solicit. Ours runs 12 or 24 months, agreed per engagement, always in writing, binding both sides. A one-way clause tells you how the relationship will go.

We set out our delivery structure on our how-we-work page and the security and contract positions on our trust page.

Timezone overlap for a software development company in Dubai, in hours

Most vendors describe overlap with adjectives. Here are the numbers.

Gulf Standard Time is UTC+4. India Standard Time is UTC+5:30. The gap is 90 minutes, and India is ahead, which means your Indian team has already been working for an hour and a half when you open your laptop.

Against a UAE business day of 09:00 to 18:00 GST:

Pune, India: 1 hour 30 minutes ahead of GST. A 09:30 to 18:30 IST working day runs from 08:00 to 17:00 GST, providing 8 hours of overlap.

London, UK — summer: 3 hours behind GST. A 09:00 to 17:30 BST day runs from 12:00 to 20:30 GST, providing 6 hours of overlap.

London, UK — winter: 4 hours behind GST. A 09:00 to 17:30 GMT day runs from 13:00 to 21:30 GST, providing 5 hours of overlap.

New York, US Eastern — summer: 8 hours behind GST. A 09:00 to 17:00 EDT day runs from 17:00 to 01:00 GST, giving just 1 hour of overlap.

New York, US Eastern — winter: 9 hours behind GST. A 09:00 to 17:00 EST day runs from 18:00 to 02:00 GST, resulting in 0 hours of standard working-day overlap.

Eight hours against one hour is the whole argument. It is the difference between a same-day fix and a 24-hour ticket cycle.

Saudi Arabia and Bahrain both run Arabia Standard Time at UTC+3, so India is 2 hours 30 minutes ahead. Against an 08:00 to 17:00 AST day, a 09:30 to 18:30 IST team covers 07:00 to 16:00 AST. Eight hours again.

One caution on the working week. In January 2022 the UAE federal government moved to a four-and-a-half-day week, Monday to Thursday 07:30 to 15:30 and Friday 07:30 to 12:00, with Saturday and Sunday off. Schools followed.

The private sector was never required to change and sets its own weekend under the UAE Labour Law. Most UAE private-sector businesses now work Monday to Friday, but confirm your counterpart's actual week rather than assuming it. Do not carry that assumption into other Gulf states, which set their own working weeks. Saudi Arabia, for example, runs Sunday to Thursday.

The commercial position: withholding tax and VAT

Two questions come up in every UAE finance review of a foreign vendor, and both have short answers.

Withholding tax. Under Federal Decree-Law No. 47 of 2022, withholding tax on UAE-sourced income earned by non-residents applies at 0%, and no separate registration or filing obligation is expected while the rate stands at zero. Your payment to an offshore supplier is not clipped on the way out.

VAT. The standard rate is 5% under Federal Decree-Law No. 8 of 2017. Where a taxable person imports services for business purposes, Article 48 treats them as making a taxable supply to themselves and accounting for the tax.

In practice, a VAT-registered recipient with full input recovery reports the same amount as output and input tax, so the reverse charge is usually cash neutral. It is an entry in your return, not a cost.

Both are general positions, not advice on your facts. Have your tax adviser confirm them against your registration and free-zone status before you sign.

Data, contracts and where the code lives

The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, has been in force since January 2022.

Article 22 permits transfer of personal data outside the UAE to a state with adequate protection legislation or under a binding international agreement.

Article 23 permits transfer in the absence of adequate protection where there is a contract binding the recipient to the standards of the decree, explicit consent from the data subject, performance of a contract, judicial cooperation or public-interest grounds.

The implementing regulations have still not been issued. Enforcement has been limited and most organisations drive compliance through their own risk assessments, which is exactly why your contract has to do the work the regulations are not yet doing.

Four things belong in it:

Data Processing Agreement: A DPA naming Articles 22 and 23.

Sub-processor list: A written list of every relevant sub-processor. For us, that means AWS, Azure, Google Cloud Platform or your own on-premise servers, plus error and performance monitoring, analytics and product telemetry, and helpdesk tooling.

Source-code protection: A source-code escrow or repository-handover clause.

Exit assistance: Defined exit assistance with a clear day count and a named handover owner.

On the India side, the Digital Personal Data Protection Rules 2025 were notified on 14 November 2025 with an 18-month phased compliance timeline, so an Indian processor sits under a statutory regime of its own.

On certification we will not pretend. Accucia does not hold ISO 27001. Implementation is underway, an auditor has been appointed, and certification is targeted for Q1 2027, January to March.

We do not hold ISO 9001 either; that work is in progress. We are not CERT-In empanelled. Where an empanelled audit is required, the client commissions it, we build to the auditor's requirements and we implement every finding.

The eleven-point vendor checklist for a Gulf buyer

1. Where is the code physically written?
Wanted answer: a named city and a named team, offered before you ask twice.

2. Who are the named engineers on my account?
Wanted answer: real names, roles and notice periods, listed in the statement of work.

3. Who do I call at 16:00 GST when production is down?
Wanted answer: one person, one number, plus a second escalation name above them.

4. What are the contracted response times, in Gulf Standard Time?
Wanted answer: severity levels with clock times, not "business hours" or "promptly".

5. Where will our source code and production data sit?
Wanted answer: a named cloud region or our own servers, agreed in writing before kickoff.

6. Who are your sub-processors?
Wanted answer: a written list covering hosting, monitoring, analytics and helpdesk tooling, updated on change.

7. Will you sign a DPA referencing PDPL Articles 22 and 23?
Wanted answer: yes, with the transfer basis identified rather than left blank.

8. Which certifications do you actually hold today?
Wanted answer: certificate numbers and scope, or a plain statement that they are in progress.

9. What happens to the code if we part ways?
Wanted answer: repository handover or escrow, plus exit assistance with a defined day count.

10. Is the non-solicit mutual, and for how long?
Wanted answer: mutual, 12 or 24 months, agreed in writing per engagement.

11. Can I speak to a client you have supported for more than two years?
Wanted answer: a name, a country and an introduction, not a logo wall.

Red flags

A Dubai address with no named local contact. If nobody in the proposal has a UAE mobile number and a job title, the address is a mailbox.

Refusal to say where delivery happens. Vagueness here is a deliberate choice, and it predicts vagueness about everything else.

References only from year-one clients. Anyone can look good in month four. Ask for a client in year three, and ask that client what happened when something broke.

A one-way non-solicit. If the clause protects only the vendor, the vendor has told you who they think the relationship is for.

Certification claims without a certificate number. "ISO compliant" is not a certification. Ask for the number and the scope statement, and check it on IAF CertSearch.

Accucia's view

The registered address is the wrong first question, and we say that knowing it costs us work.

Some UAE buyers genuinely need a local licence, particularly in government and semi-government procurement where In-Country Value scoring decides awards. When that is your situation, we will tell you to shortlist licensed UAE suppliers, on the first call rather than the fifth.

Where we win is the eight-hour overlap, named engineers who stay on the account, and a contract that says where your data lives.

Where we would not recommend us is a project needing someone physically on your floor five days a week, or a mandate requiring a UAE-licensed prime contractor. Hiring an offshore team for that and hoping is a bad plan, and we will not sell it to you.

See who we work with on our partners page and what they say on our testimonials page. For the regional view, start at our Gulf hub. When you are ready to compare answers to the eleven questions above, talk to us.

Frequently Asked Questions

Do I need a software development company in Dubai to hold a UAE trade licence?

Only if your procurement requires it. Government and semi-government tenders often score In-Country Value, which needs a licensed UAE supplier. Private buyers rarely need one. For them, named engineers, contracted response times in Gulf Standard Time and a written data location matter far more than a licence.

Where does Accucia deliver from?

Pune, India. We have no Dubai office, no UAE address, no trade licence, no TRN and no local team, and we will not imply otherwise.

Our regional clients include EPIC ME Technical Works LLC in the United Arab Emirates, Triolift in Saudi Arabia and Gulf Integrated Vertical Solutions in Bahrain.

How many working hours will an Indian team overlap with my Dubai day?

Eight. Gulf Standard Time is UTC+4 and India Standard Time is UTC+5:30, a 90-minute gap.

A 09:30 to 18:30 Indian day covers 08:00 to 17:00 in Dubai. A US Eastern vendor gives you one hour in summer and none in winter.

Is the UAE private-sector working week Monday to Friday?

Mostly, but not as a legal rule. The January 2022 change applied to UAE federal government entities and schools.

The private sector sets its own weekend under the UAE Labour Law. Most private businesses now work Monday to Friday. Confirm your counterpart's actual working week rather than assuming it.

Does the UAE apply withholding tax to payments to a foreign software supplier?

No. Under Federal Decree-Law No. 47 of 2022, withholding tax on UAE-sourced income of non-residents applies at 0%, and no separate registration or filing is expected while that rate stands.

Confirm your own position with a tax adviser before you sign anything.

Do I pay VAT on software services bought from outside the UAE?

Usually through the reverse charge. Article 48 of Federal Decree-Law No. 8 of 2017 treats an importer of services as supplying to itself and accounting for the 5% tax.

A registered recipient with full input recovery reports equal output and input tax, so it is normally cash neutral.

Can our data and code stay inside the UAE?

Yes, on request. We deploy in-region on AWS, Azure or Google Cloud Platform, with the region chosen to meet your requirement and infrastructure billed to you at cost, or to your own on-premise servers.

Agree the choice in writing before kickoff rather than after the first release.

What does the UAE PDPL require before personal data leaves the country?

Federal Decree-Law No. 45 of 2021 allows transfer under Article 22 to states with adequate protection legislation.

Article 23 allows transfer without adequacy where a contract binds the recipient to the decree's standards, or on explicit consent, contract performance, judicial cooperation or public-interest grounds.

Is Accucia ISO 27001 certified?

No. Implementation is underway, an auditor has been appointed, and certification is targeted for Q1 2027, January to March.

We do not hold ISO 9001 either; that work is also in progress. We will give you our current controls, our sub-processor list and our data-handling position in writing, and we will not claim a certificate we do not have.

Are you CERT-In empanelled?

No, we are not. Where your project requires an audit by a CERT-In empanelled organisation, you commission that audit directly.

We build to the auditor's stated requirements, cooperate through the assessment and implement every finding they raise before sign-off.

What non-solicit terms do you agree to?

Mutual ones. Twelve or twenty-four months, agreed per engagement, always in writing, binding both parties equally.

If a vendor offers you a non-solicit that protects only their staff and not yours, treat that asymmetry as a signal about how the rest of the contract will read.

What should I ask for in the first 30 days of an engagement?

A named team list with roles, an escalation contact with a working number, response times written in Gulf Standard Time, a data processing agreement naming the transfer basis, the sub-processor list, and the repository handover terms.

If any of those is still missing at day 30, escalate.