Vendor lock-in

It is rarely malicious and almost always structural. Accounts opened in the supplier's name because it was faster on day one. A proprietary layer nobody else has seen. Data in a shape only their tooling reads. No documentation, because it was never a deliverable. Every one of these is a reasonable local decision and the sum of them is a business that cannot change supplier without rebuilding.

The measurement is a single question asked at any point in the relationship: if this supplier disappeared on Friday, what could not be done on Monday? The answer is the lock-in, in units of work, and it is knowable long before anybody wants to leave.

It also compounds quietly with time, which is why it is worth testing while things are going well. A relationship that is working is the cheapest possible moment to establish that the registrar, the repository, the cloud accounts and the analytics are in the company's name — and the moment it is least likely to be raised.

Treating it as a question about trust

The supplier is competent and pleasant, so the question feels rude and is not asked. Lock-in is not about whether they would behave badly; it is about what happens if they are acquired, lose the person who knows the system, raise their rates, or simply stop replying. Ask it as an operational question and it stops being awkward — and a good supplier answers it without hesitating.

Somebody will quote this number at you.

Knowing the definition is not the same as being able to check the figure. These are the procedures that do the second thing.

Reading a quotation for technical work

“The whole project comes to AED 45,000, four to six weeks.” · 30 minutes, 5 questions.

Exit clause

What the contract says happens on the day the relationship ends — written while everyone is friendly, because it is unwritable afterwards.

---

Source code escrow

Source and build instructions held by a third party, released on stated events — insurance against a supplier that stops existing rather than one that stops replying.

---

Digital asset register

A written list of every account, domain and system the business depends on, recording who owns it, who administers it, what it costs and how it is recovered.

---

Named accounts and shared credentials

Access issued to a person rather than to a login everyone uses — the difference between being able to revoke one person and having to change everything.

---

Handover

The point at which a vendor's work becomes the company's property — defined by what is transferred, not by the project being finished.

All ninety-five termsWhat this is regulated by in the UAE

Is this one right in your own numbers?

The definitions are the easy part. Whether the figure on your dashboard was computed this way is a different question, and usually the more expensive one.