HRSanad — Pre-Requisites, Bill of Materials & Services Proposal

1

Executive Summary

Scope and purpose of this document

What This Document Covers

This document provides a complete technical and commercial specification for deploying HRSanad HRMS to serve up to 1,000 employees. It covers infrastructure pre-requisites for both cloud and on-premises deployment options, a full Bill of Materials with indicative pricing, professional services including training and documentation, and maintenance procedures.

🏢

Application Scope

Modules	All 9 core modules
Users (HR/Payroll)	Up to 50 admin users
Employees (ESS)	Up to 1,000
Tenants	Single tenant
Payroll frequency	Monthly + mid-month
Documents	Up to 50,000 files

📅

Deployment Timeline

Infrastructure setup	2 weeks
Application install	1 week
Data migration	2–4 weeks
UAT	2 weeks
Training	1–2 weeks
Go-live support	4 weeks

⚡

Performance SLA Targets

Page load (P95)	< 2 seconds
API response (P95)	< 500 ms
Payroll calc (1,000)	< 3 minutes
Report generation	< 30 seconds
Uptime SLA	99.9% (cloud)
Backup RPO	1 hour

🔒

Compliance Requirements

Data residency	In-country
Encryption at rest	AES-256
Encryption in transit	TLS 1.3
Backup encryption	AES-256
Access logging	Full audit trail
Password policy	MFA supported

2

Sizing Assumptions — 1,000 Employee Deployment

Workload model used for hardware calculations

Parameter	Value	Notes	Impact
Total employees	1,000	ESS users + payroll subjects	Database row volume
Concurrent ESS users (peak)	150	~15% of workforce at lunch/start of day	Web server sizing
HR Admin / Payroll users (concurrent)	20	Heavy data entry and report generation	API + DB connections
Payroll run volume	1,000 slips/month	Monthly + possible mid-month	CPU burst sizing
Leave requests/day (peak)	50	Start of month / before holidays	Write IOPS
Attendance records/day	2,000 swipes	Clock in + clock out × 1,000	Write throughput
Document uploads/month	500 files	Avg 2–3 MB per file	Blob storage growth
Report generation/day	30	Mix of PDF payslips and Excel exports	CPU burst + memory
Database size (year 1)	~25 GB	All tables, indexes, audit logs	Storage provisioning
Database size (year 3)	~70 GB	Growth rate ~25 GB/year with documents	Storage planning
Blob storage (documents, year 3)	~200 GB	Employee docs, payslips, reports	Object storage
Network throughput (peak)	~50 Mbps	File uploads, concurrent users	Bandwidth sizing
Redis cache	~2 GB working set	Session tokens, BullMQ jobs, query cache	Cache RAM sizing
Background jobs	~10 cron jobs	Payroll, leave accrual, doc expiry, alerts	Worker process sizing

Headroom Policy

All hardware is sized at 50% of maximum expected load to allow for growth to 1,500 employees, batch job spikes, and year-end reporting peaks without degradation. CPU is sized for 2× payroll burst. Storage is provisioned with 3-year runway.

3

Cloud Infrastructure Requirements

Azure / AWS / GCP — recommended specifications per service

Recommended Cloud Provider

Microsoft Azure is the recommended provider for this deployment (Azure UAE North for GCC customers; Azure Ireland West Europe for Ireland deployments) due to in-country data residency options, native Kubernetes (AKS), managed PostgreSQL (Azure Database for PostgreSQL Flexible Server), and Blob Storage with CDN. AWS and GCP equivalents are noted where applicable.

Application Tier

🌐

Web App (Next.js)

Azure SKU	Standard_D2s_v5
vCPU	2 cores
RAM	8 GB
OS Disk	64 GB SSD P10
Instances	2 (active/active)
OS	Ubuntu 22.04 LTS
AWS equiv.	t3.large × 2

⚙️

API Server (Fastify)

Azure SKU	Standard_D4s_v5
vCPU	4 cores
RAM	16 GB
OS Disk	64 GB SSD P10
Instances	2 (active/active)
OS	Ubuntu 22.04 LTS
AWS equiv.	t3.xlarge × 2

🔄

Background Worker

Azure SKU	Standard_D2s_v5
vCPU	2 cores
RAM	8 GB
OS Disk	32 GB SSD
Instances	1 (with auto-scale)
OS	Ubuntu 22.04 LTS
Purpose	BullMQ, cron jobs

⚖️

Load Balancer

Azure service	Application Gateway v2
SKU	Standard_v2
SSL termination	Yes (TLS 1.3)
WAF	Enabled (OWASP 3.2)
Health probes	Every 30s
AWS equiv.	ALB + WAF

Data Tier

🗄️

PostgreSQL (Primary)

Azure service	Flexible Server
SKU	Standard_D4ds_v4
vCPU	4 cores
RAM	16 GB
Storage	512 GB Premium SSD
IOPS	2,300 provisioned
Version	PostgreSQL 16
HA	Zone-redundant standby

📖

PostgreSQL (Read Replica)

Azure service	Flexible Server Read Replica
SKU	Standard_D2ds_v4
vCPU	2 cores
RAM	8 GB
Storage	512 GB (synced)
Purpose	Reports, analytics
Replication lag	< 30 seconds

⚡

Redis Cache (Azure Cache)

Azure service	Azure Cache for Redis
SKU	Standard C2
Memory	6 GB
Persistence	RDB every 60 min
TLS	Enforced
Purpose	BullMQ + sessions + cache

📁

Blob Storage (Documents)

Azure service	Azure Blob Storage
Tier	Standard LRS
Initial capacity	500 GB (scalable)
CDN	Azure CDN (static assets)
Versioning	Enabled
Soft delete	30-day retention

Network & Security

🌐

Virtual Network

VNet CIDR	10.0.0.0/16
App subnet	10.0.1.0/24
Data subnet	10.0.2.0/24
NSG	Per-subnet rules
DDoS	Basic (Standard optional)
Private endpoints	DB + Redis + Blob

🔐

Key Vault & Secrets

Service	Azure Key Vault
Secrets	DB creds, JWT secret, SMTP
Rotation	90-day auto-rotation
Audit	All access logged
Soft delete	90-day recovery

📊

Monitoring

Metrics	Azure Monitor + Prometheus
Dashboards	Grafana (AKS-hosted)
Log retention	90 days hot + 1 year archive
Alerting	PagerDuty / email
APM	Application Insights

📧

Email (SMTP)

Service	Azure Communication Services
Volume	Up to 10,000 emails/day
Domains	Custom domain + DKIM
Fallback	SendGrid (secondary)
Purpose	Payslips, alerts, OTP

4

On-Premises Infrastructure Requirements

Physical server specifications for self-hosted deployment

On-Premises Deployment Note

On-premises deployment is suited for organisations with strict data sovereignty requirements, existing datacenter infrastructure, or limited internet bandwidth. The specifications below assume a VMware ESXi or Proxmox hypervisor layer hosting virtualised workloads. All VMs run on 2 physical host servers for HA.

Physical Host Servers (2 Required for HA)

Component	Specification	Qty	Purpose
Application + Hypervisor Host (Server 1 & 2)
CPU	Intel Xeon Silver 4314 or AMD EPYC 7313 — 16 cores / 32 threads, 2.4 GHz base	2 sockets × 2 servers	vCPU pool for all VMs
RAM	256 GB DDR4 ECC RDIMM (16 × 16 GB DIMMs) — expandable to 512 GB	Per server	VM memory pool
OS / Boot Drive	2 × 480 GB SSD RAID-1 (hypervisor OS)	Per server	ESXi / Proxmox boot
VM Storage (local NVMe)	4 × 1.92 TB NVMe SSD in RAID-10 = ~3.8 TB usable	Per server	VM disks (fast tier)
Network	2 × 10GbE SFP+ NIC (bonded active/passive) + 1 × 1GbE IPMI	Per server	VM network + IPMI OOB
Power Supply	Redundant PSU 800W 80+ Platinum	2 PSU per server	Power redundancy
Form factor	1U or 2U rackmount	2 servers	Rack space: 4U total
Dedicated Database Server (Server 3)
CPU	Intel Xeon Gold 5318Y — 24 cores / 48 threads, 2.1 GHz base	2 sockets	PostgreSQL query throughput
RAM	128 GB DDR4 ECC (PostgreSQL shared_buffers = 32 GB)	Per server	DB buffer pool
Data Storage	8 × 1.92 TB NVMe SSD in RAID-10 = ~7.6 TB usable	1	PostgreSQL data + WAL
Backup Storage	4 × 4 TB SATA SSD in RAID-5 = ~10 TB usable	1	pg_basebackup + WAL archive
Network	2 × 10GbE SFP+ (bonded) + IPMI	1	DB replication + app traffic
NAS / Backup Appliance (Server 4)
CPU	Intel Xeon E-2356G — 6 cores	1	Low-power storage node
RAM	32 GB ECC	1	ZFS ARC cache
Storage	8 × 8 TB enterprise SAS HDD in RAIDZ2 = ~40 TB usable	1	Backups + blob storage
Protocol	NFS v4.1 / SMB3 / S3-compatible (MinIO)	—	Blob storage (Azure Blob replacement)

Network Equipment

Equipment	Specification	Qty	Purpose
Core switch	Cisco Catalyst 9200L-24P-4X-E (10GbE uplinks, 24-port PoE+)	2 (stacked)	Server interconnect
Firewall / UTM	Fortinet FortiGate 200F or pfSense XG-7100 (10 Gbps throughput, IDS/IPS)	1 (active/passive HA pair)	Perimeter security, VPN
Internet connection	Minimum 200 Mbps dedicated leased line (1 Gbps recommended); secondary 100 Mbps failover	2 ISPs	User access + email delivery
UPS	APC Smart-UPS 3000VA rack-mount — 15 min runtime at full load	2	Server room power backup
PDU	APC Rack PDU 2G, switched, 32A	2 (per rack)	Remote power management
KVM over IP	Raritan Dominion KX III or IPMI 2.0 on each server	Per server	Out-of-band management

VM Layout on On-Premises Hosts

VM Name	OS	vCPU	RAM	Disk	Host
hrsanad-web-01	Ubuntu 22.04 LTS	4	8 GB	64 GB SSD	Host 1
hrsanad-web-02	Ubuntu 22.04 LTS	4	8 GB	64 GB SSD	Host 2
hrsanad-api-01	Ubuntu 22.04 LTS	8	16 GB	64 GB SSD	Host 1
hrsanad-api-02	Ubuntu 22.04 LTS	8	16 GB	64 GB SSD	Host 2
hrsanad-worker-01	Ubuntu 22.04 LTS	4	8 GB	32 GB SSD	Host 1
hrsanad-pg-primary	Ubuntu 22.04 LTS	16	64 GB	2 TB NVMe	DB Server
hrsanad-pg-replica	Ubuntu 22.04 LTS	8	32 GB	2 TB NVMe	DB Server
hrsanad-redis	Ubuntu 22.04 LTS	4	12 GB	32 GB SSD	Host 2
hrsanad-lb (nginx)	Ubuntu 22.04 LTS	2	4 GB	16 GB SSD	Host 1 + 2 (VRRP)
hrsanad-monitoring	Ubuntu 22.04 LTS	4	8 GB	200 GB SSD	Host 1
Total vCPU		62 vCPU	176 GB	~4.5 TB

Minimum OS Requirements (All Servers)

Operating System: Ubuntu Server 22.04 LTS (Jammy) — preferred for all VMs. Alternatives: RHEL 9 / Rocky Linux 9 (enterprise support). Windows Server 2022 Standard is supported for AD integration only — do not run application workloads on Windows. All servers must have SELinux or AppArmor enabled.

5

Cloud vs On-Premises — Decision Matrix

Side-by-side comparison to inform deployment decision

☁ Cloud (Azure) RECOMMENDED

Capital expenditure	$0 (OPEX model)
Monthly cost (est.)	$2,800–$3,500/month
3-year TCO	~$126,000
Setup time	1–2 weeks
Uptime SLA	99.95% (Azure SLA)
Disaster recovery	Built-in geo-redundancy
Scaling	Elastic — minutes
Maintenance	Managed (Azure handles OS/HW)
Security patching	Azure auto-patching available
Data residency	In-country Azure region
IT skills needed	Azure Admin (AZ-104)
Best for	SMB, fast deployment, no DC

🏢 On-Premises

Capital expenditure	$85,000–$110,000 (one-time)
Monthly cost (est.)	$800–$1,200/month (power, support)
3-year TCO	~$125,000–$155,000
Setup time	4–8 weeks
Uptime SLA	Depends on your infrastructure
Disaster recovery	Manual — requires DR site
Scaling	Manual — hardware procurement
Maintenance	Full responsibility on customer
Security patching	Manual — scheduled windows
Data residency	Full control — on your premises
IT skills needed	Linux sysadmin + DBA + network
Best for	Regulated industries, full control

6

Bill of Materials — Cloud Deployment (Azure)

Monthly recurring costs — pricing based on Azure Pay-As-You-Go rates, UAE North region

#	Item	Specification	Qty	Unit/Month (USD)	Monthly Total
Compute					$1,068
C-01	Web App VM (Standard_D2s_v5)	2 vCPU, 8 GB RAM, Ubuntu 22.04	2	$134	$268
C-02	API Server VM (Standard_D4s_v5)	4 vCPU, 16 GB RAM, Ubuntu 22.04	2	$270	$540
C-03	Worker VM (Standard_D2s_v5)	2 vCPU, 8 GB RAM, Ubuntu 22.04	1	$134	$134
C-04	OS Disks (P10 SSD 64 GB)	Premium SSD P10	5	$25.20	$126
* 1-year Reserved Instance pricing saves ~37% — see note at end of section
Database					$756
D-01	PostgreSQL Flexible Server Primary	Standard_D4ds_v4, 16 GB RAM, 512 GB P30 SSD, Zone-HA	1	$498	$498
D-02	PostgreSQL Read Replica	Standard_D2ds_v4, 8 GB RAM, 512 GB SSD	1	$228	$228
D-03	Azure Cache for Redis Standard C2	6 GB, TLS, RDB persistence	1	$30	$30
Storage & CDN					$95
S-01	Azure Blob Storage (LRS)	500 GB initial, hot tier	1	$10	$10
S-02	Azure CDN (static assets)	100 GB/month egress	1	$8	$8
S-03	Azure Backup (VM + DB)	Vault Standard, 200 GB backup storage	1	$42	$42
S-04	Log Analytics Workspace	5 GB/day ingestion, 90-day retention	1	$35	$35
Networking & Security					$362
N-01	Application Gateway v2 (WAF enabled)	Standard_v2, OWASP ruleset, SSL termination	1	$180	$180
N-02	Azure Virtual Network	VNet + 3 subnets + NSGs + private endpoints	1	$12	$12
N-03	Public IP Addresses (static)	Standard SKU static IP	2	$8	$16
N-04	Azure Key Vault	Standard tier, 10,000 operations/month	1	$4	$4
N-05	Azure Communication Services (email)	10,000 emails/month	1	$1	$1
N-06	Azure Monitor + Application Insights	5 GB logs/day	1	$80	$80
N-07	Outbound data transfer	~100 GB/month egress	1	$9	$9
N-08	Azure DNS	Hosted zone + queries	1	$2	$2
N-09	DDoS Protection (optional)	Network-level DDoS Standard	1	$58	$58
Monthly Infrastructure Total (Azure)					$2,281
💡 With 1-year Azure Reserved Instances (compute + DB): estimated monthly saving of ~$620 → effective monthly cost $1,661
Annual Infrastructure Cost (Pay-As-You-Go)					$27,372/year
Annual Infrastructure Cost (1-Year Reserved)					$19,932/year

7

Bill of Materials — On-Premises Deployment

One-time capital expenditure — indicative pricing (USD, ex-VAT)

#	Item	Specification	Qty	Unit Price	Total
Servers					$52,000
SV-01	Application Host Server × 2	Dell PowerEdge R750 / HPE ProLiant DL380 Gen10+: Dual Xeon Silver 4314 (16C), 256 GB DDR4 ECC, 4×1.92TB NVMe RAID-10, Dual 10GbE, Redundant PSU 800W	2	$14,500	$29,000
SV-02	Database Server × 1	Dell PowerEdge R750xs / HPE DL380 Gen10+: Dual Xeon Gold 5318Y (24C), 128 GB DDR4 ECC, 8×1.92TB NVMe RAID-10 + 4×4TB SAS RAID-5, Dual 10GbE, Redundant PSU	1	$18,000	$18,000
SV-03	NAS / Backup Appliance	TrueNAS / Synology RS3621RPxs: Xeon E-2356G, 32 GB ECC, 8×8TB SAS HDD, Dual 10GbE SFP+, redundant PSU — MinIO S3-compatible blob storage	1	$5,000	$5,000
Networking					$14,800
NW-01	Core Switch (stacked)	Cisco Catalyst 9200L-24P-4X-E, 24-port PoE+, 4×10G uplinks — 2 units stacked	2	$3,200	$6,400
NW-02	Firewall HA Pair	Fortinet FortiGate 200F (10 Gbps NGFW, IDS/IPS, SSL inspection, VPN) — active/passive pair	2	$3,800	$7,600
NW-03	SFP+ DAC Cables	10GbE Direct Attach Copper, 1m and 3m lengths	10	$30	$300
NW-04	Cat6a Patch Cables	1m, 2m, 3m assorted	50	$10	$500
Power & Cooling					$7,200
PW-01	UPS (Rack Mount)	APC Smart-UPS 3000VA RM 2U — 15 min at 2,400W load, network card included	2	$1,800	$3,600
PW-02	Rack PDU (Switched)	APC AP8653 Rack PDU 2G, Switched, 32A/208V, 20× C13 + 4× C19	2	$800	$1,600
PW-03	Server Rack	APC NetShelter SX 42U 600mm wide, with blanking panels and cable management	2	$1,000	$2,000
Virtualisation & Management					$6,400
VM-01	VMware vSphere Essentials Plus Kit	vSphere 8 for 3 hosts + vCenter, 1-year SnS	1	$4,200	$4,200
VM-02	KVM over IP Switch	Raritan Dominion KX III-116 — 16-port KVM	1	$1,200	$1,200
VM-03	Network monitoring probe	PRTG Network Monitor (500 sensors perpetual)	1	$1,000	$1,000
Installation & Cabling					$4,500
IN-01	Rack installation & cable management	Labour: server racking, cable dressing, labelling	1	$1,500	$1,500
IN-02	Structured cabling	Patch panel, wall ports, cable runs (up to 20 drops)	1	$2,000	$2,000
IN-03	Environmental monitoring	Temperature/humidity sensor with SMS alert	2	$500	$1,000
On-Premises Hardware Total (One-Time CAPEX)					$84,900
Annual power cost estimate (UAE/Ireland): ~$4,800/year @ average 5 kW load × 24h × $0.11/kWh
Annual hardware maintenance (3-year HW warranty included; post-warranty support contract): ~$6,000–$9,000/year

8

Software & Third-Party Licences

Open-source (free), commercial (charged), and annual subscription items

#	Software	Purpose	Licence Type	Annual Cost
Operating System				$0
OS-01	Ubuntu Server 22.04 LTS	All application VMs and database servers	Free (Canonical) — LTS until Apr 2027; ESM extended to 2032	$0
OS-02	Ubuntu Pro (optional)	Extended Security Maintenance (ESM), FIPS, Livepatch — for compliance-sensitive deployments	Ubuntu Pro — $25/server/year (on-prem)	$200
Database				$0
DB-01	PostgreSQL 16	Primary database engine	Free open source (BSD licence) — community supported	$0
DB-02	pgBackRest	PostgreSQL backup and restore (WAL archiving)	Free open source (MIT)	$0
DB-03	pgBouncer	Connection pooling for PostgreSQL	Free open source	$0
Application Runtime				$0
RT-01	Node.js 20 LTS	API and frontend runtime	Free (MIT)	$0
RT-02	Docker Engine + Docker Compose	Container runtime (non-Swarm)	Free (Apache 2.0)	$0
RT-03	Redis 7 (self-hosted)	Cache and BullMQ queue broker	Free (RSAL 2.0) — or Redis Cloud Essentials $7/month	$0
RT-04	Nginx (load balancer / on-prem)	Reverse proxy and SSL termination	Free (BSD)	$0
Monitoring & Observability				$0–$480
MO-01	Prometheus + Grafana	Metrics collection and dashboards	Free open source (Apache 2.0)	$0
MO-02	Grafana Cloud (optional)	Managed Grafana with alerting — 14-day retention free tier	Free tier / $9/user/month for Pro	$0–$108
MO-03	Uptime Robot	External uptime monitoring, 5-min checks, SMS alerts	$7/month (Pro plan)	$84
MO-04	Sentry (error tracking)	Application exception monitoring, source map support	Free tier (5K errors/month) / $26/month Team	$0–$312
Security				$200–$600
SE-01	Let's Encrypt SSL Certificates	TLS certificates for all domains (auto-renewed via Certbot)	Free	$0
SE-02	CrowdSec (WAF / IDS)	Crowd-sourced intrusion prevention, rate limiting, IP reputation	Free (open source) — Cloud Console $0–$100/year	$0–$100
SE-03	Wazuh SIEM	Security Information and Event Management, file integrity monitoring	Free open source (GPLv2)	$0
SE-04	Snyk (dependency scanning)	Scan npm dependencies for CVEs in CI/CD pipeline	Free tier / $25/month Team	$0–$300
SE-05	Cloudflare (DNS + DDoS) — optional	DNS-level DDoS mitigation, CDN, Bot management	Free (Pro $20/month)	$0–$240
CI/CD & DevOps				$0
CD-01	GitHub Actions	CI/CD pipelines (build, test, deploy)	Free for public / $4/user/month (private repo)	$0–$96
CD-02	GitHub Repository	Source code hosting, PR reviews, issue tracking	Free (Team $4/user/month)	$0
CD-03	Docker Hub	Container image registry	Free (Pro $7/month for private repos)	$0–$84
Email Delivery				$200–$600
EM-01	SendGrid (email delivery)	Transactional email (payslips, alerts, OTP) — 100 emails/day free	Essentials $19.95/month (100K emails/month)	$240
Annual Third-Party Software Total (minimum)				$524/year
Annual Third-Party Software Total (full optional stack)				$2,004/year

9

HRSanad Application Licence & Subscription

HRSanad platform licencing tiers and pricing

#	Licence Item	Description	Unit	Unit Price	Total (Annual)
HRSanad Platform Licence — 1,000 Employees
L-01	HRSanad Core Platform (SaaS/Cloud)	All 9 modules: Personnel, Leave, Payroll, TNA, Appraisal, Recruitment, Training, Reports, ESS. Includes updates, security patches, and bug fixes. Up to 1,000 employees.	Per employee/year	$36	$36,000
L-02	HRSanad Core Platform (On-Premises)	Perpetual licence — same module scope. Annual Software Assurance (maintenance + updates) = 20% of licence fee. On-premises requires customer to manage infrastructure.	One-time + 20% SA/year	$60,000 + $12,000/yr	$72,000 (yr 1)
L-03	HRSanad WPS / Payroll Compliance Add-on	WPS SIF file generation (UAE), PMOD (Ireland), GOSI export. Required for countries with statutory payroll reporting.	Per tenant/year	$1,200	$1,200
L-04	HRSanad Advanced Analytics & BI Add-on	Built-in Metabase dashboards, custom report builder, workforce analytics, attrition predictions.	Per tenant/year	$2,400	$2,400
L-05	HRSanad Mobile App (Android + iOS)	Employee mobile app for clock-in, leave requests, payslip view, approvals. GPS + photo capture. Per-tenant deployment.	Per tenant/year	$1,800	$1,800
L-06	Additional Employee Packs (if exceeding 1,000)	Each 250-employee increment above base tier.	Per 250 employees/year	$6,000	As needed
L-07	Multi-Tenant / Group Licence	For organisations with multiple legal entities (multiple companies within one HRSanad instance). Includes shared org master, consolidated reporting.	Per additional company/year	$4,800	As needed
Professional Services (One-Time)
PS-01	Implementation & Configuration	System configuration, org structure setup, workflow configuration, pay component setup, holiday calendar, initial admin training.	Fixed price	—	$8,000
PS-02	Data Migration	Migration from legacy HRMS or Excel. Includes employee master, leave balances, payroll history (last 12 months), documents.	Fixed price	—	$6,000
PS-03	Integration Development	ERP / accounting system integration (SAP, Oracle, Xero, Sage, QuickBooks). Per integration point.	Per integration	$3,500	$3,500
PS-04	Go-Live Support (4 weeks)	Dedicated support engineer available during first payroll run, go-live week, and 4-week hypercare period.	Fixed price	—	$4,500
SaaS Licence (Year 1) — Platform + Compliance Add-on + Implementation					$55,700
SaaS Licence (Year 2 onwards) — Renewal					$39,600/year
On-Premises Licence (Year 1) — Platform + SA + Implementation					$90,500

10

Training Packages

Online, classroom, and self-paced options for all user roles

🖥 HRSanad Online Training — HR Administrator

Online / Self-Paced

System overview and navigation
Employee master management (all 6 tabs)
Organisation structure setup
Leave type configuration and approvals
Payroll run cycle (draft → finalized)
TNA: shifts, rosters, attendance corrections
Appraisal cycle setup and management
Report generation and exports
User access management
Includes: 12 HD video modules, quizzes, certificate

$480 / user

⏱ 8–10 hours | Valid 12 months | On-demand access

📊 HRSanad Online Training — Payroll Officer

Online / Self-Paced

Pay component setup and salary structures
Monthly payroll run walkthrough
Payslip review and corrections
WPS / SEPA / PMOD file generation
Loan management and deduction setup
Gratuity / redundancy calculation review
Journal voucher and GL export
Year-end procedures and audit reports
Includes: 8 video modules + live payroll simulation

$380 / user

⏱ 6–8 hours | Valid 12 months | On-demand access

👤 HRSanad Online Training — Employee (ESS)

Online / Self-Paced

ESS portal login and navigation
Viewing payslips and downloading PDFs
Applying for leave and checking balance
Loan application and installment view
Viewing attendance and raising corrections
Profile update and password management
Mobile app clock-in (GPS and photo)
Includes: 4 short video modules + interactive tour

$60 / user

⏱ 1–2 hours | Valid 12 months | Free for 1,000+ seat clients

🏫 HRSanad Classroom Training — HR & Payroll Team

On-Site / Classroom

Full-day instructor-led training (3 days)
Day 1: System setup, org structure, employee master
Day 2: Leave management, TNA, payroll cycle
Day 3: Appraisal, recruitment, reporting, admin
Hands-on exercises using your live configuration
Max 12 participants per session
Printed reference guide + digital workbook
Post-training Q&A support (30 days via email)
Includes travel (within country) and trainer expenses

$4,200 / session (up to 12 participants)

⏱ 3 full days on-site | Scheduled within 30 days of go-live

🔧 Server Maintenance Training

On-Site / Hybrid

Server architecture and component overview
Linux server administration (Ubuntu 22.04)
Docker and container management
PostgreSQL DBA basics (backup, restore, monitoring)
Redis administration and memory management
Nginx / load balancer configuration
Log management and Grafana dashboards
Incident response and escalation procedures
Azure Portal navigation (cloud deployments)
VMware / Proxmox VM management (on-prem)
Runbook and SOPs handover

$3,500 / session (up to 4 IT staff)

⏱ 2 full days | Recommended for IT/sysadmin team only

📚 HRSanad Offline Training Kit — Complete

Documentation

Full printed Administrator Manual (300+ pages)
Payroll Officer Reference Guide (150 pages)
ESS Employee Quick Start Guide (20 pages)
Server Administration Runbook (120 pages)
Backup & Recovery Procedure Manual
Patch Management Procedures
Disaster Recovery Plan template
All documentation in PDF + editable DOCX
USB drive with offline video library (12 modules)
Branded with customer organisation name/logo

$1,800 / set (one-time)

📦 Physical delivery + digital download | Updated annually

Training Package	Format	Duration	Audience	Price
Online — HR Administrator	Self-paced video	8–10 hrs	HR Admins, HR Officers	$480/user
Online — Payroll Officer	Self-paced video	6–8 hrs	Payroll team	$380/user
Online — Employee ESS	Self-paced video	1–2 hrs	All 1,000 employees	$60/user (free for large clients)
Classroom — HR & Payroll	On-site 3-day	3 days	Up to 12 staff	$4,200/session
Server Maintenance Training	On-site / hybrid	2 days	IT team (max 4)	$3,500/session
Offline Documentation Kit	Physical + digital	Reference	All roles	$1,800/set
Recommended Training Bundle (1,000-employee deployment)				$11,900
Bundle includes: Classroom training (1 session), Server Maintenance (1 session), Online HR Admin (5 users), Online Payroll (3 users), Offline Kit (1 set), ESS training waived

11

Maintenance & Support Services

Annual support tiers and included services

Service	Standard (included)	Premium +$4,800/yr	Enterprise +$12,000/yr
Support hours	Business hours (9am–6pm Sun–Thu)	Extended (8am–8pm, 7 days)	24×7 with on-call
Response SLA (Critical)	4 business hours	2 hours	30 minutes
Response SLA (High)	1 business day	4 hours	2 hours
Response SLA (Medium/Low)	3 business days	1 business day	4 hours
Support channel	Email + ticketing portal	Email + phone + portal	Dedicated Slack channel + phone
Bug fixes	Included — next release	Included — expedited	Included — hotfix within 48 hrs
Application updates	Quarterly releases	Monthly releases	Bi-weekly + hotfixes
Security patches	Within 30 days of CVE	Within 7 days	Within 48 hours
OS / dependency patching	Customer responsibility	Advisory only	Managed patching included
Health check reviews	Annual	Quarterly	Monthly
Named account manager	No	Yes	Yes (senior)
Training credits/year	2 online user licences	5 online user licences	Unlimited online + 1 classroom day
Payroll compliance updates	Included (annual)	Included	Included + advance preview

12

Backup & Recovery Procedures

Recovery objectives, schedule, and restoration process

🎯

Recovery Objectives

RPO (data loss)	≤ 1 hour
RTO (downtime)	≤ 4 hours
Backup frequency	Hourly (DB), Daily (full)
Retention — daily	14 days
Retention — weekly	12 weeks
Retention — monthly	12 months
Retention — annual	7 years (payroll)
Offsite copy	Yes — different region

📅

Backup Schedule

Continuous WAL	Every transaction
Hourly snapshot	PostgreSQL base backup
Daily full backup	02:00 local time
Blob storage sync	Every 4 hours
VM snapshot	Daily (Azure Backup)
Config backup	On every deploy
Offsite replication	Daily (geo-redundant)

🔄

Restoration Steps

Step 1	Identify incident scope
Step 2	Select recovery point
Step 3	Restore PostgreSQL from pgBackRest
Step 4	Apply WAL to target time
Step 5	Verify data integrity
Step 6	Restore blob storage
Step 7	Smoke test all modules
Step 8	Notify users and resume

🧪

Backup Testing

Monthly restore drill	DB point-in-time test
Quarterly DR drill	Full system restore test
Annual DR exercise	Full failover simulation
Verification	pgBackRest --verify
Alert on failure	Email + SMS within 5 min
Documented	Test result log retained

Backup Type	Tool	Frequency	Storage Target	Encryption	Retention
PostgreSQL continuous WAL	pgBackRest	Continuous (per transaction)	Local NVMe + S3/Blob offsite	AES-256	7 days WAL
PostgreSQL full backup	pgBackRest base backup	Daily at 02:00	Local + offsite Blob	AES-256	14 daily, 12 weekly
Blob / file storage	Azure Blob versioning / rclone	Every 4 hours + versioned	Offsite Azure region	At-rest encryption	30 days soft delete
VM snapshots	Azure Backup / VMware snapshots	Daily	Vault (cloud) / NAS (on-prem)	Vault encryption	14 days
Application config & secrets	Azure Key Vault / Git (encrypted)	On change	Git repo (encrypted) + Key Vault	Vault encryption	Indefinite (versioned)
Redis persistence	Redis RDB snapshots	Every 60 minutes	Local disk	Filesystem encryption	24 hours
Payroll records (compliance)	pgBackRest annual archive	Annual (post year-end)	Cold storage (Azure Archive)	AES-256	7 years

Critical Backup Rules

1. Backups must never reside on the same physical disk as the primary data. 2. All backup restoration must be tested monthly — an untested backup is not a backup. 3. Encryption keys must be stored in Key Vault, not alongside the backup files. 4. Payroll data backups must be retained for a minimum of 7 years per UAE Labour Law / Irish Revenue requirements.

13

Patch Management Procedures

Server OS patching, application patching, and emergency CVE response

Server OS Patch Management

Step	Activity	Frequency	Owner	Procedure
1	CVE monitoring	Daily automated scan	Security team	Ubuntu Pro ESM alerts + Wazuh SIEM + USN (Ubuntu Security Notices) subscription. Automatic notification when packages with CVE ≥ CVSS 7.0 affect installed versions.
2	Patch classification	Weekly review	IT lead	Critical (CVSS ≥ 9): patch within 48 hours. High (7–8.9): patch within 7 days. Medium (4–6.9): patch within 30 days. Low (< 4): patch at next scheduled window.
3	Patch staging	Before production	DevOps	Apply patches to staging environment first. Run full automated test suite (Vitest + Playwright). Allow 24-hour soak period before production.
4	Scheduled maintenance window	2nd Sunday monthly, 02:00–06:00 local	IT lead	`sudo apt update && sudo apt upgrade -y`. For kernel updates: schedule reboot. Coordinate with HR team to avoid payroll processing dates.
5	Unattended upgrades (security only)	Daily	Automated	Enable Ubuntu unattended-upgrades for security patches only. Reboot policy: never auto-reboot (manual reboot at next maintenance window).
6	Kernel live patching	As released	Automated	Enable Canonical Livepatch (Ubuntu Pro) — applies kernel security patches without reboot on production servers.
7	Post-patch validation	After each patch window	DevOps	Run smoke tests: health check endpoints, sample payroll calculation, leave request, ESS login. Monitor error rates for 2 hours post-patch.
8	Rollback procedure	If post-patch issues detected	DevOps	For VMs: revert to pre-patch snapshot. For packages: `apt-get install <package>=<previous-version>`. For DB server: stop PostgreSQL, restore from last backup before patching.
9	Patch record	After each window	IT lead	Update patch log spreadsheet: date, server, packages patched, CVEs addressed, test results, approver sign-off. Retain for 3 years for compliance audit.

Application Patch Management

Step	Activity	Frequency	Procedure
1	Dependency vulnerability scanning	Every CI/CD run	Snyk / `npm audit` runs on every pull request and nightly. Blocks deployment if any critical CVE found in npm dependencies.
2	HRSanad application update (SaaS)	Quarterly or as released	HRSanad publishes release notes 14 days before update. Customer approves. Update applied in maintenance window. No downtime for minor updates.
3	HRSanad application update (On-Prem)	Quarterly	1) Pull updated Docker image from registry. 2) `docker compose pull && docker compose up -d`. 3) Run DB migrations automatically. 4) Verify health endpoint returns 200. Rollback: `docker compose down && docker compose up -d --scale web=0` then restore previous image tag.
4	Node.js LTS version upgrade	Annual (LTS release)	Upgrade from Node 20 LTS to next LTS. Test in staging for 2 weeks. Coordinate with HRSanad team to confirm compatibility. Update Dockerfile base image.
5	PostgreSQL minor version update	Quarterly	Review PostgreSQL release notes. For minor versions (16.x → 16.y): apply in maintenance window, restart service. For major versions: full migration plan required — consult HRSanad support.
6	Payroll compliance rule updates	Annual (or on law change)	When tax laws / leave laws change (e.g. new UAE Labour Decree, Irish Budget changes): HRSanad pushes compliance update within 30 days of law publication. Emergency update for mid-year changes.
7	Emergency hotfix deployment	As needed (critical bugs)	HRSanad hotfix SLA: P1 critical bug (data loss, payroll error) — hotfix within 48 hours. P2 high bug (module unusable) — fix within 5 business days. Hotfix deployed out-of-band, customer notified 1 hour before.

Zero-Downtime Deployment Strategy

All application patches use a rolling deployment: update one API instance while the other continues serving traffic, then swap the load balancer over. Typical patch window: < 5 minutes for application patches, < 2 minutes for configuration updates. Database migrations run on startup with automatic rollback on failure.

14

Grand Total & Payment Terms

All-inclusive investment summary for Year 1 and Year 2+

Option A — SaaS / Cloud Deployment (Recommended)

Category	Item	Year 1	Year 2+
HRSanad Platform	SaaS licence — 1,000 employees + Compliance Add-on	$37,200	$37,200/yr
Implementation	Implementation, data migration, integration, go-live support	$21,500	—
Azure Infrastructure	Cloud compute, DB, storage, networking (Pay-As-You-Go)	$27,372	$27,372/yr
Software licences	Third-party software (minimum stack)	$524	$524/yr
Training	Recommended bundle (classroom + server + online + docs)	$11,900	$2,400/yr
Support	Standard support (included in SaaS licence)	Included	Included
TOTAL — Option A, Year 1		$98,496	$67,496/yr
With 1-year Reserved Instances: Year 1 reduces by ~$7,440 → $91,056. Year 2+ reduces to $59,256/yr.

Option B — On-Premises Deployment

Category	Item	Year 1	Year 2+
HRSanad Platform	Perpetual licence + 20% annual SA + Compliance Add-on	$73,200	$13,200/yr
Implementation	Implementation, data migration, integration, go-live support	$21,500	—
Hardware	Servers, networking, power, rack (CAPEX)	$84,900	—
Software licences	VMware + monitoring + third-party	$5,724	$4,524/yr
Training	Recommended bundle	$11,900	$2,400/yr
Power / facilities (est.)	~5 kW × 8,760h × $0.11/kWh	$4,800	$4,800/yr
Hardware maintenance	Post-warranty support contract (from Year 4)	Included (warranty)	$7,200/yr
TOTAL — Option B, Year 1		$202,024	$32,124/yr
On-premises becomes more cost-effective than cloud after approximately Year 5 (break-even at ~$350K TCO).

Recommended Investment — Option A (SaaS / Cloud)

$98,496

Year 1 all-inclusive — platform, infrastructure, implementation, training. Excluding VAT.

Year 2 Annual Renewal

$67,496

3-Year Total Cost

$233,488

Cost Per Employee/Year

$78 / emp

Payment Schedule

30%

of Year 1 total

On contract signing

30%

of Year 1 total

On go-live date

25%

of Year 1 total

30 days post go-live

15%

of Year 1 total

60 days post go-live

Payment Notes

All amounts in USD. Bank transfer preferred (SWIFT/IBAN). VAT/GST/sales tax will be added as applicable by jurisdiction. Year 2+ renewals are invoiced annually, 30 days before renewal date. Annual inflation adjustment: CPI + 2% cap on renewal pricing.

15

Legal Notice, Terms & Conditions

Governing terms for this proposal and any resulting agreement

1. Validity of This Proposal

This proposal and all pricing herein is valid for 90 days from the date of issue (20 April 2026). After this date, prices are subject to revision. HRSanad Solutions reserves the right to withdraw or amend this proposal at any time before a signed contract is executed.

2. Scope and Exclusions

This proposal covers the items explicitly listed in Sections 6–13. Any work not listed is out of scope and will require a separate change order and additional quotation.
Hardware prices are indicative and subject to market availability at time of order. Final hardware costs will be confirmed on purchase order.
Third-party software pricing (Azure, AWS, VMware, etc.) is subject to change by the respective vendor and is passed through at actual cost.
Integration development (PS-03) is estimated per integration point. Complex integrations may require additional scoping.
Travel and accommodation for on-site training and implementation services will be charged at cost if outside the Greater Dubai metropolitan area / Dublin metropolitan area.

3. Intellectual Property

The HRSanad software platform, including all source code, algorithms, database schemas, and documentation, remains the exclusive intellectual property of HRSanad Solutions at all times.
Customer data loaded into HRSanad remains the exclusive property of the Customer. HRSanad Solutions will not access, process, or disclose customer data except as required to provide the contracted services or as required by applicable law.
Customisations developed specifically for a Customer are owned jointly unless otherwise agreed in writing.
The Customer is granted a non-exclusive, non-transferable licence to use the HRSanad software for the duration of the contract term (SaaS) or perpetually (on-premises, subject to Software Assurance).

4. Data Protection & Confidentiality

Both parties agree to maintain strict confidentiality regarding the terms of this proposal and any confidential business information exchanged.
HRSanad Solutions processes customer employee data as a Data Processor under applicable data protection laws (UAE PDPL / EU GDPR / Irish Data Protection Act 2018). A Data Processing Agreement (DPA) will be executed before go-live.
Customer data is stored in the agreed data residency region and is not transferred outside that region without the Customer's prior written consent.
HRSanad Solutions maintains ISO 27001-aligned information security policies. Security audit reports are available to Enterprise customers upon request under NDA.

5. Service Level Agreement

SaaS Cloud uptime SLA: 99.9% monthly uptime (excluding scheduled maintenance windows, which will not exceed 4 hours per month and will be communicated at least 48 hours in advance).
SLA credits: for each full hour below 99.9% in a calendar month: 1-day service credit; below 99.5%: 1-week credit; below 99.0%: 1-month credit.
SLA credits are the Customer's sole remedy for downtime and will not exceed the monthly fee for the affected service.
SLA does not apply to: Customer-caused outages, force majeure events, third-party service failures (Azure, DNS), or scheduled maintenance.

6. Liability Limitations

HRSanad Solutions' total aggregate liability under this agreement shall not exceed the total fees paid by the Customer in the 12 months preceding the claim.
HRSanad Solutions shall not be liable for indirect, consequential, special, or punitive damages, including loss of profits, loss of data, or business interruption.
The Customer is solely responsible for verifying that payroll calculations comply with applicable employment and tax laws. HRSanad Solutions provides the calculation engine; compliance is the Customer's legal obligation.

7. Termination

Either party may terminate the SaaS agreement with 90 days' written notice before the renewal date.
Termination for cause (material breach uncured within 30 days): immediate termination with no further obligation.
On termination: HRSanad Solutions will provide a full data export (PostgreSQL dump + blob files) within 30 days. Data will be securely deleted from HRSanad systems within 90 days of export delivery.
No refund for prepaid annual fees on voluntary termination.

8. Governing Law & Dispute Resolution

This agreement is governed by the laws of the United Arab Emirates (for GCC deployments) or the Republic of Ireland (for Ireland/EU deployments), without regard to conflict-of-laws principles.
Any disputes shall first be referred to senior management of both parties for resolution within 30 days. If unresolved, disputes shall be submitted to binding arbitration under DIAC (UAE) or LCIA (Ireland/UK) rules.

9. Warranties

HRSanad Solutions warrants that the software will perform substantially as described in the product documentation during the term of the agreement.
HRSanad Solutions does not warrant that the software will be error-free or uninterrupted, but commits to the SLA and support response times in Section 11.
The Customer warrants that it has the legal authority to enter into this agreement and that all employee data provided has been collected lawfully.

10. Acceptance

Acceptance of this proposal is signified by the Customer's signature on the accompanying Service Agreement or by written confirmation (email) from an authorised representative of the Customer. This proposal does not constitute a binding contract until a formal Service Agreement is signed by both parties.

For and on behalf of HRSanad Solutions

Authorised Signatory | Name: ________________

Date: ________________

For and on behalf of Customer

Authorised Signatory | Name: ________________

Date: ________________

Pre-Requisites, Infrastructure &Professional Services Proposal

Hardware sizing, Bill of Materials, Training packages, Maintenance, and Licensing — for a 1,000-employee deployment.

Table of Contents

Executive Summary

What This Document Covers

Application Scope

Deployment Timeline

Performance SLA Targets

Compliance Requirements

Sizing Assumptions — 1,000 Employee Deployment

Headroom Policy

Cloud Infrastructure Requirements

Recommended Cloud Provider

Application Tier

Web App (Next.js)

API Server (Fastify)

Background Worker

Load Balancer

Data Tier

PostgreSQL (Primary)

PostgreSQL (Read Replica)

Redis Cache (Azure Cache)

Blob Storage (Documents)

Network & Security

Virtual Network

Key Vault & Secrets

Monitoring

Email (SMTP)

On-Premises Infrastructure Requirements

On-Premises Deployment Note

Physical Host Servers (2 Required for HA)

Network Equipment

VM Layout on On-Premises Hosts

Minimum OS Requirements (All Servers)

Cloud vs On-Premises — Decision Matrix

Bill of Materials — Cloud Deployment (Azure)

Bill of Materials — On-Premises Deployment

Software & Third-Party Licences

HRSanad Application Licence & Subscription

Training Packages

Maintenance & Support Services

Backup & Recovery Procedures

Recovery Objectives

Backup Schedule

Restoration Steps

Backup Testing

Critical Backup Rules

Patch Management Procedures

Server OS Patch Management

Application Patch Management

Zero-Downtime Deployment Strategy

Grand Total & Payment Terms

Option A — SaaS / Cloud Deployment (Recommended)

Option B — On-Premises Deployment

Recommended Investment — Option A (SaaS / Cloud)

Payment Schedule

Payment Notes

Legal Notice, Terms & Conditions

1. Validity of This Proposal

2. Scope and Exclusions

3. Intellectual Property

4. Data Protection & Confidentiality

5. Service Level Agreement

6. Liability Limitations

7. Termination

8. Governing Law & Dispute Resolution

9. Warranties

10. Acceptance

Pre-Requisites, Infrastructure &
Professional Services Proposal