Ten questions that separate serious vendors from pretty demos
- Is it hosted entirely in the EU? Ask for the specific region.
- Is there AES-256-GCM encryption? Without a concrete algorithm, there is no real security.
- Are they working towards ENS Medium category alignment? With a documented process, not marketing only.
- Real public APIs? GraphQL, REST and MCP — not “integration on request”.
- Native multi-tenant? If you have several centres, require Business Units.
- Granular roles? RBAC + ABAC, not “global” roles.
- Immutable audit? Ask to see a real export.
- Deployment in 4–6 weeks? If they say 6 months, that’s a bad sign.
- Migration template? Excel, CSV, previous ERP.
- Exit guarantee? How you recover all your data in JSON or CSV.
What decides success
- That care staff use it without intensive training.
- That the monthly cost does not balloon with surprise add-ons.
- That the vendor responds in under 4 hours in production.
Need an editable checklist? Request the Excel version and we will adapt it to your case.
