17 February 20268 min read
If you are seriously considering a Lebanese supplier, someone in your organisation is going to ask the obvious question, probably in a procurement review and probably in a way that ends the conversation. It is a fair question and it deserves a straight answer rather than a reassurance.
Lebanon has been through a severe financial and banking crisis, its electricity grid does not supply full-time power, and it has periods of political and security instability that reach international news. All of that is true. None of it is a reason to stop reading, and none of it is a reason to skip diligence either. What follows is what the practical arrangements actually look like, so you can evaluate a specific provider instead of a country.
The contract sits outside Lebanese law, usually
The first thing to establish is which entity you are contracting with and under which law. Cross-border service agreements are routinely written under English law, or under the law of the client's own country, with a chosen forum for disputes, and there is no reason for this arrangement to be different.
Ask three things and get them in writing: which legal entity signs, which law governs, and where disputes are heard. If the answer to the first is a company you cannot look up, that is a problem in any country. If the answer to the second and third is 'Lebanese courts', ask why, and expect a better option to be available.
IP assignment is the clause to read twice
In a staff augmentation or managed delivery arrangement, everything produced should be yours from the moment it is created, with a present assignment rather than a promise to assign later, covering code, designs, documentation and anything the individual contributors produce. The provider's contracts with its own people need to carry that through, because an assignment from a company that does not itself hold the rights is worth nothing.
Ask directly whether the people doing the work are employed by the provider or engaged as contractors, and how IP flows from them to the provider to you. A provider that has thought about this will answer in one paragraph. A provider that has not will change the subject to how trustworthy their team is.
Payment, said plainly
This is where the financial crisis is actually relevant to you, and it is more mundane than it sounds. The Lebanese banking sector is not a normal channel for international business at the moment, and providers structure around that. In practice that usually means invoicing in euro or US dollars to an account outside the affected domestic channels, with an entity and a bank your finance team can verify.
What you should require is simple: a proper invoice from a named entity, a payment route your finance function can process without an exception, and no request to route money through personal accounts or informal channels. That last one is not a Lebanon-specific rule, it is a rule, and it is a reasonable place to end a conversation.
Power and connectivity are a solved engineering problem
The grid does not supply full-time power, so buildings run generators. That has been the arrangement for a long time, and it is normal infrastructure rather than an emergency. For an office where people are doing your work, the arrangement should be generator backup plus battery or UPS for the transition, and more than one internet path so that a single provider's outage is an inconvenience rather than a stopped day.
This is checkable. Ask what the backup is, per site, and ask what happens when someone works from home. A provider who has genuinely solved it will describe the specific setup without being prompted twice.
Continuity is the real question, and it is about people
Infrastructure is the easy half. The harder half is what happens when a period of instability means an individual has a bad week, or when a road is closed, or when someone leaves. Those risks exist everywhere and are more likely in some places than others, and the mitigation is the same everywhere: no single point of failure that is a person.
- Named cover for every role, agreed at the start rather than improvised during the event
- Code, infrastructure and documentation in your accounts and your repositories throughout, never only in the provider's
- Access managed so that nothing is gated behind one individual's credentials
- An agreed communication protocol for a disruption: who tells you, how quickly, and through which channel
- Knowledge transfer treated as a running obligation rather than an exit clause
Read that list again and notice that none of it is Lebanon-specific. It is what a competent buyer should require of any supplier anywhere. The difference is that in some places you can get away with skipping it, and here you should not, which tends to produce a better-run engagement than the one you would have signed with a supplier in a comfortable jurisdiction.
Data protection, which is a separate exercise
Lebanon is outside the EU and is not covered by an adequacy decision, so any transfer of personal data is a Chapter V transfer under the GDPR. That means standard contractual clauses, a transfer impact assessment, and a data processing agreement that specifies what is processed, where, by whom and for how long, alongside the technical measures. This is work, it is well-trodden work, and it should be finished before the engagement starts rather than during it.
The alternative worth considering seriously is designing the engagement so the question is smaller: pseudonymised or synthetic data in development environments, production access restricted to named people under logged conditions, and personal data kept in EU-hosted systems the team reaches rather than copies. That is good practice regardless of jurisdiction and it shortens the compliance conversation considerably.
What a reasonable decision looks like
Do not decide about a country. Decide about a provider, with the country as one input among several. Require the same things you would require anywhere, plus explicit answers on power, connectivity, payment route and cover. Start with one bounded piece of work rather than a broad engagement, so that the diligence has a chance to be tested against reality at a small scale.
If the answers are specific and written down, you have an ordinary supplier relationship with an unusual cost base and a shared working day. If the answers are reassuring but vague, walk away, which is advice that would serve you equally well in Warsaw, Bangalore or Manchester.