NNasaq Training Centre

ShadoApps Services العربيةWork sample · fictional client

Software Requirements Specification

Enrolment, payment, attendance and certificates platform

A mobile-first web platform that moves the trainee journey at a private training centre in Riyadh out of WhatsApp threads, bank transfers and Excel files, and into one place: enrolment, payment, attendance and certificates.

Version: 1.0
Date: Sep 2026
Status: Ready for sign-off
Prepared by: ShadoApps

Interactive prototype: 11 screens covering the whole trainee journey, plus the instructor and admin views. Open it on your phone.

Open the prototype

1Executive summary

Nasaq runs about 12 courses a month, with an average of 15 trainees per course. Every enrolment today passes through a WhatsApp thread, a bank transfer matched by hand, a receipt sent as a photo, then a paper attendance register and a certificate laid out by hand in Word.

This document specifies a first release (MVP) that covers the journey end to end: the trainee finds the course, enrols from a phone, pays by mada or Apple Pay, receives a tax invoice, attends against a QR ticket, and receives a certificate carrying a verification code. The initial estimate is 485–685 development hours, or 8–12 weeks for a team of two developers.

2Current state and objectives

Problem today	Impact	Objective in release 1
Enrolment through WhatsApp threads	Enquiries are lost, and one enrolment takes a full day	Self-service enrolment in under 5 minutes
Bank transfer matched by hand	Seats are confirmed late, and revenue figures carry errors	Immediate confirmation once payment clears, with no staff step
Seats held without payment	Held seats that never convert, and high absence	A seat hold tied to a payment deadline
Paper attendance registers	Attendance is hard to prove when the certificate is issued	A digital attendance register for every session
Certificates laid out by hand	3–5 days' delay, and no way to verify them	Certificate within 24 hours of the last session, with a public verification code

Assumption

The current figures (12 courses a month, 15 trainees per course) come from the discovery session and are to be reviewed with centre management before sign-off.

3Users and roles

Role	What they do in the platform	Channel
Visitor	Browses the course catalogue, the schedule and the prices	Phone and desktop browser
Trainee	Enrols, pays, shows attendance tickets, downloads invoices and certificates	Phone first
Instructor	Marks attendance for their own sessions and sees the trainee list	Phone, in the classroom
Registrar	Manages courses, cohorts, enrolments and refunds	Admin console on desktop
Centre director	Reviews the reports and approves exceptions	Admin console

Role-based access control (RBAC): an instructor never sees payment data, and a registrar cannot amend attendance after a session is closed without a recorded reason.

4Release 1 scope (MoSCoW)

MustRequired for launch

Course catalogue with search and filters
Course page with cohort dates and seats remaining
Account on a mobile number with a one-time passcode (OTP)
Enrolment with a temporary seat hold
Payment by mada, Apple Pay and cards
Simplified tax invoice, reported to Fatoora
"My courses" and a QR attendance ticket
Attendance marked by the instructor
Certificates with a public verification code
Admin console for courses, cohorts, enrolments and refunds
Occupancy, revenue and attendance reports
SMS notifications

ShouldImportant, not a launch condition

Instalment plans through Tabby or Tamara
Waitlist for full cohorts
Corporate clients enrolling their staff in one batch
Reminders over WhatsApp
English interface
Discount codes

CouldIf time allows

Course and instructor ratings
Hijri date shown alongside Gregorian
One-tap certificate sharing to LinkedIn

Won'tNot in release 1

Online learning content (LMS)
Native mobile apps; an installable web app (PWA) is enough
Integration with government training systems

5Functional requirements

Story format: "As a… I want… so that…". Acceptance criteria are written as Given / When / Then.

Catalogue CAT

US-01

As a visitor, I want to browse courses by field, month and time of day, so that I find a course that fits my schedule.

Must

Given there are published courses, when I pick the field "Technology" and the month of October, then the list shows only the matching courses, each with the price inclusive of VAT and the seats remaining.

Given every cohort of a course is full, then the card reads "Full" and no enrol button is shown.

US-02

As a visitor, I want to see the course detail (topics, instructor, cohorts, programme accreditation number), so that I can decide before I pay.

Must

Account and enrolment REG

US-03

As a trainee, I want to sign in with my mobile number and a one-time passcode instead of a password, so that I can enrol quickly.

Must

Given a Saudi mobile number in the form 05XXXXXXXX and my consent to the privacy notice, when I request the code, then a 4-digit code reaches me by SMS and stays valid for 5 minutes.

When I enter a wrong code 3 times, then the request is blocked for 15 minutes and a message states when I may try again.

US-04

As a trainee, I want to hold a seat in a named cohort, so that my place is kept while I complete payment.

Must

When I tap "Enrol now", then the seat is held for me for 15 minutes with a visible countdown (BR-02).

Given I am already enrolled in the same cohort, then the system blocks the duplicate enrolment and shows me the existing one.

Payment and invoicing PAY

US-05

As a trainee, I want to pay by mada, Apple Pay or credit card, so that my enrolment is confirmed at once.

Must

When payment succeeds, then the enrolment status becomes Confirmed, a simplified tax invoice is issued, and an SMS with the details reaches me.

When payment fails, then a message explains why and offers another method, and the seat stays held until the deadline runs out.

US-06

As a finance officer, I want a simplified tax invoice issued for every payment and reported to Fatoora, so that the centre meets its e-invoicing obligations.

Must

When the invoice is issued, then it carries a serial number, a QR code, the centre's VAT registration number, the amount before VAT, VAT at 15% and the total, and it is reported to the platform within 24 hours.

US-07

As a trainee, I want to pay the course fee over instalments, so that I can enrol on the higher-priced courses.

Should

Attendance ATT

US-08

As a trainee, I want a QR attendance ticket in "My courses", so that I can enter the classroom without signing a paper register.

Must

US-09

As an instructor, I want to mark attendance by scanning the ticket or by hand from the list, so that every trainee is recorded for every session.

Must

Given the session is today, when I scan a valid ticket, then the trainee is marked Present and the counter goes up.

When attendance is amended by hand after the session is closed, then the system asks for a reason and writes it to the audit trail (BR-08).

Certificates CRT

US-10

As a trainee, I want my certificate issued automatically after the last session, so that I can use it in my CV straight away.

Must

Given my attendance is 80% or more (BR-04), when the last session is closed, then a PDF certificate is issued within 24 hours, carrying a verification code and the programme accreditation number.

When anyone opens the verification link, then the page shows the name, the course and the issue date only, and nothing else.

Administration and reporting ADM

US-11

As a registrar, I want to create cohorts and set the instructor, classroom, seat capacity, minimum enrolment and dates, so that they can be published for enrolment straight away.

Must

US-12

As a registrar, I want to cancel an enrolment and refund it under the policy, or move the trainee to another cohort, so that I can settle requests without going back to the accountant.

Must

When I cancel an enrolment, then the system calculates the refund automatically under BR-03, issues a credit note, and releases the seat.

US-13

As a centre director, I want occupancy, revenue and attendance reports for every course and cohort, so that I can decide which courses to repeat and which to stop.

Must

US-14

As a trainee, I want a reminder 24 hours before the first session, so that I do not forget the time or the place.

Must

6Business rules

Id	Rule
BR-01	Prices are shown inclusive of VAT at 15%. The invoice separates the amount before VAT from the VAT amount.
BR-02	A seat is held for 15 minutes during payment, then released automatically if payment is not completed.
BR-03	Cancellation 7 days or more before the cohort starts: full refund. Between 3 and 6 days: 50% refund. Less than 3 days: no refund, with one free move to another cohort.
BR-04	A certificate is issued to a trainee who attends 80% or more of the cohort's sessions.
BR-05	When a cohort is full, a waitlist opens. If a seat is released, the first person on the list is notified and has 12 hours to complete payment.
BR-06	If enrolments do not reach the minimum 5 days before the start date, the cohort is cancelled and everyone is refunded in full.
BR-07	The mobile number is the trainee's primary identifier. Two accounts cannot share one number.
BR-08	Every manual change to attendance or payments is written to the audit trail with the user, the time and the reason, and cannot be deleted.

Assumption

The refund tiers in BR-03 and the attendance threshold in BR-04 are proposals. Centre management signs them off before development starts.

7Data model and enrolment lifecycle

The enrolment is the central entity: it links a trainee to a cohort, and payments, attendance and the certificate all hang off it.

Entity	Key fields	Relationships
Course	Title, field, hours, price, programme accreditation number, status	Has many cohorts
Cohort	Course, instructor, classroom, time of day, seat capacity, minimum enrolment, status	Has many sessions and many enrolments
Session	Cohort, date, start and end time, status (open / closed)	Attendance is marked against it
Trainee	Name, mobile, email, consents and the date given	Has many enrolments
Enrolment	Trainee, cohort, status, hold expiry, source	Has payments, attendance records and at most one certificate
Payment	Enrolment, amount, method, gateway reference, status	Has one invoice, and may have a credit note
Invoice	Serial number, amount before VAT, VAT, QR, Fatoora reporting status	Belongs to one payment
Attendance	Enrolment, session, status, method (QR / manual)	One record per trainee per session
Certificate	Enrolment, certificate serial, issue date, PDF link	Belongs to one enrolment
Audit trail	User, action, entity, value before and after, reason, time	Cannot be amended

Enrolment lifecycle

Seat heldConfirmedCompletedThe normal path: payment, then attendance through to the end

Seat heldHold expiredPayment not completed within 15 minutes

ConfirmedCancelledRefund under BR-03, or cohort cancellation under BR-06

ConfirmedMovedConfirmed (another cohort)

8Non-functional requirements and compliance

Id	Area	Requirement
NFR-01	Performance	The catalogue and course pages shall load in under two seconds on a 4G connection.
NFR-02	Availability	99.5% monthly, with a daily backup retained for 30 days.
NFR-03	Security	Sign-in by one-time passcode, permissions by role, and encryption in transit and at rest. Card data shall never be stored in the platform; the payment gateway holds it.
NFR-04	Personal data protection	Explicit consent and a privacy notice in Arabic and English at the point of collection. Collect the minimum data needed. Support access, correction and deletion requests. A documented procedure for reporting any breach within 72 hours.
NFR-05	Hosting	A data centre inside the Kingdom is preferred, to avoid the conditions attached to transferring personal data abroad.
NFR-06	Language and interface	Arabic right-to-left first, designed mobile first, with colour contrast meeting WCAG AA.
NFR-07	Auditability	An audit trail for every payment, refund and manual attendance action, as set out in BR-08.

Reference · Personal Data Protection Law

PDPL (Personal Data Protection Law) came fully into force on 14 Sep 2024. Its main obligations: consent as the default basis for processing, a clear notice at the point of collection, notification of the Saudi Data and AI Authority (SDAIA) of any breach within 72 hours, and controls on transferring data outside the Kingdom.

9Integrations

Integration	Purpose	Priority	Notes
Locally licensed payment gateway	mada, Apple Pay, cards	Must	Candidates: Moyasar, HyperPay, PayTabs, Tap. mada requires a gateway licensed inside the Kingdom.
Fatoora	Reporting simplified tax invoices	Must	Depends on where the centre stands on e-invoicing Phase 2.
Local SMS provider	One-time passcodes and notifications	Must	Under a sender name registered to the centre.
Tabby / Tamara	Instalment plans	Should	Some gateways support them directly, HyperPay among them.
WhatsApp Business API	Reminders	Should	Using approved message templates.

Reference · e-invoicing

Wave 24 of the integration phase (Phase 2) covers businesses whose taxable revenue exceeded SAR 375,000 in 2022, 2023 or 2024, with a compliance date of 30 Jun 2026.

Reference · mada

Processing mada payments requires a gateway licensed by the Saudi Central Bank (SAMA), and testing with mada test cards, not Visa alone.

10Out of scope

Any online learning content, or live streaming of sessions.
Native iOS and Android apps.
Integration with government training or subsidy systems.
The centre's general accounting. The platform issues invoices and exports revenue reports, nothing more.
Instructor payroll.

11Delivery plan and effort estimate

Module	Phase	Hours (low – high)
Design and user interfaces, starting from the prototype	1	40 – 60
Accounts, one-time passcode and permissions	1	30 – 40
Catalogue and course page	1	30 – 40
Enrolment and the seat hold	1	40 – 50
Payment gateway integration	1	40 – 60
Invoicing and the Fatoora connection	2	50 – 80
Attendance and QR tickets	2	30 – 40
Certificates and the verification page	2	25 – 35
Admin console (courses, cohorts, enrolments, refunds)	1–3	80 – 110
Reporting	3	25 – 35
SMS notifications	2	15 – 25
Testing and QA	1–3	60 – 80
Deployment, configuration and launch	3	20 – 30
Total		485 – 685

Phase	Weeks	Outcome
1 · Foundation	1–4	The trainee browses, enrols and pays; the centre publishes its courses.
2 · Operations	5–8	Invoicing, attendance, certificates and notifications are working.
3 · Launch	9–12	Admin console complete, reporting, acceptance testing, launch.

Assumption

The estimate covers Must requirements only, for a team of two full-time developers with a part-time tester. Should requirements are estimated once this document is signed off. The schedule excludes opening the merchant account with the payment gateway.

12Risks and open questions

Item	Type	Proposed action
Is the centre in scope for e-invoicing Phase 2?	Open question	Confirm with the centre's accountant before phase 2.
Are all programmes accredited by TVTC?	Open question	Collect the accreditation numbers; they are printed on the certificate.
Delay in opening the merchant account with the payment gateway	Risk	Start the paperwork as soon as this document is signed off, in parallel with development.
Volume of corporate enrolment	Open question	If it is more than a quarter of revenue, raise its priority to Must.
Collecting the national ID or iqama number	Open question	Do not collect it unless the certificate requires it, keeping to data minimisation.

Reference · Programme accreditation

TVTC (Technical and Vocational Training Corporation) licenses private training centres and accredits their programmes. An accredited programme is one whose certificate is recognised in the labour market. The system therefore stores each programme's accreditation number and prints it on the certificate.

13Appendix: prototype screens

S01Courses S02Course detail S03Sign in by mobile S04One-time passcode S05Enrolment summary and payment S06Confirmation and invoice S07My courses S08Attendance ticket S09Certificate S10Instructor: attendance S11Admin: cohort