I'd start by digging deeper on their requirement to see if it is absolutely crictial. Then it would be import to know what is really required to comply with the requirement. Can you just have a DB at their location and you'd still host the app remotely?

Assuming the above doesn't help, there are a few sets of questions that should be answered.

Infrastructure and local support resources: - Will you be deploying hardware to their site or do they already have existing infrastructure?

- Do they have internal resources to maintain either scenario above?

- Will your support be limited to just to your software if they don't have internal hardware support?

- Does the app need to function "offline" from the internet?

- Do they have external users who will need access to the app?

Commercial: - Will your commercial arrangement be a typical Saas with a regular fee? Or they now expect to have perpetual ownership of a license?

- How will you protect your IP?

- Will they accept a lower SLA?