Due diligence on an offshore development partner
The questions that only apply when the team is in another country: who employs them, whose law governs the work, whether the IP actually reaches you, and what the hours really overlap.
An offshore engagement is a services contract with three extra problems attached — a border, a time zone and an employment relationship you do not control. The commercial questions are the same as for any supplier; this list covers only what changes because the team is somewhere else. Use it alongside the IT services provider checklist, not instead of it.
Who actually employs the team
This determines who is liable for what, and it is the question most often answered vaguely.
Are the people employees of the supplier, contractors, or engaged through an employer of record?
Deal-stopperEach model puts obligations and risks in a different place. A contractor network presented as an in-house team is the most common misrepresentation in this market.
Ask for: A written statement of the model for each person on your team.
Red flags
- Model varies per person and was not volunteered
- 'Our team' turns out to be freelancers
- Supplier cannot say
How does the IP get from the individual developer to us?
Deal-stopperThis is the single most expensive thing to get wrong. In several jurisdictions work product vests in the individual unless assigned in writing, so if the supplier has no assignment from its own contractors, it has nothing to assign to you.
Ask for: Confirmation that every individual has a written present assignment to the supplier, and the supplier assigns onward to you.
Red flags
- Assignment only in the supplier's client contract
- Contractors sign nothing
- Assignment governed by a law where it may not be effective
If these are contractors, who carries the misclassification risk?
ImportantLong-running full-time contractors managed like employees attract scrutiny in many jurisdictions, and the liability does not always stop at the supplier.
Ask for: An indemnity, and the supplier's own account of how it manages the risk.
Red flags
- Risk passed to you
- No indemnity
- Question not understood
What background checks are run, and are they possible in that jurisdiction?
ImportantChecks that are standard in one country are unavailable or unlawful in another. What matters is that the supplier knows which applies.
Ask for: The check policy, and what it covers where your team sits.
Red flags
- Checks claimed but not evidenced
- Policy copied from another market
Law, data and enforcement
Cheap to settle now. Close to unenforceable later if you did not.
Which law governs the contract, and where would a dispute be heard?
Deal-stopperA favourable clause you cannot afford to enforce is not protection. Ask what it would actually take to bring a claim.
Ask for: Governing law and jurisdiction clauses, and whether judgments are enforceable where the supplier's assets are.
Red flags
- Jurisdiction where enforcement is impractical
- Arbitration in a costly third country
- Supplier holds no assets in the named jurisdiction
What lawful basis covers personal data moving to that country?
Deal-stopperTransfers out of the UK or EEA need a mechanism — adequacy, standard contractual clauses with a transfer risk assessment, or another route. It is your obligation, not the supplier's.
Ask for: A DPA with the transfer mechanism attached, and the assessment where one is required.
Red flags
- Transfers unaddressed
- Assumption that a DPA alone is sufficient
- Data location differs from the contracting country
From where will our systems be accessed, and on whose devices?
Deal-stopperThe contracting country, the delivery country and the country someone is working from can all differ, and remote work has made the third increasingly common.
Ask for: Named locations, a device policy, and whether access from other countries is permitted.
Red flags
- Personal devices
- Work from unnamed countries permitted
- No device management
Has the entity and its ownership been screened against sanctions lists?
ImportantOwnership is not always obvious from the trading name, and the obligation to check sits with you.
Ask for: Ownership details, screened yourself against the applicable lists.
Red flags
- Ownership opaque
- Entity or owners in a restricted jurisdiction
How it works day to day
The practical questions that decide whether the arrangement is pleasant or exhausting.
How many hours a day genuinely overlap with our working day, and is that contractual?
Deal-stopperFour hours of overlap and two are very different engagements. Suppliers quote the best case; ask for the committed minimum.
Ask for: Committed working hours in the supplier's local time, converted to yours, written into the contract.
Red flags
- Overlap described as flexible
- Overlap depends on individual goodwill
- Under three hours for collaborative work
Which public holidays apply, and how much notice do we get?
Worth askingHoliday calendars differ substantially between countries, and a run of them lands in the middle of a sprint you planned without knowing.
Ask for: The local holiday calendar for the next twelve months.
Red flags
- Calendar not supplied
- Holidays taken without notice
Have we spoken, unscripted, to the people who will do the work?
Deal-stopperWritten English in a proposal tells you about the person who wrote the proposal. A live conversation with the actual team is the only test that matters.
Ask for: An unscripted call with each named team member.
Red flags
- Only account managers made available
- Interviews declined
- Interviewed team differs from allocated team
Who do we call when something is wrong, and in which time zone are they?
ImportantAn escalation path that is asleep during your incident is not an escalation path.
Ask for: A named escalation contact with hours and a response commitment.
Red flags
- Escalation only through the account manager
- No out-of-hours route
Payment and exit
Cross-border engagements add costs and frictions that do not exist domestically.
Which currency, and who carries the exchange risk?
ImportantA rate that moves ten per cent over a year changes the price of a long engagement materially, and the contract decides which side absorbs it.
Ask for: The currency clause and any rate adjustment mechanism.
Red flags
- Rate adjusted at the supplier's discretion
- Currency differs from the one you budgeted
Is withholding tax due on these payments, and is there a treaty?
ImportantIt can add materially to the cost and is usually discovered after the first invoice.
Ask for: Advice on the treaty position for the two countries involved.
Red flags
- Not considered by either side
What handover do we get if we end this, and is it paid for already?
Deal-stopperKnowledge concentrated in a team you no longer employ is the real lock-in in offshore work — greater than any contractual one.
Ask for: A defined handover period, documentation standards maintained throughout, and whether handover is inside the rate or billed extra.
Red flags
- No handover obligation
- Documentation promised at the end rather than kept current
- Handover charged at a premium
Are we allowed to hire the people directly, and at what cost?
ImportantSome suppliers forbid it outright, some charge a fee. It matters if the engagement works well and you want to keep the team.
Ask for: The non-solicitation clause with any buyout figure.
Red flags
- Perpetual restriction
- Buyout unstated
- Restriction extends to people who left the supplier
This checklist is general guidance, not legal, security or financial advice, and it does not replace your own advisers on anything contentious. It was last reviewed on 19 September 2026. Tell us if something here is wrong or missing.