Three things decide whether offshore work is safe for your company: a written assignment of the code to you, engineers who cannot reach real production data by default, and a data boundary that follows your regulator's rules. A security section in a proposal can say all three. A contract, an access log and a hosting diagram can show them.
Who owns the code, and from when
Ask for assignment to your company from the first commit. Do not accept transfer on final payment. Until payment, ownership is unsettled, and a payment dispute is the moment that matters.
Indian law adds a detail that catches buyers. According to section 19 of the Copyright Act, 1957, an assignment is valid only if it is in writing and signed, and it must state the rights assigned, their duration and the territory. Where the period is not stated, it is treated as five years from the date of assignment, and where the territory is not stated, the assignment is presumed to cover India. Source: Copyright Act 1957, section 19.
A short clause saying "all IP belongs to the client" may not name a term or a territory. Have your lawyer write both: the rights assigned, a term stated as perpetual, and the territory stated as worldwide.
Assign more than source code:
- Documentation and architecture decisions, with their reasons.
- Infrastructure definitions and deployment scripts.
- Prompts, evaluation sets and training data where AI is involved.
- Design files and test suites.
Every engineer on the project should also sign a personal confidentiality and assignment undertaking. The company-level clause then has individual paper behind it.
Access: what an engineer can reach
The useful question is what an engineer can open on an ordinary working day. Four controls answer it.
- No production data by default. Engineers build and test on masked or invented records. Real records open only through a named, time-limited, logged request with an approver and a reason.
- Least privilege. Each person gets the repositories and environments their task needs and nothing more.
- Review on movement. Access is checked when someone changes project, so permissions do not pile up.
- Revocation on exit. Access ends on the day a person leaves. A quarterly sweep leaves weeks of exposure.
The first control is the one teams drop, because masked data makes debugging slower. It is also the one an auditor asks about first, because it limits the damage of a breach.
Where the data sits
For regulated Indian companies, rules draw the line around the data, and a vendor's convenience does not.
Payment data. According to the Reserve Bank of India, payment system data must be stored only in India under its circular of 6 April 2018. Overseas processing is allowed only if the data is deleted abroad and brought back within one business day or 24 hours, whichever is earlier. Source: RBI FAQs on storage of payment system data.
Outsourced IT work. According to the RBI Master Direction on Outsourcing of Information Technology Services, effective 1 October 2023, agreements must give the regulated entity the right to audit the provider and its sub-contractors, and must recognise the regulator's authority to inspect them. Source: RBI Master Direction on Outsourcing of IT Services.
Personal data. According to the Press Information Bureau, the Digital Personal Data Protection Rules were notified in November 2025 with an 18-month phased timeline, and a failure to notify a breach can attract one of the larger penalties in the Act's Schedule. Source: PIB, DPDP Rules notified. A copy of customer data on a vendor's laptop is still your data, and your duty.
Incident reporting. According to the CERT-In Directions of 28 April 2022, listed cyber incidents must be reported within six hours of noticing them. Source: CERT-In Directions under section 70B(6). Your contract should oblige the vendor to tell you fast enough for you to meet that clock.
These texts point to one arrangement: keep the data where you host it, and let engineers log in. Work happens in your cloud account or data centre. The vendor holds a login, and never a copy. Cloud migration for Indian companies shows how the same rules shape hosting decisions.
Devices and workplace
Security policy only covers what sits inside the estate it describes. Ask where the engineers sit, on whose network, and on what managed devices. A managed laptop needs an encrypted disk, an automatic lock and a way to wipe it remotely. A team on personal machines and home connections sits outside every control the proposal lists.
Ask also whether the work stays with the people you interviewed. Subcontracted staff behind the named team change your risk, whatever the policy says.
Six checks to run before you sign
- Could an engineer export live records to a personal or work laptop, and which control prevents it?
- In which building does each engineer work, and which network do they use?
- Can you show last month's access log for a single named engineer?
- How soon after a resignation does that person's login stop working?
- In which country and under which contract will our data be processed?
- After an exit in month six, which items reach us, and within how many days?
Look for specific answers: a tool name, a document, a number of days. Compare two vendors on the same six questions.
Exit terms
Write the exit before the start.
- Source, documentation and infrastructure definitions handed over on request, not only at termination.
- A knowledge-transfer period of stated length, with named people.
- No dependence on the vendor's own tooling to build, test or deploy the system you own.
- Return or deletion of your data, with written confirmation.
- Credentials and cloud accounts held in your company's name from day one.
A company that holds its own repository and its own cloud accounts from the start can change vendor without asking permission. For how the models differ on control, see ODC, staff augmentation, BOT and GCC compared.
Questions buyers ask
Is a standard NDA enough?
An NDA protects confidential information. It does not assign the code. You need both: the NDA for what you share, and a signed assignment for what the vendor writes.
Does a security certificate settle the question?
A certificate shows that the vendor runs a managed security system and is audited against a standard. It does not show what your engineers can reach in your project. Ask for the access log as well.
Who is liable if a vendor engineer leaks data?
Under the DPDP Rules, the duty to protect and report sits with the company that collects the data. Write the vendor's duties, notice period and indemnity into the contract, and ask what insurance backs them.
Where Brihat Infotech fits
Brihat Infotech works in your repositories and your ticketing system, and your code sits in your own repository from the first commit. The company holds ISO/IEC 27001 and ISO 9001. See offshore delivery centres, or read the offshore engineering models guide.