NDA signed the same working day
Secure software development: your IP, your repositories, an NDA before the details, and the controls we run.
Outsourcing software development means handing a company abroad your idea, your customer data and your competitive advantage. This page is written for the two people who worry about that: the founder who wants to know who owns the code, and the security reviewer who has a questionnaire to fill in. Everything is in your name from day one, the NDA comes before the details, and you never need anything from us to keep running.
Fire us on Friday and ship on Monday. That is the whole test, and every section below is a way of passing it.
100%
IP assigned to you
0
Subcontractors, ever
1 day
To a signed NDA
5 days
To a clean exit
Get your free estimate
Three quick questions: scope, approach and a price range back within 48 hours. No sales call required first.
Trusted by companies worldwide
- Bloomford
- Contractor Plus, Inc.
- Snappy Stats
- Ad Lunam
- Local Buzz
- CyberFind
- Hellory
- 5.0Clutch · 8 client reviews
- 4.9Google · 18 reviews
- Top ratedUpwork · 100+ reviews · 5K+ hours worked
- TopTracker7K+ hours tracked with clients
Intellectual property
Who owns the code: intellectual property ownership in outsourced software development.
Under copyright law the author owns the code unless a contract says otherwise, and plenty of agencies leave it at "you own the code" in a sales deck. Four things make ownership real rather than stated, and all four are in place before the first commit.
Repositories in your name
GitHub, GitLab or Bitbucket under your organisation from day one. We are collaborators on your repository, never the other way round, and every commit is yours the moment it lands.
From the first commit
Cloud accounts in your name
AWS, DigitalOcean or whichever provider, billed to you and owned by you. We hold a scoped IAM role that you can revoke in one click; we never hold the root.
You hold the root
No proprietary framework
Everything is standard Laravel, Node.js, React, Next.js or Flutter. There is no QalbIT runtime, licence or plugin you would have to keep paying for or migrate off.
Nothing to leave behind
Written IP assignment
The master services agreement assigns all work product to you on creation, not on final payment and not on project completion. Code written this morning is yours this morning.
On creation
Confidentiality
How the NDA for software development actually works.
Signed before the details, mutual by default, binding on everyone who touches your project, and still in force long after it ends. An NDA protects what you tell us; the IP clause in the contract protects what we build. You get both.
NDA before the details
Send yours or use ours. Signed before you share a spec, a repository or a customer list, usually the same working day.
Day zero
Mutual by default
Ours is two-way. You are protected, and so is anything we tell you about our own methods and tooling.
Two-way
Covers the whole team
Every engineer, designer and QA on your project is bound by the same confidentiality terms through their employment contract with us.
Everyone
Survives the engagement
Confidentiality obligations continue after the project ends. The standard term is three years, longer on request.
3 years+
Day one
Day one, in your name.
Before a line of code is written, four things are already yours.
The first working day of every engagement is the same, whatever the model. The NDA is signed. The repository is created under your organisation and we are invited in. The cloud account is opened in your name with your card on it and we are given a scoped role. The vault is yours and our access is time-limited. Only then does anyone open an editor.
What you see
A repository with your name at the top and our commits underneath it, a cloud bill addressed to you, a vault you can lock us out of, and a signed NDA in your inbox.
NDA
Signed, mutual, three years after the end
Repository
Your organisation, us as collaborators
Cloud
Your account, your card, our scoped role
Vault
Your secrets, our time-limited access
- GitHub
- GitLab
- AWS
- 1Password
- Vault
Security practice
Secure software development practices we run on every project.
Not a certification badge: the actual working practices your security reviewer will ask about, written out so you can hand this page straight to them. Five groups, twenty controls, no exceptions by project size.
Access & identity
Access & identity
- Least-privilege access: engineers get only the systems their task needs
- Two-factor authentication mandatory on every account and repository
- Access reviewed at every sprint boundary and revoked on rotation off
- Shared credentials never used; secrets live in a managed vault
Code & delivery
Code & delivery
- Peer review required on every pull request before merge
- Dependency and vulnerability scanning in CI on every build
- Secrets never committed: enforced by automated pre-commit checks
- Staged releases with a documented rollback path
Application security
Application security
- Built against the OWASP Top 10: injection, broken auth, exposed data, misconfiguration
- Threat model written at design time for anything that touches money, identity or health data
- Server-side validation, rate limiting and audit logs on every authenticated API
- Role-based access control designed in, not bolted on after launch
Data handling
Data handling
- Production data never copied to a developer machine
- Anonymised or synthetic data used in staging and test environments
- Encryption in transit and at rest as standard on every project
- Data residency configured to your jurisdiction where required
People & premises
People & premises
- One office, one team: no subcontractors and no offshore chain
- Background checks and signed confidentiality on every hire
- Company-managed devices with disk encryption and remote wipe
- Physical access to the office controlled and logged
Who holds what
Who holds what
Everything is in your name before the first commit. We are collaborators on your repository, never the owner of it.
Source code repository
GitHub / GitLab under your org
You hold: Owner + admin · We hold: Commit access
Cloud accounts
AWS, DigitalOcean, billed to you
You hold: Root account · We hold: Scoped IAM role
Intellectual property
Assigned on creation, not on payment
You hold: Assigned to you · We hold: No claim
Credentials & secrets
Your vault, our scoped access
You hold: Your vault · We hold: Scoped, time-limited
Architecture documentation
Written decisions, kept current
You hold: Shared drive · We hold: Write access
Secure SDLC
A secure software development lifecycle, phase by phase.
Security is not a phase at the end; it is a set of checks that run at each one. Here is what happens at every stage of a QalbIT build, so a reviewer can map it to their own framework, and it sits on top of how a build runs week by week.
Scope
Data classified, roles and permissions listed, jurisdictions named. Anything that touches money, identity or health gets a written threat model, and that pass runs identically across the three ways to engage us.
Before the quote
Design
Authentication, authorisation and data flows drawn before screens. Third-party services reviewed for what they will hold and where.
Week 1–2
Build
Peer-reviewed pull requests, secrets scanning, dependency and vulnerability checks on every CI run. Nothing merges with a critical finding open.
Every sprint
Test
Automated tests on the paths that matter, an OWASP Top 10 pass on every authenticated surface, and your penetration testers welcome before launch.
Before each release
Release
Staged rollout with a rollback path, production secrets in your vault, monitoring and alerting handed to you with the runbook.
Launch week
Operate
Dependency updates on a schedule, access reviewed each sprint, an incident process that names who calls whom, and an honest post-mortem if it is ever needed.
Ongoing
Data protection
Where your data lives, who can see it, and what happens if something goes wrong.
The four questions every data-protection review comes down to, answered without a policy document in the way.
Where it lives
In your cloud account, in the region you choose. We do not run a copy of your production data anywhere of ours, and we do not use subprocessors: there is no third company in the chain.
Your account, your region
Who can see it
The engineers on your project, through scoped credentials you issue and can revoke. Development and staging run on anonymised or synthetic data, never a production export.
Named engineers only
How it is protected
Encrypted in transit and at rest, backed up on a schedule you sign off, with retention and deletion rules written into the scope rather than left to defaults.
Encrypted, backed up
If something goes wrong
You hear from us first, within 24 hours of us knowing, with what happened, what is affected and what we are doing. That is inside the 72-hour window GDPR gives you, with time to spare.
Notified within 24 hours
Security review
Your vendor security questionnaire, answered before you send it.
The questions that appear on nearly every vendor security review, our answer to each, and the evidence we hand over so nobody has to take our word for it.
| The question | Our answer | The evidence you get |
|---|---|---|
| Who owns the source code? | You, on creation, in your own repository | The signed MSA with the IP clause; the repository settings |
| Who has access to our systems? | Named engineers on your project, via credentials you issue | The access list, reviewed each sprint, with revocation dates |
| Do you use subcontractors? | No. One office, employees only | Our employee register for the project team, on request |
| How are secrets handled? | In your vault; never in code, chat or email | Pre-commit scanning config and CI logs |
| Do you scan dependencies? | On every CI build, with critical findings blocking merge | The pipeline definition and a recent scan report |
| Are you ISO 27001 or SOC 2 certified? | No. We adopt your controls and evidence needs | This page, and completed questionnaires from prior reviews |
| What happens to our data when we leave? | Access revoked and copies destroyed within five working days | Written confirmation of both, signed |
| Do our code or data go into AI tools? | Not for training. Tools run on business plans with training off; secrets and production data never enter them | The tool list and its data settings; opt-out on request |
Compliance
Compliance: honest about what we hold, and what we build to.
We are not ISO 27001 or SOC 2 certified. We work inside clients who are, adopt their controls and evidence needs, and would rather say that plainly than imply a certificate we do not have. What we do build to, every time, is below.
GDPR and DPDP-aware delivery
Data minimisation, retention rules, consent records and subject-access mechanics designed in for EU and UK users under GDPR and for Indian users under the DPDP Act, and named in the scope where they apply.
Client-led compliance
Working under HIPAA, SOC 2, ISO 27001 or PCI DSS requirements? We adopt your controls, fill in your evidence requests and keep card data out of scope by design, rather than asking you to adopt our framework.
Independent testing welcome
Bring your own penetration testers or auditors. We fix what they find, give them direct access to the engineers, not a ticket queue, and re-test before we call it closed.
If you leave
Fire us on Friday. Ship on Monday.
You should never have to ask us for anything to keep running. Here is what happens in the five working days after you tell us it is over, whatever the reason.
You say so, in writing
An email is enough. No exit meeting, no retention call, no invoice you did not already have.
Day 0
Access comes off
Repository, cloud, vault and tooling access revoked from our side, and you revoke from yours. Nothing of yours was ever on a machine you do not control.
Day 1
The handover pack lands
Architecture decisions, environment notes, the runbook, open items and the last sprint report, written so the next team can read it cold.
Day 3
Written confirmation
A signed note that access is revoked and working copies destroyed. Your confidentiality terms stay in force for three years after it.
Day 5
Our clients · reviews
Teams who trusted QalbIT
Short feedback from clients and products we work on across web, mobile, SaaS and internal tools.
- Testimonials from long-term custom software development and SaaS product clients.
- Covers ERP systems, B2B marketplaces, booking platforms, and web & mobile app development projects.
- Real text and video reviews from founders, CTOs, and product teams who partnered with QalbIT for delivery.
Video review
Rated 5 out of 5.“I would recommend QalbIT to everybody. QalbIT has been developing all my front-end & backend systems complete to my requirements. They have excellent technical knowledge and listen very well to the needs of their customers. And above all, they are great people.”
Wouter SantensExecutive Search Consultant · Bloomford Written review
Rated 5 out of 5.“Excellent work! QalbIT team delivered the project on time, with great quality. Their ability to quickly adapt to new requirements and deliver promptly was impressive. Highly recommend them for Flutter projects.”
Ahmed GFounder at Local Buzz · Consumer app / local discovery
Video review
Rated 5 out of 5.“QalbIT quickly integrated four payment platforms: Square, Stripe, PayPal and Coinbase. Active communication, timely deadlines despite research-heavy work, plus post-launch support.”
Roshan SethiaCTO · Contractor Plus, Inc. Written review
Rated 5 out of 5.“They took a half-finished marketplace, stabilised it, and shipped the modules we actually needed first. The weekly demos meant nothing came as a surprise.”
Abhishek P.Product Lead · B2B marketplace
Written review
Rated 5 out of 5.“QalbIT is a fantastic dev partner. They provide quality work, good communication and go above and beyond. Fantastic work delivered by QalbIT and his team. Can’t give enough credits with regards to how they work and at which speed they do it. Top team.”
Joost HesselberthFounder · Ad Lunam
Built this way, whatever we build
Software development services at a glance.
From MVPs to long-term platforms, combine our core and specialised services to design, build and grow products that match how your business really works.
Start here
Get the NDA and the scope together.
Tell us roughly what you are building. The mutual NDA comes back the same day, and the written scope follows within 48 hours.
Start here
Get the NDA and the scope together.
Tell us roughly what you are building. The mutual NDA comes back the same day, and the written scope follows within 48 hours.
- Mutual NDA, signed before any detail
- IP assigned to you on creation
- Your repositories, your cloud accounts
- Our security practice in writing for your reviewer
FAQs · IP, NDA & security
The questions your legal and security teams will ask
Ownership, the NDA, access, certification, AI tools, incidents and what happens to your data when the engagement ends.
Ask us directly →Next step
Send the NDA. Then we talk.
Yours or ours, signed the same working day. Nothing sensitive gets discussed before it is in place.