Software Development Outsourcing: Models, Costs, and Vendor Selection
Software development outsourcing is hiring an outside firm to design, build, test, or maintain software under a contract that sets who directs the work, who owns the result, and who pays when estimates are wrong. Buyers choose one of four engagement models (a fixed-scope project, a dedicated team, staff augmentation, or a managed product) and one of three locations: onshore, nearshore, or offshore. Senior developers bill $60 to $75 an hour in Latin America and $31 to $41 in Asia in Accelerance's November 2025 survey, against $150 to $250 an hour at US onshore firms in BD Emerson's planning. For a regulated company the rate is one input, and oversight, rework, the exit, and whether your data may leave the country decide the rest.
This guide is vendor-neutral and written for insurers, banks, fintechs, and healthcare organizations. It compares the models and locations, sets out the rules that restrict offshore work, scores vendors, lists the contract terms that protect the buyer, and prices a build three ways.
Software development outsourcing models compared
The engagement model decides who directs the work and who carries delivery risk, and it shapes the outcome more than the vendor's size does. Four models cover nearly every contract.
| Model | How it is priced | Who directs the work | Who carries delivery risk | Best fit |
|---|---|---|---|---|
| Project-based, fixed scope | Fixed price or capped time and materials per release | The vendor, inside a scope you approve | The vendor, priced into the fee | A release that discovery has specified |
| Dedicated team | Monthly fee for a named team | You set priorities; the vendor manages the people | You for output, the vendor for staffing continuity | A long-running product with a roadmap |
| Staff augmentation | Hourly or daily rate per person | Your leads | You | A well-led team short on capacity or a skill |
| Managed product | Monthly or annual fee against service levels and a roadmap | The vendor, against outcomes you set | The vendor, for service levels and the run | A non-core product you want built and operated for you |
Fixed-scope pricing works only when the scope will hold, so our custom software development cost guide recommends capped time and materials for discovery and the first release, then fixed price for releases discovery has specified. A dedicated team suits a product that keeps changing, and it needs a product owner on your side every week. Staff augmentation leaves the architecture and the risk with you. A managed product moves the most to the vendor, including the run, and leaves you the least control over how the software evolves.
Onshore vs nearshore vs offshore software development
Onshore means a team in your own country, nearshore a team in a nearby country with overlapping hours, such as Latin America for US buyers, and offshore a distant one, such as Europe or Asia. Location changes the rate, the workday overlap, how the team communicates, and the legal terms that attach to your data.
| Factor | Onshore (US) | Nearshore (Latin America) | Offshore (Europe) | Offshore (Asia) |
|---|---|---|---|---|
| Senior developer rate | $150 to $250 at US firms (BD Emerson planning) | $60 to $75 | $64 to $76 | $31 to $41 |
| Junior developer rate | Firm rate cards vary | $33 to $45 | $31 to $39 | $24 to $31 |
| Hours from New York | 0 to 3 behind | Mexico City 1 to 2 behind; Bogotá 0 to 1 behind; São Paulo 1 to 2 ahead | Warsaw 5 to 6 ahead | Bengaluru 9.5 to 10.5 ahead; Manila 12 to 13 ahead |
| Overlap with a 9-to-5 Eastern day | Full day | 6 to 8 hours | 2 to 3 hours | None unless the team shifts its hours |
| Working pattern | Live meetings, easy site visits | Live collaboration most of the day | A morning handoff window | Written handoffs and overnight cycles |
The nearshore and offshore rates come from Accelerance's November 2025 summary of its 2026 rates guide, a survey of 60 software development partners that reports Latin American rates fell 7.1 percent in 2025; Accelerance helps companies choose outsourcing partners, so read them as vendor-reported. The onshore figure is a BD Emerson planning assumption that includes overhead and margin, set against a BLS median wage of $135,980 for software developers in May 2025, or $65.38 an hour. Overlap figures are our arithmetic from each city's time zone across the year, as of September 2026.
Rate gaps shrink when hours grow. A team at half the rate that needs 40 percent more hours saves 30 percent (0.5 × 1.4 = 0.7), and rework can erase even that. Nearshore buys overlap, which pays when product decisions happen daily. Offshore buys rate, which pays when the work is well specified and can move through written handoffs.
Security and compliance for regulated industries
Outsourcing moves the work to a vendor and leaves the obligations with you. In regulated industries, the rules decide where people may sit, what the contract must say, and how you watch the vendor after signing.
Where offshore access is restricted
Several rules limit offshore access to specific kinds of data. The Justice Department's Data Security Program, in effect since April 8, 2025 under 28 CFR Part 202, treats vendor and employment agreements that give a country of concern or a covered person access to bulk US sensitive personal data as restricted transactions, allowed only when they meet CISA's security requirements and the rule's other conditions. The countries of concern are China, including Hong Kong and Macau, Cuba, Iran, North Korea, Russia, and Venezuela, and the bulk thresholds include personal health or financial data on more than 10,000 US persons. IRS Publication 1075, the safeguards standard for agencies and contractors that receive federal tax information, adds a control enhancement restricting access, processing, storage, and transmission of that information to the United States and its territories. CMS's policy for work performed outside the US requires its contractors and subcontractors to get written approval, requested at least 45 calendar days ahead, before any work abroad, including access to or transmission of CMS data; as of September 2026 it does not apply to Medicare Part C and D plans. Your own customer contracts can add restrictions, so read them before you choose a location.
Third-party risk management obligations
Regulators expect you to vet and monitor the vendor as closely as your own team. The Interagency Guidance on Third-Party Relationships, final as of June 6, 2023, says a bank's use of third parties does not diminish its responsibility to operate safely and comply with the law, sets a life cycle of planning, due diligence, contract negotiation, ongoing monitoring, and termination, and lists foreign-based third parties among the factors to weigh. Non-bank financial institutions under the FTC's Safeguards Rule must select capable service providers, require safeguards by contract, and assess providers periodically under 16 CFR 314.4(f). New York's 23 NYCRR 500.11 requires covered entities to set guidelines for vendor access controls, including multifactor authentication, encryption, and notice of cybersecurity events. A vendor that creates, receives, maintains, or transmits protected health information for a covered entity is a business associate under 45 CFR 160.103, wherever its engineers sit. Our guide to vendor risk management covers running that program.
Data access controls that make outsourcing safer
Most of the risk sits in what the vendor can reach. Keep production data out of development, give the vendor synthetic or de-identified test data, route any production access through your accounts with time-limited approval, require managed devices or virtual desktops, and log every session. NIST's Secure Software Development Framework, SP 800-218, gives the vendor-side practices to ask about: separating and protecting development environments (PO.5.1), storing code under least privilege (PS.1.1), reviewing code (PW.7), and testing executable code for vulnerabilities (PW.8).
How to choose a software development outsourcing vendor
BD Emerson's method runs every vendor through four pass-fail gates before scoring anyone, because a vendor that fails a gate should never win on price. The weighted score then uses the eight criteria from our ranked shortlist of custom software development companies, with the evidence to request beside each.
| Gate | Pass if the vendor provides |
|---|---|
| Security evidence | A current SOC 2 Type 2 report whose scope covers the delivery centers and people on your work |
| Code ownership | An express written IP assignment, and repositories and cloud accounts in your name from day one |
| Data location | The country of every person with access, consistent with your regulations and customer contracts |
| Named team | Named leads with stated allocations and replacement terms |
| Criterion | Weight | Evidence to request |
|---|---|---|
| Regulated domain fit | 20% | Systems in production in your industry, and people who know your regulators |
| Delivery model and team continuity | 15% | Location mix, overlap hours, attrition, and replacement terms |
| Security and compliance evidence | 15% | SOC 2 Type 2 and ISO/IEC 27001 scope, penetration test summaries |
| Engineering practices | 15% | An SSDF mapping, automated testing, deployment frequency, change failure rate |
| AI-enabled delivery | 10% | A written policy on AI coding tools and how AI-written code is reviewed |
| IP and code ownership | 10% | The assignment clause, repository control, open-source terms |
| Pricing transparency | 10% | A rate card by role and estimates shown as roles, hours, rates, and weeks |
| References | 5% | Two clients with systems in production for 12 months or more, called without the vendor |
Score each finalist from 1 to 5 on every criterion, multiply by the weight, and add the results. Read the SOC 2 report itself, including its system description, to confirm your delivery team sits inside the boundary the auditor tested against the AICPA's Trust Services Criteria. Set the weights before proposals arrive, so nobody can bend them toward a favorite.
Contract terms that protect the buyer
The contract decides what you own and how you leave. Work with counsel on the language; the table gives the business terms to ask for.
| Term | What to ask for | What it prevents |
|---|---|---|
| IP assignment | An express written assignment of copyright and work product, with matching agreements from the vendor's staff and subcontractors | A vendor or contractor owning code you paid for |
| Repository ownership or source code escrow | Repositories, pipelines, and cloud accounts in your organization from day one; verified escrow deposits if the vendor hosts or licenses the platform | Losing access when a vendor fails, disputes an invoice, or exits |
| Acceptance criteria | Testable criteria per release, an acceptance window, and defect severity definitions | Disputes over what counts as done |
| Change control | Written change requests with cost and schedule impact, approved before work starts | Scope creep and surprise invoices |
| Warranties | A defect warranty period after acceptance and disclosure of every open-source license | Paying twice to fix what you bought |
| Security obligations | Your security requirements, SOC 2 Type 2 evidence, multifactor authentication, encryption, a stated incident notice deadline, and audit rights | A breach you learn about late or cannot investigate |
| Subcontracting and location | Prior written consent for any subcontractor or new country | People and places you never approved |
| Termination and transition | Termination for convenience, transition assistance at agreed rates, knowledge transfer deliverables, and return or deletion of data | Staying with a vendor because leaving costs too much |
Ownership needs the assignment. The Copyright Office's Circular 30 limits commissioned works made for hire to nine categories that rarely cover software, and 17 U.S.C. § 204(a) requires a transfer of copyright in writing, signed by the owner. Bank contracts should also cover the factors the interagency guidance lists for contract negotiation, including ownership and license, subcontracting, foreign-based third parties, and default and termination.
Hidden costs and a worked total cost example
The rate sets most of the cost, and four lines the rate leaves out move the total: extra hours for coordination, onboarding, and rework; your own oversight; travel; and the transition at exit. On the assumptions below, an offshore team costs 47 percent less than an all-onshore firm, and the gap narrows as coordination hours grow.
The example reuses the 8,960 engineering hours in our cost guide's worked example, seven people for 32 weeks, and its blended rates: $175 for an all-onshore firm and $120 for three onshore leads with four nearshore engineers. The offshore team pairs one onshore lead at $190 with six engineers at $36, the midpoint of Accelerance's senior range for Asia, for a $58 blend. Coordination and rework add 10 percent to nearshore hours and 30 percent offshore. Your oversight runs half, three quarters, or one and a quarter of a full-time person over the 32 weeks at about $95 an hour, the BLS median developer wage with benefits from its September 9, 2026 compensation release. A reserve of 5 percent of vendor labor covers knowledge transfer at exit. All of these are BD Emerson planning assumptions.
| Cost line | All-onshore firm | Onshore leads, nearshore team | Offshore team, onshore lead |
|---|---|---|---|
| Blended rate | $175 | $120 | $58 |
| Vendor hours | 8,960 | 9,856 (+10%) | 11,648 (+30%) |
| Vendor labor | $1,568,000 | $1,182,720 | $675,584 |
| Your oversight at $95 an hour | $60,800 (640 hours) | $91,200 (960 hours) | $152,000 (1,600 hours) |
| Travel | $0 | $20,000 | $40,000 |
| Transition reserve, 5% of labor | $78,400 | $59,136 | $33,779 |
| Total | $1,707,200 | $1,353,056 | $901,363 |
| Versus all-onshore | Baseline | 21% less | 47% less |
Holding oversight fixed, the offshore team stays cheaper than the nearshore blend until it needs more than 2.1 times the base hours, so on these inputs cost rarely decides the location. Three questions decide it instead: whether your data can lawfully go there, whether your product owner can write specifications a team 10 time zones away can build from, and whether your release schedule can absorb a feedback loop measured in days.
When to keep software development in-house
Keep work in-house when it is how you compete and changes every week, when it needs constant access to data your rules keep inside the company, or when the knowledge it creates is the asset. Outsource defined builds and non-core support, and decide whether to build at all before deciding who builds.
| Signal | Keep in-house | Outsource |
|---|---|---|
| The software differentiates you and changes weekly | Yes | Only for capacity under your architecture |
| Routine access to restricted production data | Yes | Only with US-based people under your access controls |
| A one-time build with a clear scope | Rarely | Yes, fixed scope or capped |
| Mature, non-core application support | Rarely | Yes, as a managed service |
| A commodity capability | No: buy it | No: buy it |
Companies move work back as they learn. In Deloitte's 2024 Global Outsourcing Survey of more than 500 executives, 70 percent had selectively insourced scope a third party used to handle over the previous five years, while 80 percent planned to maintain or increase their investment in third-party outsourcing. Before choosing who builds, decide whether to build: our build vs buy framework prices both paths over ten years.
Frequently asked questions
What is software development outsourcing? Software development outsourcing is hiring an outside firm to design, build, test, or maintain software under a contract that sets who directs the work, who owns the result, and who pays when estimates are wrong. The four common models are a fixed-scope project, a dedicated team, staff augmentation, and a managed product, delivered onshore, nearshore, or offshore.
How much does it cost to outsource software development? Rates depend on location. Accelerance's November 2025 survey puts senior developers at $60 to $75 an hour in Latin America, $64 to $76 in Europe, and $31 to $41 in Asia, while US onshore firms bill $150 to $250 an hour for senior engineers in BD Emerson's planning. Add your oversight, extra coordination hours, travel, and a transition reserve to reach total cost.
What is the difference between nearshore and offshore software development? Nearshore teams work in nearby countries with overlapping hours, such as Latin America for US buyers, which allows live collaboration most of the day. Offshore teams work in distant time zones, such as Asia, at lower rates, and rely on written handoffs and overnight cycles. Nearshore suits fast-changing products; offshore suits well-specified work.
Who owns the code when you outsource software development? You own it only if the contract assigns it to you. The Copyright Office's Circular 30 limits commissioned works made for hire to nine categories that rarely cover software, and a copyright transfer must be in writing and signed. Require an express assignment, matching agreements from the vendor's staff and subcontractors, and repositories in your name from day one.
Can regulated companies outsource software development offshore? Most can, within limits that depend on the data. The Justice Department's Data Security Program restricts vendor access by countries of concern to bulk US sensitive personal data, IRS Publication 1075 keeps federal tax information in the United States and its territories, and CMS requires approval before its contractors work abroad. Banks must also weigh foreign-based third parties under the 2023 interagency guidance.
How do I choose a software development outsourcing company? Run every vendor through pass-fail gates first: a SOC 2 Type 2 report covering its delivery centers, an express IP assignment with repositories in your name, the country of everyone with access, and named leads. Then score finalists on weighted criteria such as domain fit, delivery continuity, security evidence, engineering practices, AI policy, ownership terms, pricing transparency, and references.
What are the hidden costs of outsourcing software development? The largest are extra hours for coordination, onboarding, and rework, the time your product owner and architects spend directing and reviewing the vendor, travel, and the knowledge transfer you pay for at exit. In BD Emerson's worked example, those lines add $139,200 to an onshore build and $381,683 to an offshore one with the same base scope.
If you're weighing whether to outsource a regulated build, our custom software development team can run the gates and the scored comparison with your evaluation group, ourselves included, and price the build in roles, hours, and rates.
About the author
