What you are actually buying

You are buying two things. A working system, and the ability to keep it working after the people who built it have moved on. Most buyers assess the first and assume the second.

That assumption is where projects fall over in year two. The build lands, the team rotates, the engineer who understood the payment reconciliation logic leaves, and nobody wrote it down. Every change after that costs three times what it should.

So the first thing to check is not a portfolio. It is continuity. Who writes your code, how long they have been there, what happens when they leave, and whether you can read the repository on day one.

The eleven point evaluation checklist

Ask these eleven on the first call, before anyone opens a deck. The wording matters more than the answer. Vendors who have done this answer in specifics.

1. Team continuity and named engineers

A good answer sounds like:
"Four people, tenure 3, 5, 2 and 6 years. Interview them before signing."

A bad answer sounds like:
"We will assign our best available resources."

2. Code and IP ownership

A good answer sounds like:
"Signed assignment of copyright to you, perpetual term, effective on payment."

A bad answer sounds like:
"You own it, it's in the standard MSA."

3. Repository access from day one

A good answer sounds like:
"Your Git organisation, your account. Commits visible from week one."

A bad answer sounds like:
"We hand code over at each phase end."

4. Security, certified versus claimed

A good answer sounds like:
"Certificate number, body, scope, expiry date. Verify it yourself."

A bad answer sounds like:
"We are ISO certified and fully compliant."

5. Sub-processor disclosure

A good answer sounds like:
"Named list in the agreement, with notice before it changes."

A bad answer sounds like:
"We use standard industry tooling."

6. Data location

A good answer sounds like:
"You pick the region. Infrastructure billed at cost, or your own servers."

A bad answer sounds like:
"Our data centres are highly secure."

7. Documentation standard

A good answer sounds like:
"Decision records, runbook and API reference, updated in the same pull request."

A bad answer sounds like:
"We document at project end."

8. Handover and exit terms

A good answer sounds like:
"Named exit period, day rate agreed up front, knowledge transfer recorded."

A bad answer sounds like:
"We have never had a client leave."

9. Support SLA

A good answer sounds like:
"Severity levels with response and restoration times, reported monthly."

A bad answer sounds like:
"We offer 24/7 support."

10. Escalation path

A good answer sounds like:
"Named engineer, delivery lead and director, with numbers and hours."

A bad answer sounds like:
"Raise a ticket."

11. References past year two

A good answer sounds like:
"Two clients live over three years, with their numbers."

A bad answer sounds like:
"Logos and written testimonials."

How we answer all eleven

Here is our own position, item by item.

1, 2 and 3. Team, ownership, repository. You meet the engineers before signing and they are named in the statement of work. Copyright is assigned to you in writing. The repository is yours from the first commit and we work inside it, not alongside it.

4. Security, certified versus claimed. We do not hold ISO 27001 today. Implementation is underway, an auditor has been appointed, and certification is targeted for Q1 2027, January to March. ISO 9001 is also in progress and not held.

On CERT-In. We do not hold empanelment, and we should not, because it is a designation for organisations that perform audits. CERT-In requires empanelled auditors to send audit reports and metadata to it within five days of finishing an audit. Where your procurement needs one, you commission the auditor. We build to their requirements and implement every finding raised.

5 and 6. Sub-processors and data location. Named in the agreement: AWS, Microsoft Azure, Google Cloud Platform or your own on-premise environment, plus error and performance monitoring, analytics and product telemetry, and helpdesk tooling. You get notice before that list changes. We deploy in-region on request, region chosen to meet your requirement, infrastructure billed at cost, or to your own servers.

7 to 11. Documentation, exit, SLA and escalation sit in the contract, not the deck. Our delivery model is on how we work and the security position on trust. For references, start with testimonials, then ask for clients past year three.

Software development company in Pune: what the city actually gives you

Pune gives a buyer two things. Supply of engineers, and a workable overlap with Europe and the Gulf.

On supply. The Maharashtra State CET Cell's final 2025 admission data records 166,746 students taking engineering seats in the state for 2025-26, against 202,883 registrations. Computer Engineering took 27,995, Computer Science and Engineering 17,650 and Information Technology 15,178. Those three filled at 86.81, 88.71 and 87.50 per cent respectively. That is the pipeline a Pune vendor hires from every June.

On cost. You will read posts claiming Pune runs a fixed percentage below Bengaluru or the NCR. We are not quoting one, because we found no salary survey we would stand behind in public. City is the wrong variable anyway. Team seniority, how much of the work is genuinely new, and the depth of QA and DevOps move the number far more. Our cost drivers are published.

On time zones, this is arithmetic, and it is what Gulf and European buyers ask first.

Saudi Arabia and Bahrain

Standard offset: UTC+3
Your 09:00 to 18:00 in IST: 11:30 to 20:30
Overlap with a 09:30 to 18:30 Pune day: 7 hours

United Arab Emirates

Standard offset: UTC+4
Your 09:00 to 18:00 in IST: 10:30 to 19:30
Overlap with a 09:30 to 18:30 Pune day: 8 hours

Germany and Netherlands — Summer

Standard offset: UTC+2
Your 09:00 to 18:00 in IST: 12:30 to 21:30
Overlap with a 09:30 to 18:30 Pune day: 6 hours

Germany and Netherlands — Winter

Standard offset: UTC+1
Your 09:00 to 18:00 in IST: 13:30 to 22:30
Overlap with a 09:30 to 18:30 Pune day: 5 hours

United Kingdom — Summer

Standard offset: UTC+1
Your 09:00 to 18:00 in IST: 13:30 to 22:30
Overlap with a 09:30 to 18:30 Pune day: 5 hours

United Kingdom — Winter

Standard offset: UTC+0
Your 09:00 to 18:00 in IST: 14:30 to 23:30
Overlap with a 09:30 to 18:30 Pune day: 4 hours

India runs at UTC+5:30 with no daylight saving, so the Gulf overlap never moves. The European overlap loses an hour each winter. Plan for it rather than discovering it in November.

One caution on the Gulf working week. The UAE federal government sector works 07:30 to 15:30 Monday to Thursday and 07:30 to 12:00 on Friday, with Saturday and Sunday as the official weekend, effective 1 January 2022. UAE Labour Law sets private sector hours at eight a day or 48 a week. Do not assume a private sector client keeps the federal calendar. Confirm the working week and the weekend with each client before you commit to a delivery rhythm.

Onsite, offshore and hybrid, and what each costs you in coordination

The model you pick decides how much of your own management time the project eats. That cost is rarely priced.

Onsite

Who you coordinate with: Engineers in your building.

Coordination overhead in practice: Lowest. Corridor talk replaces tickets. Highest day rate, slowest to staff.

When it is the right call: Short, high ambiguity work: discovery, a regulator deadline, a migration weekend.

Offshore

Who you coordinate with: A delivery lead in Pune.

Coordination overhead in practice: Written specifications become compulsory. Needs a decision maker on your side who answers within a day.

When it is the right call: Steady, understood scope: product build-out, maintenance, migration.

Hybrid

Who you coordinate with: One or two people with you, the rest in Pune.

Coordination overhead in practice: Works only if the onsite person can decide, not just relay.

When it is the right call: Most enterprise programmes over six months.

We recommend hybrid for engagements over six months and pure offshore for maintenance. We would not put a first discovery phase offshore, where nobody has yet agreed what the system should do. That needs a room.

Proof: what we have actually delivered

Ask any vendor for named clients with the country stated.

In India we have delivered for Star Engineering, Force Motors, Lotus Imaging and Utech Waterproofing. Outside India, we work with EPIC ME Technical Works LLC in the United Arab Emirates, Triolift in Saudi Arabia, and Gulf Integrated Vertical Solutions in Bahrain. Those three are cleared for name and logo, which settles the second question buyers ask: do you work beyond India.

Some clients stay anonymous permanently. A large Indian pharmaceutical company and a government organisation in Maharashtra are in that group, as is a renowned real estate developer in Mumbai. If we broke a confidentiality commitment to win your business, we would break one to win the next.

Across eight years since 2018 we have delivered 730+ projects for 500+ clients worldwide across 25+ industry verticals, and our lift management product ElevatorPlus has over 2,000 users. The partnerships behind that work are on partners.

What to put in the contract

Four clauses decide whether you are a customer or a hostage. Settle them before the first invoice.

Ownership

Do not rely on having paid for the work. Indian law treats computer programmes as literary works under section 2(o) of the Copyright Act 1957. But section 17's default rule handing ownership to the commissioning party covers photographs, paintings, portraits, engravings and films. Software is not on that list.

You need an express assignment. Section 19(1) says none is valid unless in writing and signed by the assignor, and section 19(5) deems an unstated period to be five years. Write the term in.

Non-solicit

Make it mutual. A one-way clause that stops you hiring the engineer who knows your system, while leaving your own team open, is lock-in, not protection of investment. Ours is mutual, 12 or 24 months by agreement, always in writing.

Source escrow

Worth it when the vendor holds something you cannot rebuild: build pipelines, signing keys, infrastructure code. With full repository access, it adds less than people expect.

Exit assistance

Name a period and a day rate at signature, not once you have decided to leave. Six to twelve weeks is normal. Make recorded knowledge transfer and a written runbook deliverables.

Handling personal data adds a fifth clause: who does what when there is a breach. India's Digital Personal Data Protection Rules 2025 were notified on 14 November 2025 with an eighteen month phased compliance window, and the data fiduciary must inform affected individuals without delay.

CERT-In's directions of 28 April 2022 separately require reporting listed cyber incidents within six hours, and keeping ICT system logs for a rolling 180 days within Indian jurisdiction. Six hours is not long enough to work out who calls whom.

Red flags

No named team. "Best available resources" means you are buying a queue position, not a team.

No repository access until delivery. If the repository holds reusable vendor components, settle that in the contract.

Refusal to name sub-processors. Any serious vendor can list where your data sits. "Industry standard tooling" is not a list.

References only from year one. Anyone can make six months look good. What separates vendors is what a client says in month thirty, after two staff changes and a platform upgrade.

A certificate claim with no certificate. ISO does not perform certification, issue certificates, or permit use of its logo in connection with certification. Certificates come from independent certification bodies. Ask for the number, the issuing body, the scope statement and the expiry date, then check it on the International Accreditation Forum's CertSearch.

Accucia's view

Two of our positions cost us work. We hold them anyway.

The first is certification. We are not ISO 27001 certified. We are implementing it, an auditor has been appointed, certification is targeted for Q1 2027, January to March, and ISO 9001 is in progress. When a tender scores certification as a gate, we lose on that line.

We could call ourselves "ISO aligned", as a fair number of firms here do, which means nothing. We would rather be the vendor that told you to demand certificate numbers and then gave you an honest no.

The second is scope. We turn down work where the buyer wants a fixed price for a system nobody has specified. Producing that number means padding the estimate or arguing about change requests for a year. We will run a paid discovery phase, hand you the specification, and you can take it elsewhere.

Where we are plainly ordinary: no Gulf office, no Dubai trade licence, no local team there. We deliver from Pune to clients in the UAE, Saudi Arabia and Bahrain, openly. If your procurement needs a locally licensed entity, we are the wrong vendor, and you should know in week one.

To test any of this, talk to us and start with the eleven questions.

Frequently Asked Questions

1. What does a custom software development company in India actually deliver?

A working system built to your specification, plus the source code, documentation and access needed to maintain it without the original vendor. If a proposal covers the build but not the repository, the documentation standard or the exit terms, you are buying half of it.

2. How do I verify a vendor's ISO 27001 certificate?

Ask for four items: certificate number, the issuing certification body, the scope statement and the expiry date. ISO does not certify anyone or issue certificates itself. Check the certificate on the International Accreditation Forum's CertSearch database, or contact the certification body directly.

3. Does Accucia hold ISO 27001 or ISO 9001?

No. Neither is held today. ISO 27001 implementation is underway, an auditor has been appointed, and certification is targeted for Q1 2027, January to March. ISO 9001 is also in progress. We say that rather than claiming alignment, because this post asks you to verify certificate claims.

4. Who owns the source code we pay for?

Only what your contract assigns. Indian copyright law treats computer programmes as literary works, but the default rule giving the commissioning party ownership covers photographs, paintings, portraits, engravings and films, not software.

Section 19(1) requires written, signed assignment. State a perpetual term, because an unstated one defaults to five years.

5. Do I need a CERT-In empanelled auditor, and does Accucia hold empanelment?

We do not hold CERT-In empanelment, and we should not, because it is a designation for organisations that perform audits. Where your procurement requires one, you commission the empanelled auditor. We build to that auditor's requirements and implement every finding raised, at our cost where it is our defect.

6. Where will my data be hosted?

Wherever your requirement demands. We deploy in-region on request using AWS, Microsoft Azure or Google Cloud Platform, region chosen to meet your rule, infrastructure billed to you at cost.

We also deploy to your own on-premise servers. Sub-processors are named in the agreement, with notice before changes.

7. What should a software development company in Pune offer that a vendor elsewhere cannot?

Two practical things.

A hiring pipeline: Maharashtra admitted 166,746 engineering students for 2025-26, over 60,000 of them in computer engineering, computer science and IT.

And time zone overlap: eight working hours with the UAE, seven with Saudi Arabia and Bahrain, four to six with the UK and Europe.

8. What is a reasonable non-solicit clause?

Mutual, time limited and in writing. Ours runs 12 or 24 months, agreed per engagement.

Refuse any one-way clause that restricts your hiring while leaving the vendor free to approach your staff. That is not protection of investment, it is lock-in, and it costs you continuity.

9. Is source code escrow worth paying for?

It depends what you already hold. Escrow earns its keep when the vendor controls things you cannot rebuild, such as build pipelines, signing keys or infrastructure code.

With full repository access from day one and a maintained runbook, spend the money on documentation quality instead.

10. How many hours will my team actually overlap with a team in India?

India runs at UTC+5:30 with no daylight saving.

Against a 09:00 to 18:00 local day and a 09:30 to 18:30 Pune day, that is eight hours with the UAE, seven with Saudi Arabia and Bahrain, six with central Europe in summer, four with the UK in winter.

11. What does exit assistance actually mean?

A named period after termination during which the vendor keeps helping, at a day rate agreed at signature rather than negotiated under pressure.

Six to twelve weeks is normal. Make recorded knowledge transfer sessions and a written runbook contractual deliverables, so handover is received, not hoped for.

12. What drives the cost of custom software development in India?

Team seniority, how much of the scope is genuinely new rather than configuration, the depth of QA and DevOps you are buying, the number of integrations, and how long you need support afterwards.