White-Label Software Development: The Client Question, Answered

The moment the question arrives

Decide the answer before the question is asked, because it is usually asked at the worst moment: in a security review, a procurement questionnaire, or when someone technical reads a commit author. You answer under pressure, in front of people paid to find the gap.

Three answers hold up: the work is delivered by your team, true when the arrangement is genuinely full white-label; or you work with a named delivery partner; or you name the supplier as a subcontractor.

One does not hold up: "everything is built in-house by our own employees", when it is not. It survives until the first data processing agreement, invoice or commit log contradicts it. The damage is not the offshore team. It is that you signed something untrue.

The three white-label software development models

Pick the model first, then buy the partner that fits it.

Fully white-label

What your client sees:
Your brand on every file, commit, staging URL and email. The partner does not exist.

Support implications:
Everything routes through you. You carry first-line response.

Risk:
One licence header reads as concealment.

Best fit:
Agencies selling one accountable team.

Badged partner

What your client sees:
Your brand, plus a named delivery partner in the proposal.

Support implications:
Your client may accept a joint call. You still own escalation.

Risk:
Your vetting has to be defensible.

Best fit:
Builds whose governance expects named suppliers.

Disclosed subcontractor

What your client sees:
The supplier named on the contract and in the sub-processor list.

Support implications:
Your client raises tickets directly, which moves the relationship.

Risk:
The supplier now has a route to your client.

Best fit:
Public sector and regulated buyers.

Full white-label is the strongest position and the least forgiving. It only works if the partner holds no route to your client, and if the invisibility is mechanical rather than promised: your repository, your cloud account, your domain, your email signature. Ours is on our partner page.

Two published non-solicits, and why most partners will not publish either

Ask for the numbers before you ask for the rate card. There are two clauses, they protect different things, and you want both. Here are ours.

Client non-solicit. One way, fixed at 24 months, and not up for negotiation.

We sign your non-solicitation agreement as written and we do not negotiate it down. For the duration of our work together and for 24 months afterwards, we will not solicit, accept or service work from any client you introduce us to.

Staff non-solicit. Mutual, with the term agreed per engagement.

We also carry a mutual staff non-solicit, set at either 12 or 24 months depending on what the two parties agree for that engagement. It runs both ways: we do not approach your people, you do not approach ours. Whatever term we agree goes into the contract in writing, and we hold to it.

We publish both terms because most delivery partners will not put a number on either. That is the point. Read a dozen offshore partner pages and you will find "strict no-poach policy" and no term length anywhere. A term length is something a lawyer can act on. A sentiment is not.

One thing about how these clauses work in India. Section 27 of the Indian Contract Act 1872 says "every agreement by which any one is restrained from exercising a lawful profession, trade or business of any kind, is to that extent void". A clause aimed at an individual engineer's right to work is not the instrument you want. A term between two companies is: it binds the businesses and how they behave towards each other's people and clients.

Insist that the staff clause is mutual, because a one-way staff clause reads as defensive and gets negotiated down. The client clause is the opposite. One way is the whole point of it, and a partner who wants that one softened or made reciprocal is telling you something.

The NDA has to cover the relationship, not just the code

Most subcontractor NDAs protect source code and credentials. Few protect what you care about: the existence of the engagement and the identity of your client. So define confidential information to include the fact that the parties work together, your client's name and the commercial terms. Make it survive termination, because an award entry two years later is how these things surface. Extend it to every sub-processor and named individual.

There is a legal reason for that last one. Article 28(2) of the GDPR says "the processor shall not engage another processor without prior specific or general written authorisation of the controller", and Article 28(4) leaves that first processor "fully liable" for the sub-processor's performance. If your client is a controller in the EU or the UK, you need that authorisation before appointing us, and you stay liable for us.

Our sub-processors are named in the agreement: Amazon Web Services, Microsoft Azure, Google Cloud Platform, or your client's own on-premise servers. Where residency matters we deploy in the region you need, billed to you at cost.

Expect directness on certifications and give it. We do not hold ISO 27001; implementation is underway with an appointed auditor and certification targeted for Q1 2027, January to March. ISO 9001 is in progress and not held. We do not hold CERT-In empanelment: where an empanelled audit is required, your client commissions it and we implement every finding the auditor raises. The rest is on our trust page.

The partner contract checklist

Take this into the second call.

Staff non-solicit, mutual, with a stated term

Why it protects you:
A number is actionable, a sentiment is not.

What a weak answer sounds like:
"It need not be in the contract."

Client non-solicit, one way, covering everyone you introduce

Why it protects you:
Your pipeline stays yours.

What a weak answer sounds like:
"Only for our larger partners."

Confidentiality naming the relationship itself

Why it protects you:
Your client's identity is the asset.

What a weak answer sounds like:
"Our NDA covers code and credentials."

No portfolio, case study, logo or award rights

Why it protects you:
Stops a sales deck outing you later.

What a weak answer sounds like:
"We would always ask you first."

Repository and cloud accounts in your name from commit one

Why it protects you:
Nothing to negotiate on exit.

What a weak answer sounds like:
"Everything transfers on final invoice."

Named sub-processor list, with notice before changes

Why it protects you:
You cannot answer a data protection questionnaire.

What a weak answer sounds like:
"We use the standard cloud providers."

Certifications stated as held or not held, with dates

Why it protects you:
Buyers verify numbers with the issuer.

What a weak answer sounds like:
"We are ISO compliant."

Escalation path with a named person and a response time

Why it protects you:
Someone answers when production breaks.

What a weak answer sounds like:
"Email support and we will reply."

Overlap written into the contract in hours

Why it protects you:
You can promise a window you can meet.

What a weak answer sounds like:
"We are flexible with timezones."

Access removal and deletion confirmed in writing

Why it protects you:
Closes the loop your auditor asks about.

What a weak answer sounds like:
"We delete everything, obviously."

Escalation, and who answers at a bad hour

Agree the escalation path before the first line of code, because nobody negotiates one calmly at 11pm.

Three things need names. Who your client calls, which in a full white-label model is always you. Who you call, which should be one named person with a stated response time, not a shared inbox. And what counts as urgent, because urgent means one thing to a marketing director and another to a database.

Ours: anything broken in production is urgent, and urgent means a human, an owner and a status update, weekends included. Everything else gets a written response inside four working hours.

Ask how that is priced. Out-of-hours cover is free for nobody, and a partner who says it is has not thought about it. How we scope and quote is on how we work; what moves a number is on our how-we-work page.

Timezone in hours, not adjectives

"Good overlap" is not a commitment. A number of hours in the contract is.

Indian Standard Time is five and a half hours ahead of UTC and does not observe daylight saving, so the gap to your market moves twice a year even though our clock never does. UK clocks change on the last Sunday in March and October, per the UK government. US daylight saving runs from the second Sunday in March to the first Sunday in November, per NIST. In New South Wales it runs from 4 October 2026 to 4 April 2027, per the NSW government.

London

Working day:
09:00 to 17:30

Against IST:
India +4.5 hours, +5.5 hours in winter.

Overlap we commit to, your hours:
09:00 to 13:00

Same window in IST:
13:30 to 17:30, or 14:30 to 18:30.

US East Coast

Working day:
09:00 to 17:00

Against IST:
India +9.5 hours, +10.5 hours in winter.

Overlap we commit to, your hours:
09:00 to 13:00

Same window in IST:
18:30 to 22:30, or 19:30 to 23:30.

US West Coast

Working day:
08:00 to 16:00

Against IST:
India +12.5 hours, +13.5 hours in winter.

Overlap we commit to, your hours:
08:00 to 12:00

Same window in IST:
20:30 to 00:30, or 21:30 to 01:30.

Sydney

Working day:
09:00 to 17:00

Against IST:
India -4.5 hours, -5.5 hours in their summer.

Overlap we commit to, your hours:
13:00 to 17:00

Same window in IST:
08:30 to 12:30, or 07:30 to 11:30.

Sydney needs an early roster here, so it is a decision, not a gift of geography. The windows shift with the clocks, so we restate them in writing in March and October.

Commercials: margin, minimums, change control, losing the client

Promethean Research's 2026 State of Digital Services report put average digital agency net margin at 13% for 2025, average headcount down 2% and average revenue growth at 7.5%. On those numbers, delivery cost decides whether a won project was worth winning.

You buy delivery at a scoped price and sell an outcome at yours. We never see what you charge. On minimums, ours is none: start with one project, judge the work, then decide. A partner asking for a seat commitment before you have seen a sprint is moving their risk onto you.

Change control is where these engagements go wrong quietly. Your client changes their mind, you absorb it to protect the relationship, and the hours land on your margin instead of an invoice. Insist on written acceptance criteria and a re-quote for anything outside them.

Then settle what happens if you lose the end client. The repository, cloud accounts and credentials were always in your name, so there is no handover to negotiate and no exit fee. Work in progress is handed over, access removed, deletion confirmed in writing.

Three ways this goes wrong

A partner who goes direct

It starts with something innocent: a support email copied to your client, a calendar invite, a connection request after handover. This is why the client non-solicit and the no-route rule matter more than any technical claim on a partner page.

A partner with no documentation standard

The work ships, the engagement ends, and eighteen months later your client asks for a change nobody can price, because the person who understood the deployment has left. Ask to see a real handover pack before you sign.

A partner you cannot reach in your own working day

That is a staffing decision they made and did not mention, not a timezone problem. It shows up as a one day round trip on every question.

Accucia's view

Full white-label is the right default for most agencies, and we run it as mechanics rather than as a promise. We also think it is oversold. If your client's procurement rules require named suppliers, the disclosed subcontractor route is better for you, and we will say so even when that ends with your client contracting us directly and your margin gone. We would rather lose it than help you sign a statement you cannot defend in an audit.

The second position belongs in public. We work both ways. Some months we are the invisible team behind an agency. Other months we are the named supplier on a direct client's contract. Some direct clients would prefer we did not do the first. We do both, we keep them separated by agreement, and we would rather you read it here than find out later. What they say about the named side is on our testimonials.

Founded 2018, so eight years, 730 or more projects, 500 or more clients worldwide. The agencies who handle the "who builds it" question well settled the answer before anybody asked.

Frequently Asked Questions

What is white-label software development?

White-label software development is an arrangement where an external engineering team builds software under your brand, contracts and invoices with you rather than with your client, and stays invisible to that client. The code sits in your repository and staging runs on your domain.

Do I have to tell my client I use a development partner?

It depends what you have already signed. Many master services agreements permit subcontracting, some require notice, some require prior written consent. Public sector and regulated buyers usually require disclosure outright. Read the clause first, because the answer is contractual rather than optional.

What should I say if my client asks directly?

Say whichever of the three answers your contract and paperwork support: delivered by your team, delivered with a named partner, or delivered by a named subcontractor. Never claim everything is built in-house by your own staff if a commit log would contradict it.

What non-solicit terms does Accucia agree to?

Two separate clauses. The client non-solicit is one way and fixed at 24 months: we will not solicit, accept or service work from any client you introduce us to. The staff non-solicit is mutual, set at 12 or 24 months by agreement, and it goes into the contract in writing.

Will you approach or take my client?

No. In a full white-label engagement we hold no route to your client and we do not want one. Every question, approval and escalation runs through your named contact. We sign your client non-solicit as written, and it runs for 24 months after our work together ends.

Does your NDA cover the fact that we work together?

Yes, when it is drafted properly. Ask for confidential information to include the existence of the relationship, your client's identity and the commercial terms, not only source code and credentials. Ask for it to survive termination and to bind every sub-processor.

Do you hold ISO 27001 certification?

No. We are implementing an ISO 27001 information security management system, with an appointed auditor and certification targeted for Q1 2027, January to March. We are not certified today and we will not claim otherwise. ISO 9001 is also in progress and not held. We publish certificate details on issue.

Do you hold CERT-In empanelment?

No. Empanelment is a designation for organisations that perform security audits, and we do not hold it. Where an empanelled audit is required, your client commissions the audit, we build to the requirements the auditor sets, and we implement every finding.

Where does the code and the data sit?

In your accounts, from the first commit. Where residency matters we deploy into the region you need on AWS, Azure or Google Cloud Platform, with infrastructure billed to you at cost, or onto your client's own on-premise servers. Sub-processors are named in the contract.

How many hours will you overlap with my working day?

At least four hours, written into the contract. For the US East Coast that is typically 09:00 to 13:00 your time, and for London the same window. For Sydney it is 13:00 to 17:00 your time, on an early roster from our side.

Who answers when my client's system breaks out of hours?

You do, in a full white-label model, and we answer you. Anything broken in production is treated as urgent, which means a named human, an owner and a status update, weekends included. Everything else gets a written response inside four working hours.

What happens to the code if I lose the end client?

Nothing dramatic. The repository, cloud accounts, registrar entry and credentials were always yours, so there is no handover cliff and no exit fee. We finish or hand over work in progress, write up architecture notes, remove our access and confirm deletion in writing.