Skip to content
Cyan Orbit
Menu

Europe

Software Development Company UK

We work as the engineering team for UK companies, delivering against a fixed-scope proposal without a UK office to run.

Get a project estimateTalk to a developer

NDA on request · Free, no-obligation estimate · Reply within one business day

London skyline with Tower Bridge, the Shard and the City over the Thames
NDA before discovery
You own the code and IP on payment
Code in your repository from day one
A working demo every two weeks
Senior engineers do the work
How we work

We are a remote software development company working with businesses across the UK, from a founder in Manchester validating a first product to a regulated financial services firm in London replacing a system its own compliance team no longer trusts. There is no UK office to visit; a named engineering lead runs the engagement, working hours that overlap the UK day, and reporting through whatever tool the client already runs, whether that's Jira, Linear or a shared spreadsheet nobody wants to admit is still load-bearing.

The work covers a wide spread of UK buyers: an NHS-adjacent health-tech company preparing for a DTAC assessment, a fintech firm building a product inside the FCA's regulatory perimeter, a public-sector-facing charity needing a site that meets accessibility regulations, a retailer adding Klarna at checkout. Each of those buyers runs procurement differently, but most UK organisations share a preference for a clearly scoped proposal before work starts, rather than an open-ended time-and-materials arrangement.

The sections below cover how UK buyers typically structure an engagement, which regulations shape what gets built, and how the working day overlaps once a project is under way.

Services

Services for companies in the UK

Fixed-Scope Proposals and UK Procurement

UK buyers, more consistently than buyers in some other markets, expect a fixed-scope proposal for at least the first phase of work: a defined set of features, a fixed price, a delivery date. That preference holds even for organisations that will move to a rolling time-and-materials arrangement once the relationship is established. Public sector and NHS-adjacent buyers add a formal procurement step on top, often a short tender or a framework call-off, before a contract is signed.

A data processing agreement is usually bundled into the same contract as the statement of work rather than negotiated separately, since almost every UK engagement involves processing some amount of personal data under UK GDPR.

Data Transfers Out of the UK

Because we work as a remote team, personal data the client controls sometimes needs to move outside the UK for the engineering team to do its job, and UK GDPR treats that movement as a restricted transfer unless a recognised mechanism covers it. In practice that means the contract includes the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU's Standard Contractual Clauses, whichever fits the client's existing paperwork, so the transfer has a documented legal basis rather than an assumption that it's fine.

Time Zones and Delivery Cadence

UK working hours (GMT, moving to BST over summer) overlap almost the entire working day of teams based across Europe and most of the morning for teams on the US East Coast, which makes same-day answers the norm rather than the exception. Standups and sprint reviews sit inside the UK's core hours; day-to-day questions move over Slack or a ticket comment without waiting for a scheduled call.

Compliance

Regulations we design for in the UK

  • UK GDPR and the Data Protection Act 2018

    Every system that handles personal data for a UK client is built around the UK GDPR's lawful-basis, data-minimisation and retention requirements as implemented through the Data Protection Act 2018, with ICO guidance as the working reference for how those rules apply in practice.

  • International data transfer mechanisms

    Where personal data needs to leave the UK for the engineering team to work on it, the contract uses the IDTA or the UK Addendum to the EU Standard Contractual Clauses so the transfer has a documented legal basis.

  • FCA expectations for fintech products

    Financial products built for a UK client are designed with the FCA's regulatory perimeter in view: clear risk disclosures, audit trails on decisions that affect a customer, and outcomes that hold up under the Consumer Duty's focus on customer outcomes rather than just process.

  • NHS DSP Toolkit and DTAC for health software

    Health software built for an NHS-adjacent client is structured around the data security and protection standards the NHS DSP Toolkit assesses, and where the product is a digital health tool, the evidence the Digital Technology Assessment Criteria (DTAC) expects on clinical safety, data protection, interoperability and usability.

  • PECR for cookies and marketing email

    Cookie consent banners, marketing email opt-ins and any tracking that isn't strictly necessary for the site to function are built to PECR's consent requirements, alongside the UK GDPR basis for the underlying data.

  • WCAG 2.2 and public sector accessibility rules

    Sites and services touching the public sector are built to WCAG 2.2 AA and the Public Sector Bodies Accessibility Regulations 2018, with an accessibility statement the client can publish rather than an assumption that the design already qualifies.

Working together

Contracts, invoicing and working hours

  • Fixed-scope proposal for phase one

    The first phase is quoted as a fixed scope with a fixed price and date; work after that typically shifts to a rolling time-and-materials arrangement.

  • Data processing agreement bundled into the contract

    A DPA sits inside the same contract as the statement of work, covering how personal data is processed, stored and deleted over the engagement.

  • IDTA or UK Addendum for cross-border transfers

    When personal data needs to leave the UK for the team to work on it, the IDTA or the UK Addendum documents the legal basis for that transfer.

  • GBP invoicing

    Invoices are issued in GBP against milestones in the statement of work; cross-border B2B services are typically invoiced without UK VAT under the place-of-supply rules, with the client accounting for any reverse charge.

  • Overlap across GMT and BST

    UK hours overlap most of the European working day and the US East Coast morning, so standups and reviews sit inside the UK's core hours by default.

Industries

Industries we build for

FAQ

Frequently asked questions

Do you sign a data processing agreement under UK GDPR?

Yes, as standard on any engagement touching personal data. The DPA is bundled into the same contract as the statement of work and sets out how data is processed, stored and deleted, rather than left to a separate document nobody reads later.

How do you handle personal data transfers out of the UK?

Where the engineering team needs access to personal data the client controls, the contract uses the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, whichever matches the client's existing paperwork, so the transfer has a documented legal basis.

Can you build software that will pass an NHS DTAC assessment?

We build to the DTAC's criteria on clinical safety, data protection, interoperability, usability and accessibility from the start, and structure the project so the evidence the assessment asks for (data flow maps, risk logs, accessibility statements) exists as a by-product of the build rather than a scramble at the end.

Do you provide a fixed-scope proposal for UK procurement?

Yes. The first phase is quoted as a fixed scope, fixed price and fixed date, which fits how most UK buyers, and especially public sector or NHS-adjacent ones, run procurement before a contract is signed.

How do you invoice UK clients, and is VAT charged?

Invoices are issued in GBP against milestones in the statement of work. Cross-border B2B services are generally invoiced without UK VAT under the place-of-supply rules, with the client's own accounting handling any reverse charge; a UK accountant should confirm the treatment for a specific contract.

What working hours overlap can we expect across GMT and BST?

UK hours overlap almost the entire working day for teams across Europe and most of the morning for teams on the US East Coast, so standups and sprint reviews sit inside UK core hours and same-day answers are the norm.

How do you meet WCAG 2.2 and public sector accessibility rules?

We build to WCAG 2.2 AA by default (keyboard navigation, contrast, screen-reader labeling) and, for anything touching the public sector, structure the project so an accessibility statement under the Public Sector Bodies Accessibility Regulations 2018 can be published rather than assumed.

Start a project with a team that plans around your working hours

Share a few details about your project. A senior engineer reviews every request and replies with next steps, questions, and a rough budget range.

Get a project estimateTalk to a developer
Get a free project estimate