--- title: "Software Development Company in the UK | Cyan Orbit" description: "A remote software development team for UK companies: fixed-scope proposals, UK GDPR and IDTA transfer terms, GBP invoicing, and GMT/BST delivery hours." url: https://cyanorbit.com/locations/uk --- 1. [Home](https://cyanorbit.com/) 2. [Locations](https://cyanorbit.com/locations) 3. United Kingdom Europe # Software Development Company UK We work as the engineering team for UK companies, delivering against a fixed-scope proposal without a UK office to run. [Get a project estimate](https://cyanorbit.com/get-a-quote) [Talk to a developer](https://cyanorbit.com/contact) NDA on request · Free, no-obligation estimate · Reply within one business day NDA before discovery You own the code and IP on payment Code in your repository from day one A working demo every two weeks Senior engineers do the work [How we work](https://cyanorbit.com/process) We are a remote software development company working with businesses across the UK, from a founder in Manchester validating a first product to a regulated financial services firm in London replacing a system its own compliance team no longer trusts. There is no UK office to visit; a named engineering lead runs the engagement, working hours that overlap the UK day, and reporting through whatever tool the client already runs, whether that's Jira, Linear or a shared spreadsheet nobody wants to admit is still load-bearing. The work covers a wide spread of UK buyers: an NHS-adjacent health-tech company preparing for a DTAC assessment, a fintech firm building a product inside the FCA's regulatory perimeter, a public-sector-facing charity needing a site that meets accessibility regulations, a retailer adding Klarna at checkout. Each of those buyers runs procurement differently, but most UK organisations share a preference for a clearly scoped proposal before work starts, rather than an open-ended time-and-materials arrangement. The sections below cover how UK buyers typically structure an engagement, which regulations shape what gets built, and how the working day overlaps once a project is under way. Services ## Services for companies in the UK - [AI DevelopmentA remote team building AI features for UK companies, designed around the ICO's guidance on AI and UK GDPR's rules on automated decisions.](https://cyanorbit.com/locations/uk/ai-development) - [Custom Software DevelopmentA remote team building custom systems for UK companies against a fixed-scope proposal, from case management tools to systems that connect to HMRC.](https://cyanorbit.com/locations/uk/custom-software-development) - [E-commerce DevelopmentA remote team building online stores for UK retailers, with Strong Customer Authentication, BNPL options and VAT-inclusive pricing built in from launch.](https://cyanorbit.com/locations/uk/ecommerce-development) - [Mobile App DevelopmentA remote team building iOS and Android apps for UK companies, from Open Banking integration to the DTAC evidence NHS-adjacent apps need.](https://cyanorbit.com/locations/uk/mobile-app-development) - [SaaS DevelopmentA remote team building multi-tenant SaaS products for UK companies, with data processing and VAT handling built in from the first release.](https://cyanorbit.com/locations/uk/saas-development) - [Web DevelopmentA remote web team building sites for UK companies that meet PECR cookie rules, display pricing correctly, and hold up under public sector accessibility scrutiny.](https://cyanorbit.com/locations/uk/web-development) ## Fixed-Scope Proposals and UK Procurement UK buyers, more consistently than buyers in some other markets, expect a fixed-scope proposal for at least the first phase of work: a defined set of features, a fixed price, a delivery date. That preference holds even for organisations that will move to a rolling time-and-materials arrangement once the relationship is established. Public sector and NHS-adjacent buyers add a formal procurement step on top, often a short tender or a framework call-off, before a contract is signed. A data processing agreement is usually bundled into the same contract as the statement of work rather than negotiated separately, since almost every UK engagement involves processing some amount of personal data under UK GDPR. ## Data Transfers Out of the UK Because we work as a remote team, personal data the client controls sometimes needs to move outside the UK for the engineering team to do its job, and UK GDPR treats that movement as a restricted transfer unless a recognised mechanism covers it. In practice that means the contract includes the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU's Standard Contractual Clauses, whichever fits the client's existing paperwork, so the transfer has a documented legal basis rather than an assumption that it's fine. ## Time Zones and Delivery Cadence UK working hours (GMT, moving to BST over summer) overlap almost the entire working day of teams based across Europe and most of the morning for teams on the US East Coast, which makes same-day answers the norm rather than the exception. Standups and sprint reviews sit inside the UK's core hours; day-to-day questions move over Slack or a ticket comment without waiting for a scheduled call. Compliance ## Regulations we design for in the UK - ### UK GDPR and the Data Protection Act 2018 Every system that handles personal data for a UK client is built around the UK GDPR's lawful-basis, data-minimisation and retention requirements as implemented through the Data Protection Act 2018, with ICO guidance as the working reference for how those rules apply in practice. - ### International data transfer mechanisms Where personal data needs to leave the UK for the engineering team to work on it, the contract uses the IDTA or the UK Addendum to the EU Standard Contractual Clauses so the transfer has a documented legal basis. - ### FCA expectations for fintech products Financial products built for a UK client are designed with the FCA's regulatory perimeter in view: clear risk disclosures, audit trails on decisions that affect a customer, and outcomes that hold up under the Consumer Duty's focus on customer outcomes rather than just process. - ### NHS DSP Toolkit and DTAC for health software Health software built for an NHS-adjacent client is structured around the data security and protection standards the NHS DSP Toolkit assesses, and where the product is a digital health tool, the evidence the Digital Technology Assessment Criteria (DTAC) expects on clinical safety, data protection, interoperability and usability. - ### PECR for cookies and marketing email Cookie consent banners, marketing email opt-ins and any tracking that isn't strictly necessary for the site to function are built to PECR's consent requirements, alongside the UK GDPR basis for the underlying data. - ### WCAG 2.2 and public sector accessibility rules Sites and services touching the public sector are built to WCAG 2.2 AA and the Public Sector Bodies Accessibility Regulations 2018, with an accessibility statement the client can publish rather than an assumption that the design already qualifies. Working together ## Contracts, invoicing and working hours - ### Fixed-scope proposal for phase one The first phase is quoted as a fixed scope with a fixed price and date; work after that typically shifts to a rolling time-and-materials arrangement. - ### Data processing agreement bundled into the contract A DPA sits inside the same contract as the statement of work, covering how personal data is processed, stored and deleted over the engagement. - ### IDTA or UK Addendum for cross-border transfers When personal data needs to leave the UK for the team to work on it, the IDTA or the UK Addendum documents the legal basis for that transfer. - ### GBP invoicing Invoices are issued in GBP against milestones in the statement of work; cross-border B2B services are typically invoiced without UK VAT under the place-of-supply rules, with the client accounting for any reverse charge. - ### Overlap across GMT and BST UK hours overlap most of the European working day and the US East Coast morning, so standups and reviews sit inside the UK's core hours by default. Industries ## Industries we build for - [HealthcareClinical and patient-facing software built to HIPAA technical safeguards, wired into the EHR your care teams already use.](https://cyanorbit.com/industries/healthcare) - [Fintech & BankingLedger-accurate financial software with KYC/AML checks and PCI DSS-aligned payment flows built in from the schema up.](https://cyanorbit.com/industries/fintech) - [InsurancePolicy administration, claims and underwriting software that speaks ACORD to carriers, MGAs and agents on the first integration attempt.](https://cyanorbit.com/industries/insurance) - [Professional ServicesEngagement management, time tracking, and client portals built around the way consulting and advisory firms actually bill for their time.](https://cyanorbit.com/industries/professional-services) - [Retail & E-commerceInventory, POS and storefront software that stays in sync across every channel, with EDI wired in for your wholesale partners.](https://cyanorbit.com/industries/retail-ecommerce) - [EducationLearning platforms and student portals built on real rostering data, wired into Canvas, Google Classroom and your SIS through LTI 1.3.](https://cyanorbit.com/industries/education) - [LegalMatter management, document automation and conflict checking with privilege, retention rules and trust accounting designed in from the start.](https://cyanorbit.com/industries/legal) FAQ ## Frequently asked questions Do you sign a data processing agreement under UK GDPR? Yes, as standard on any engagement touching personal data. The DPA is bundled into the same contract as the statement of work and sets out how data is processed, stored and deleted, rather than left to a separate document nobody reads later. How do you handle personal data transfers out of the UK? Where the engineering team needs access to personal data the client controls, the contract uses the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, whichever matches the client's existing paperwork, so the transfer has a documented legal basis. Can you build software that will pass an NHS DTAC assessment? We build to the DTAC's criteria on clinical safety, data protection, interoperability, usability and accessibility from the start, and structure the project so the evidence the assessment asks for (data flow maps, risk logs, accessibility statements) exists as a by-product of the build rather than a scramble at the end. Do you provide a fixed-scope proposal for UK procurement? Yes. The first phase is quoted as a fixed scope, fixed price and fixed date, which fits how most UK buyers, and especially public sector or NHS-adjacent ones, run procurement before a contract is signed. How do you invoice UK clients, and is VAT charged? Invoices are issued in GBP against milestones in the statement of work. Cross-border B2B services are generally invoiced without UK VAT under the place-of-supply rules, with the client's own accounting handling any reverse charge; a UK accountant should confirm the treatment for a specific contract. What working hours overlap can we expect across GMT and BST? UK hours overlap almost the entire working day for teams across Europe and most of the morning for teams on the US East Coast, so standups and sprint reviews sit inside UK core hours and same-day answers are the norm. How do you meet WCAG 2.2 and public sector accessibility rules? We build to WCAG 2.2 AA by default (keyboard navigation, contrast, screen-reader labeling) and, for anything touching the public sector, structure the project so an accessibility statement under the Public Sector Bodies Accessibility Regulations 2018 can be published rather than assumed. ## Start a project with a team that plans around your working hours Share a few details about your project. A senior engineer reviews every request and replies with next steps, questions, and a rough budget range. [Get a project estimate](https://cyanorbit.com/get-a-quote) [Talk to a developer](https://cyanorbit.com/contact)