Nearshore development in Türkiye: the risks that matter, and how to test them

Most pages about nearshore development are written to sell the model. This one is written to help you interrogate it. Everything below is a risk European buyers have actually raised with us, together with the test that answers it before money changes hands.

What the model is

Nearshoring means placing the engineering work in a country close enough to share your working day and cheap enough to change the arithmetic. It sits between hiring locally, where communication is effortless and rates are high, and far-offshore, where rates are low and the working day barely overlaps. You gain budget; you take on distance, a different legal system and a supplier you cannot walk over to. Whether that is worth it depends on how well the five risks below are handled.

Risk 1: the working day does not overlap as much as brochures claim

Türkiye is on UTC+3 all year and does not observe daylight saving. Europe does, so the gap changes twice a year.

How to test it: ask for the supplier's standard working hours in your own time zone, in writing, and schedule your first three calls at the times you would actually want them. A supplier who can only meet at 17:00 your time is telling you something about the rest of the project.

Risk 2: data protection is not solved by saying the laws are similar

Turkish data protection law is modelled closely on the European framework, and that similarity is genuinely useful. It is not the same as an adequacy decision, and Türkiye does not have one. Under GDPR, moving personal data there requires standard contractual clauses or another Article 46 safeguard, plus the transfer assessment that goes with it. There is a simpler answer that avoids most of the question: keep the data where it already is. Production runs in an EU or UK cloud region in your own account, developers work against anonymised data, and production access is granted narrowly, logged, and revoked at the end.

How to test it: ask where production data will physically live, whose cloud account holds it, who has credentials, and how access is logged. If the answer is vague, the answer is no. The same questions apply to any supplier, and are worked through in where your data actually lives.

Risk 3: intellectual property you would have to enforce abroad

Every serious supplier will sign an assignment clause transferring the code to you. The clause is necessary, and it is also the weakest of your protections, because enforcing it across borders is slow and expensive. Practical custody beats contractual custody:

• The repository is yours, created under your organisation account on day one with the supplier added as a contributor — not "handed over at the end".
• The cloud and domain accounts are yours, billed to you, with the supplier holding a user account you can revoke in one click.
• Milestones are short and small, so the largest sum ever at risk covers a few weeks of work already in your repository.
• No proprietary framework underneath. Code written on a closed platform belongs to you in name only.

How to test it: ask to have the repository created in your account before the first invoice. The answer tells you almost everything. More in code ownership and lock-in.

Risk 4: language and who you actually talk to

The common failure is not that nobody speaks English. It is that the person who speaks it best is in sales and the person writing your code is two handoffs away. Requirements degrade at every handoff, and the degradation shows up as software that does what someone thought you meant.

How to test it: insist the engineer who will build the work joins the discovery call and answers directly, then read what comes back in writing. A supplier who returns a scope with your own edge cases restated in it has understood you; one who returns a template has not.

Risk 5: calendars, and the small logistics nobody plans for

Weekends match. National holidays do not, and two of the year's holidays shift by around eleven days annually, so this year's dates are not next year's — a week you assumed was working may not be. Travel is straightforward, with Istanbul three to four hours by direct flight from most western European capitals, but check visa requirements for your own passport before planning an on-site workshop.

How to test it: ask for the holiday calendar covering the whole engagement, in writing, at proposal stage, and check it against your milestone dates.

How we work, in specifics

• Fixed-scope module delivery: written scope, fixed price, a clickable prototype in the first two weeks and a working module in weeks 4 to 6. For buyers who know the workflow they want replaced.
• Dedicated team extension: engineers working inside your own tracker and repository. For buyers with an internal technical lead who wants capacity, not a supplier.
• Migration and modernisation: moving workflows off a legacy system while it keeps running, connected by integrations rather than replaced in one step — sequencing in our migration guide.

The lowest-risk way to start

• Buy one module, not a programme. Four to six weeks, fixed price, one workflow. The cost of finding out you chose wrongly should be a few thousand dollars, not a year.
• Set up the accounts in your name first — repository, cloud, domain — before the kick-off call, not after the final invoice.
• Judge the prototype, not the proposal. Two weeks in you should be clicking through screens with your own staff.
• Only then decide about scale. If the first module lands well the second is easy; if it does not, you have learned it cheaply.

Our published bands and delivery times are on the pricing page, the questions to ask any supplier are in how to choose a software vendor, and a first module can be scoped through the quote form.

Frequently asked questions

How much working-day overlap is there between Türkiye and the UK or Germany?

Türkiye is on UTC+3 all year and does not change clocks. That is three hours ahead of UK time in winter and two in summer; two and one against central European time. A Turkish day of 09:00 to 18:00 gives roughly six hours of overlap with a UK office and seven with a German one.

Does GDPR allow personal data to be processed in Türkiye?

Türkiye is not covered by an EU adequacy decision, so transfers rely on standard contractual clauses or another Article 46 safeguard. The simpler route, and the one we normally take, is to keep production data in an EU or UK region under your own cloud account, with developer access controlled and logged.

How do I make sure I own the code when the supplier is in another country?

Do not rely on the assignment clause alone. Own the repository from day one under your own account and add the supplier as a contributor, own the cloud accounts and domains, and tie milestone payments to code already in your repository. Ownership you can enforce technically beats ownership you would have to litigate.

What law should govern a cross-border software contract?

Agree the governing law and forum explicitly rather than leaving the default. English law or the buyer's own jurisdiction is common and reasonable. Then design the commercial terms so you would rarely need them: short milestones, small amounts at risk, deliverables in your possession as you go.

How do public holidays differ and how should that be planned for?

Weekends are Saturday and Sunday, the same as Europe. National holidays differ, and two religious holidays move about eleven days earlier each year, so the dates change annually. Ask for the supplier's holiday calendar covering the whole engagement at the start and put it in the plan.

What is the safest way to try a nearshore supplier?

Buy a small paid piece of work first, not a full project. One focused module, four to six weeks, fixed price, working software you can test at the end. It costs a fraction of the full build and tells you more about communication and delivery discipline than any reference call.