7 security questions to ask before giving an offshore team repo access

Rajat Jain — Sat, 31 Oct 2026 08:12:48 +0000

Giving people outside your building access to source code is a fair thing to worry about. The risks are specific, though, and most of the controls are the ones you should already apply to any remote employee.

Before the first engineer gets access, ask the provider these seven questions. Vague answers are worth following up in writing.

Who employs the engineers? Do they sign individual NDAs and IP assignment terms that name your company?
Are devices company-owned and managed? Can they show that encryption and remote wipe are enforced?
Can your identity provider control all access? You should be able to revoke it without asking them.
Certified or aligned? ISO 27001 certification comes from an accredited body, and a SOC 2 report comes from a CPA firm. "Aligned" means neither has happened. Ask for the certificate, the report or the control list.
What happens to code and data when the engagement ends? How is deletion confirmed?
Who do you call during a suspected incident? How quickly will they respond?
How is the office secured? Ask about physical access and visitors on the delivery floor.

What to configure on your side

Protect main branches and require at least one approval.
Scan every pull request for vulnerable dependencies and leaked secrets.
Keep credentials in a secrets manager, and rotate any secret that reaches a commit.
Remove standing production access. Changes go through the pipeline, and break-glass access is time-bound and logged.
Use synthetic or masked data in development.

Our own position, for comparison: controls aligned with ISO 27001 and SOC 2, not certified.

The full checklist covers contracts, monitoring, the DPDP Act and EU data transfers: https://offshore1st.com/blog/ip-protection-data-security-offshore-teams-checklist

Disclosure: I'm the founder of Offshore1st, which places dedicated staff in India. This post was prepared with AI assistance and is condensed from our checklist.

India doesn't change its clocks. Here's what that does to your offshore team's overlap

Rajat Jain — Sat, 31 Oct 2026 06:39:05 +0000

US clocks go back an hour on Sunday 1 November. India's never move, so every team working between the two loses an hour of shared time on Monday.

Here's the overlap we plan around, for a client working 09:00 to 18:00 local time and a team in Hyderabad on a matched shift.

Client city	Team hours (IST)	Daily overlap
New York	14:30 to 23:30	4 hours in US winter, 5 in summer
London	11:00 to 20:00	5½ hours in UK winter, 6½ in summer
Dubai	10:00 to 19:00	About 8½ hours all year
Sydney	07:00 to 16:00	5½ hours in the southern summer, 6½ in winter

New York is the tightest window. In US winter, 09:00 Eastern is 19:30 in Hyderabad, so shared time runs from 19:30 to 23:30 IST.

This week's checklist

Move recurring meetings so they still land inside the overlap.
Check any handoff that relies on someone seeing it before they log off.
Decide whether the shift moves with your clocks or stays put, and confirm it in writing.

Protect the overlap

Don't spend it on status. Post a written standup at the start of each person's day, with four lines: yesterday, today, blockers and FYI. The required blockers line matters most, because it makes raising a problem routine.

Use the shared hours for decisions, pairing and design reviews. Before logging off, each side writes down what finished, the exact state of what's in progress, open questions with a named owner, and what the other side should pick up first.

Write messages that don't need a reply

Incomplete: "The users API is broken."
Complete: "GET /api/users returns 500 with an expired token. Expected 401. I suspect the error handler. Draft fix in PR 412. Needed before Thursday's release."

Each clarifying question can cost half a day, so that second version pays for itself.

The full guide covers operating models, response-time targets and how to measure whether the system works: https://offshore1st.com/blog/complete-guide-managing-offshore-teams-time-zones

Disclosure: I'm the founder of Offshore1st, which places dedicated staff in India. This post was prepared with AI assistance and is condensed from our guide.

DEV Community: Offshore1st

7 security questions to ask before giving an offshore team repo access

India doesn't change its clocks. Here's what that does to your offshore team's overlap