Do you have Cyber Essentials, and what if our framework requires it?

We do not currently hold Cyber Essentials. Where your framework lists it as preferred, we offer our ISO 27001:2022 certificate with a mapping to the five Cyber Essentials controls. Where it is mandatory, as on most central government routes and some framework agreements, we can work as a subcontracted engineering capability behind a UK prime who holds it, with our ISO scope statement supporting their submission. If neither route fits, we will tell you on the first call.

Can our data stay in the UK or EU?

Yes, your data can stay in the UK or EU where the architecture allows it. Data residency is agreed at contract and written into the DPA. Hosting in UK or EU regions is standard for engagements with that requirement, and the sub-processor list is adjusted accordingly before work starts.

How much overlap will we actually get with your team?

You get three and a half hours of overlap in winter and four and a half during British Summer Time, starting at your 09:00. India is five and a half hours ahead of GMT, so our working day ends at 12:30 GMT: your morning is our afternoon, and your afternoon is outside our day. We publish the window in your time zone and treat it as a commitment. Standups, reviews and demos happen inside it, and the rest of your day runs on written reporting.

United Kingdom · Global delivery09:00–12:30 GMTGBP

Engineering for UK companies.

UK procurement asks the right questions early: who is the data controller, where is the transfer agreement, which sub-processors, what is your certification number. Each answer already exists as a document: the ISO 27001 certificate, a DPA with named sub-processors, and an IDTA for the transfer, all available before the first technical call.

Start a project Verify our certifications

Working with the UK

Hours, money,
and paperwork.

The three things that decide whether a cross-border engagement works. Everything here is specific to the UK.

Time overlap

09:00–12:30 GMT

IST is five and a half hours ahead of GMT, so your morning is the back half of our day. Our 18:00 IST is your 12:30 GMT, which gives three and a half hours of overlap through the winter. Under British Summer Time the gap narrows by an hour and the overlap grows to four and a half. Standups, reviews and stakeholder demos sit inside it. Your afternoon is outside our working day and is covered by written reporting.

Currency and tax

GBP

Quoted and invoiced in pounds sterling, so your budget line and our invoice carry the same number with no exchange exposure on your side. There is no Indian tax component to reclaim or query. We are a non-UK supplier of services to a UK business, so you account for VAT under the reverse charge.

Data protection

Governing law: UK GDPR and the Data Protection Act 2018
Authority: Information Commissioner's Office (ICO)
Our role: Processor, on your instructions
Named sub-processors, written consent before any addition.

You are controller, we are processor, under a DPA that names every sub-processor and requires your written consent before another is added. Transfers out of the UK are covered by the ICO's International Data Transfer Agreement or the UK Addendum to the EU SCCs, with a transfer risk assessment provided. UK or EU data residency can be fixed at contract and written into the DPA.

City by city

Local hours and
local rules.

The shared working window in local time, and any rule that applies in a city on top of the national ones.

London
England
09:00–12:30 GMT, 09:00–13:30 BST
UK time
For FCA-regulated firms, the FCA's outsourcing rules (SYSC 8) apply when a critical or important function is outsourced. We support the due diligence those rules require.
Manchester
England
09:00–12:30 GMT, 09:00–13:30 BST
UK time
National rules apply, with no city-specific additions.
Birmingham
England
09:00–12:30 GMT, 09:00–13:30 BST
UK time
National rules apply, with no city-specific additions.
Edinburgh
Scotland
09:00–12:30 GMT, 09:00–13:30 BST
UK time
Data protection is UK-wide. Scottish public authorities also answer requests under the Freedom of Information (Scotland) Act 2002, which can make contract terms disclosable.
Bristol
England
09:00–12:30 GMT, 09:00–13:30 BST
UK time
National rules apply, with no city-specific additions.
Cambridge
England
09:00–12:30 GMT, 09:00–13:30 BST
UK time
National rules apply, with no city-specific additions.
Oxford
England
09:00–12:30 GMT, 09:00–13:30 BST
UK time
National rules apply, with no city-specific additions.
Leeds
England
09:00–12:30 GMT, 09:00–13:30 BST
UK time
National rules apply, with no city-specific additions.
Reading
England
09:00–12:30 GMT, 09:00–13:30 BST
UK time
National rules apply, with no city-specific additions.
Glasgow
Scotland
09:00–12:30 GMT, 09:00–13:30 BST
UK time
Scottish public authorities answer requests under the Freedom of Information (Scotland) Act 2002, as in Edinburgh.
Cardiff
Wales
09:00–12:30 GMT, 09:00–13:30 BST
UK time
National rules apply, with no city-specific additions.
Belfast
Northern Ireland
09:00–12:30 GMT, 09:00–13:30 BST
UK time
Northern Ireland is under UK GDPR. Businesses that also serve customers in the Republic of Ireland work under the EU GDPR for that data.

What your procurement will ask

Answered
before you ask.

The questions procurement teams in the UK typically ask, with our answers. Where we do not hold something, the answer says so.

Cyber Essentials certification

We do not currently hold Cyber Essentials. We hold ISO 27001:2022, the broader standard, which covers the same control ground with an external audit behind it. We will map our controls to the five Cyber Essentials controls if you need the comparison.

DPA, sub-processor list and TRA

All three exist as documents. The sub-processor list is specific to your engagement, and adding to it needs your written consent. The transfer risk assessment is supplied with the DPA.

Financial standing and company checks

We are a registered Indian LLP, LLPIN ACS-5305, verifiable on the MCA portal, which is the Indian equivalent of a Companies House check. GSTIN, DPIIT recognition and Udyam registration are all published with their numbers.

Accessibility conformance

Accessibility criteria are set during design, and WCAG 2.2 AA is the working target on public-facing interfaces. A full conformance claim requires manual testing with assistive technology and expert review, and where you need one we scope that work explicitly.

Certificate numbers, accreditation status and the verification route are published on our trust page. Check them without asking us.

Work we take on in the UK

Common problems
we build for.

Common work for teams in the UK. If one of these is yours, send us a brief.

Legacy estate that cannot be replaced wholesale

A system that runs the business, was written a decade ago, and has to keep running while it changes. The approach is integration boundaries and incremental extraction.

Regulated-adjacent product work

Financial services, insurance and healthcare products where the audit trail matters as much as the feature. Decision records and change control are part of the deliverable.

Design and brand systems

We take design and brand work as a standalone commission. Identity, design systems and front-end build without an engineering programme attached.

Why we suit teams in the UK

The four documents UK procurement asks for exist before you ask: the ISO 27001 certificate, the DPA, the sub-processor list and the transfer risk assessment. The certificate number can be verified independently.
Your whole morning overlaps our working day, which leaves room for live standups, reviews and demos. We quote the window in your time zone.
Weekly written reporting covering what shipped, what slipped, decisions taken and risks opened or closed, which gives you an audit trail a board pack can quote.

Where we are not the right answer

We are not a UK-registered company and hold neither Cyber Essentials nor a G-Cloud listing. For central government work that requires either, we cannot meet that requirement today. For private sector and local authority work, we provide our ISO certifications and a mapped control summary. Check what your own framework requires before you invest time.

United Kingdom · Questions

Asked from
the UK.

General questions about pricing, process, IP and security are answered on the FAQ page.

Are you UK GDPR compliant as a data processor?: Yes, we work to UK GDPR as your processor, with you as controller. Each engagement runs under a data processing agreement that names every sub-processor and requires your written consent before another is added. Transfers to India are covered by the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and a transfer risk assessment is supplied with the DPA. The ISO 27001:2022 information security management system provides the audited control framework beneath those commitments.
Do you have Cyber Essentials, and what if our framework requires it?: We do not currently hold Cyber Essentials. Where your framework lists it as preferred, we offer our ISO 27001:2022 certificate with a mapping to the five Cyber Essentials controls. Where it is mandatory, as on most central government routes and some framework agreements, we can work as a subcontracted engineering capability behind a UK prime who holds it, with our ISO scope statement supporting their submission. If neither route fits, we will tell you on the first call.
Can our data stay in the UK or EU?: Yes, your data can stay in the UK or EU where the architecture allows it. Data residency is agreed at contract and written into the DPA. Hosting in UK or EU regions is standard for engagements with that requirement, and the sub-processor list is adjusted accordingly before work starts.
How much overlap will we actually get with your team?: You get three and a half hours of overlap in winter and four and a half during British Summer Time, starting at your 09:00. India is five and a half hours ahead of GMT, so our working day ends at 12:30 GMT: your morning is our afternoon, and your afternoon is outside our day. We publish the window in your time zone and treat it as a commitment. Standups, reviews and demos happen inside it, and the rest of your day runs on written reporting.

Other markets