Offshore or nearshore application maintenance: how to choose

Entrusting your application maintenance to an offshore provider is first of all a search for a lower cost. But maintenance lasts for years and lives at the pace of incidents: the time difference, the language, access to data and the stability of the team weigh as much as the rate. This guide compares offshore and nearshore on these points and gives the questions to ask before choosing.

It is aimed at executives, IT directors and application managers considering entrusting their application maintenance (TMA) to a team located outside France, and who want to know what distance changes day to day.

Offshore, nearshore, onshore: what are we talking about?

The three words describe where the team works relative to its client. No text defines them; for a French company, usage is roughly as follows.

• Onshore. The provider works in France, or in the client’s country.
• Nearshore. The provider works in a nearby country, with a small time difference: North Africa, Southern or Eastern Europe. For a French client, North Africa often adds a shared language.
• Offshore. The provider works far away, with several hours’ difference: in India or Southeast Asia, for example.

The boundary is not clear-cut, and distance in kilometres matters less than what it changes: the hours the team works, the language it writes in, the law that applies to the data. These are the points to compare.

Why maintenance is not a project like any other

A development project has a start and an end: the work is broken into packages delivered on schedule, and a time difference is managed with scheduled check-ins. Maintenance works differently.

• It lasts. Years, with a team that must know the application in depth.
• It is reactive. A blocking defect reported in the morning must be picked up within the time set in the contract.
• It lives on short exchanges. A question, a clarification, an acceptance test: back-and-forth with users is daily.
• It depends on the team’s memory. Every departure loses part of the knowledge of the application.

The CCAG-TIC 2021 defines third-party application maintenance as the services that consist in keeping an information system in a state that allows it to fulfil its function (Article 38), whether by fixing, preventing or evolving the application (see our guide to evolutive maintenance). This objective is held day by day: this is why the provider’s location weighs more in maintenance than in a project.

Five criteria for comparing offshore and nearshore

1. Time zone and service hours. Tunisia is on UTC+1 all year: the same time as Paris in winter, one hour behind in summer. Morocco is also on UTC+1, except during Ramadan. India is on UTC+5:30 all year: when it is 9:00 in Paris, it is 13:30 there in winter and 12:30 in summer. With offshore, the shared working day is therefore shorter, and a request sent late in the afternoon arrives when the team has finished its day. Some providers shift a team onto the client’s hours: check this in the contract, along with service hours and on-call cover.

2. Language, spoken and written. In maintenance, writing is constant: tickets, reports, release notes, documentation. A team that works in the users’ language understands requests without an intermediary and documents in a language the company can read after it. With a team that works in English, someone has to translate business requests, at the client or at the provider.

3. Personal data. As soon as the team accesses production personal data from a country outside the European Economic Area, the GDPR governs that transfer. The subject is detailed below: it also concerns nearshore outside the Union.

4. Team stability. Knowledge of an application rests with people. Ask who will work on yours, how long the same people will stay, and how a departure is prepared: documentation, pairing, overlap period. The question applies everywhere; it weighs more when the team is far away and you see little of it.

5. Reversibility. Code in a repository in the company’s name, up-to-date documentation, a written exit plan: the day you change provider, distance must complicate nothing. Our guide to the application maintenance contract details the relevant clauses.

General comparison: each provider should be judged on evidence. Time zones according to the Wikipedia pages UTC+01:00 and UTC+05:30.

And the cost? The daily rate does not tell you what maintenance costs. You have to add the management time spent by your teams, the back-and-forth over misunderstood requests, rework, and the part of the day when nobody can be reached. Compare full costs over a period, not rates.

Data: nearshore does not escape the GDPR

This is the point that does not depend on distance. The European Data Protection Board (EDPB), which brings together the CNIL and its European counterparts, states it in its Recommendations 01/2020: remote access, by an entity located in a third country, to data located in the European Economic Area is also a transfer. A provider is an entity distinct from its client: a developer who consults a production database from abroad may be enough.

A transfer is not prohibited: it must be governed by one of the tools of Chapter V of the GDPR, as the CNIL reminds us. The first is the adequacy decision, by which the European Commission recognises that a country offers a sufficient level of protection. Its list includes in particular Switzerland, the United Kingdom, Canada (commercial organisations), Japan and South Korea; neither Tunisia, nor Morocco, nor India is on it at present. Without adequacy, appropriate safeguards are needed, for example the Commission’s standard contractual clauses, and a transfer impact assessment (TIA), carried out by the data exporter with the assistance of the provider. The CNIL has published a practical guide to it.

The rule applies to an offshore provider as to a nearshore provider located outside the Union. What changes is the way of working: the less access the team has to real data, the less the subject weighs.

• No direct access by developers to production data.
• Test environments fed with anonymised or fictitious data.
• Hosting in the European Union.
• Named, traced accesses, removed when each contributor leaves.

The questions to ask before choosing

• Where will the team work, and at what hours for us?
• In what language will tickets, reports and documentation be written?
• Who will work on our application, and how is a departure prepared?
• Will the team have access to production data? From which country, and with what safeguards?
• Where is the code hosted, and in whose name?
• What response times during our business hours?
• How does exit from the contract work: documentation, handover, duration?

These questions complement the criteria for choosing a provider detailed in our guide to outsourcing application maintenance.

Frequently asked questions

Offshore or nearshore: judge on evidence

For application maintenance, the right provider is the one with whom a request is understood the first time, at an hour when your teams are working, without your data leaving its framework. Distance is one of the ways of getting there, or of moving away from it.

iones’ French-speaking nearshore team, based in Tunis, provides application maintenance for existing applications and can start with an audit of what you have. You can also write to us for a first discussion.