--- title: "Software Development Company in the UK | Arbocode" description: "Remote software development for UK companies, with fixed-scope proposals, UK GDPR and IDTA transfer terms, GBP invoicing and delivery in GMT/BST hours." url: https://arbocode.com/locations/uk --- 1. [Home](https://arbocode.com/) 2. [Locations](https://arbocode.com/locations) 3. United Kingdom Europe # Software Development Company UK We act as the engineering team for UK companies and deliver against a fixed-scope proposal, with no UK office to run. [Get a free estimate](https://arbocode.com/get-a-quote) [Speak with an engineer](https://arbocode.com/contact) NDA on request · Free, no-obligation estimate · Reply within one business day NDA signed before we start Full IP ownership on payment Your repository from the first commit Live demo at the end of every sprint Built by senior engineers [How we work](https://arbocode.com/process) We are a remote software development company serving businesses across the UK, from a Manchester founder validating a first product to a regulated London financial services firm replacing a system its own compliance team no longer trusts. There is no UK office to visit. A named engineering lead runs the engagement during working hours that overlap the UK day and reports through whichever tool the client already uses, whether that is Jira, Linear or a shared spreadsheet nobody wants to admit still carries the load. The work covers a wide spread of UK buyers: an NHS-adjacent health-tech company preparing for a DTAC assessment, a fintech firm building a product inside the FCA's regulatory perimeter, a public-sector-facing charity needing a site that meets accessibility regulations, a retailer adding Klarna at checkout. Each of those buyers runs procurement differently, but most UK organisations share a preference for a clearly scoped proposal before work starts, rather than an open-ended time-and-materials arrangement. The sections below cover how UK buyers typically structure an engagement, which regulations shape what gets built, and how the working day overlaps once a project is under way. Services ## Services for companies in the UK - [AI DevelopmentA remote team that builds AI features for UK companies around the ICO's AI guidance and the UK GDPR rules on automated decisions.](https://arbocode.com/locations/uk/ai-development) - [Custom Software DevelopmentA remote team that builds custom systems for UK companies against a fixed-scope proposal, from case management tools to systems that connect to HMRC.](https://arbocode.com/locations/uk/custom-software-development) - [E-commerce DevelopmentA remote team that builds online stores for UK retailers, with Strong Customer Authentication, BNPL options and VAT-inclusive pricing in place at launch.](https://arbocode.com/locations/uk/ecommerce-development) - [Mobile App DevelopmentA remote team that builds iOS and Android apps for UK companies, from Open Banking integration to the DTAC evidence that NHS-adjacent apps need.](https://arbocode.com/locations/uk/mobile-app-development) - [SaaS DevelopmentA remote team that builds multi-tenant SaaS products for UK companies, with data processing and VAT handling in place from the first release.](https://arbocode.com/locations/uk/saas-development) - [Web DevelopmentA remote web team that builds sites for UK companies meeting PECR cookie rules, showing prices correctly, and standing up to public sector accessibility scrutiny.](https://arbocode.com/locations/uk/web-development) ## Fixed-Scope Proposals and UK Procurement UK buyers, more consistently than buyers in some other markets, expect a fixed-scope proposal for at least the first phase of work: a defined set of features, a fixed price, a delivery date. That preference holds even for organisations that will move to a rolling time-and-materials arrangement once the relationship is established. Public sector and NHS-adjacent buyers add a formal procurement step on top, often a short tender or a framework call-off, before a contract is signed. A data processing agreement is usually bundled into the same contract as the statement of work rather than negotiated separately, since almost every UK engagement involves processing some amount of personal data under UK GDPR. ## Data Transfers Out of the UK Because we work as a remote team, personal data the client controls sometimes needs to move outside the UK for the engineering team to do its job, and UK GDPR treats that movement as a restricted transfer unless a recognised mechanism covers it. In practice that means the contract includes the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU's Standard Contractual Clauses, whichever fits the client's existing paperwork, so the transfer has a documented legal basis rather than an assumption that it's fine. ## Time Zones and Delivery Cadence UK working hours (GMT, moving to BST over summer) overlap almost the entire working day of teams based across Europe and most of the morning for teams on the US East Coast, which makes same-day answers the norm rather than the exception. Standups and sprint reviews sit inside the UK's core hours; day-to-day questions move over Slack or a ticket comment without waiting for a scheduled call. Compliance ## the UK rules we build around - ### UK GDPR and the Data Protection Act 2018 Every system that handles personal data for a UK client is built around the UK GDPR's lawful-basis, data-minimisation and retention requirements as implemented through the Data Protection Act 2018, with ICO guidance as the working reference for how those rules apply in practice. - ### International data transfer mechanisms Where personal data needs to leave the UK for the engineering team to work on it, the contract uses the IDTA or the UK Addendum to the EU Standard Contractual Clauses so the transfer has a documented legal basis. - ### FCA expectations for fintech products Financial products built for a UK client are designed with the FCA's regulatory perimeter in view: clear risk disclosures, audit trails on decisions that affect a customer, and outcomes that hold up under the Consumer Duty's focus on customer outcomes rather than just process. - ### NHS DSP Toolkit and DTAC for health software Health software built for an NHS-adjacent client is structured around the data security and protection standards the NHS DSP Toolkit assesses, and where the product is a digital health tool, the evidence the Digital Technology Assessment Criteria (DTAC) expects on clinical safety, data protection, interoperability and usability. - ### PECR for cookies and marketing email Cookie consent banners, marketing email opt-ins and any tracking that isn't strictly necessary for the site to function are built to PECR's consent requirements, alongside the UK GDPR basis for the underlying data. - ### WCAG 2.2 and public sector accessibility rules Sites and services touching the public sector are built to WCAG 2.2 AA and the Public Sector Bodies Accessibility Regulations 2018, with an accessibility statement the client can publish rather than an assumption that the design already qualifies. Working together ## Contracts, invoicing and working hours - ### Fixed-scope proposal for phase one The first phase is quoted as a fixed scope with a fixed price and date; work after that typically shifts to a rolling time-and-materials arrangement. - ### Data processing agreement bundled into the contract A DPA sits inside the same contract as the statement of work, covering how personal data is processed, stored and deleted over the engagement. - ### IDTA or UK Addendum for cross-border transfers When personal data needs to leave the UK for the team to work on it, the IDTA or the UK Addendum documents the legal basis for that transfer. - ### GBP invoicing Invoices are issued in GBP against milestones in the statement of work; cross-border B2B services are typically invoiced without UK VAT under the place-of-supply rules, with the client accounting for any reverse charge. - ### Overlap across GMT and BST UK hours overlap most of the European working day and the US East Coast morning, so standups and reviews sit inside the UK's core hours by default. Industries ## Industries we serve - [HealthcareClinical and patient-facing software that meets HIPAA technical safeguards and connects to the EHR your care teams already work in.](https://arbocode.com/industries/healthcare) - [Fintech & BankingFinancial software with KYC/AML checks and PCI DSS-aligned payment flows designed in from the schema onward, with ledgers that reconcile to the cent.](https://arbocode.com/industries/fintech) - [InsurancePolicy administration, claims and underwriting software that speaks ACORD with carriers, MGAs and agents from the first integration attempt.](https://arbocode.com/industries/insurance) - [Professional ServicesEngagement management, time tracking and client portals designed around how consulting and advisory firms bill for their time.](https://arbocode.com/industries/professional-services) - [Retail & E-commerceInventory, POS and storefront software that stays synchronized across every channel, with EDI connected for your wholesale partners.](https://arbocode.com/industries/retail-ecommerce) - [EducationLearning platforms and student portals driven by real rostering data and connected to Canvas, Google Classroom and your SIS over LTI 1.3.](https://arbocode.com/industries/education) - [LegalMatter management, document automation and conflict checking, with privilege, retention rules and trust accounting designed in from day one.](https://arbocode.com/industries/legal) FAQ ## Frequently asked questions Do you sign a data processing agreement under UK GDPR? Yes, as standard on any engagement touching personal data. The DPA is bundled into the same contract as the statement of work and sets out how data is processed, stored and deleted, rather than left to a separate document nobody reads later. How do you handle personal data transfers out of the UK? Where the engineering team needs access to personal data the client controls, the contract uses the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, whichever matches the client's existing paperwork, so the transfer has a documented legal basis. Can you build software that will pass an NHS DTAC assessment? We build to the DTAC's criteria on clinical safety, data protection, interoperability, usability and accessibility from the start, and structure the project so the evidence the assessment asks for (data flow maps, risk logs, accessibility statements) exists as a by-product of the build rather than a scramble at the end. Do you provide a fixed-scope proposal for UK procurement? Yes. The first phase is quoted as a fixed scope, fixed price and fixed date, which fits how most UK buyers, and especially public sector or NHS-adjacent ones, run procurement before a contract is signed. How do you invoice UK clients, and is VAT charged? Invoices are issued in GBP against milestones in the statement of work. Cross-border B2B services are generally invoiced without UK VAT under the place-of-supply rules, with the client's own accounting handling any reverse charge; a UK accountant should confirm the treatment for a specific contract. What working hours overlap can we expect across GMT and BST? UK hours overlap almost the entire working day for teams across Europe and most of the morning for teams on the US East Coast, so standups and sprint reviews sit inside UK core hours and same-day answers are the norm. How do you meet WCAG 2.2 and public sector accessibility rules? We build to WCAG 2.2 AA by default (keyboard navigation, contrast, screen-reader labeling) and, for anything touching the public sector, structure the project so an accessibility statement under the Public Sector Bodies Accessibility Regulations 2018 can be published rather than assumed. ## Start a project with a team that plans around your working hours Send a short description of the project. A senior engineer reads each request and answers with questions, next steps and an early budget range. [Get a free estimate](https://arbocode.com/get-a-quote) [Speak with an engineer](https://arbocode.com/contact)