A buyer's guide, from the vendor side of the table
Outsourcing Software
Development to Morocco
Yes, it is a good idea for most European and US companies that need senior backend, infrastructure or operations engineering, and it goes wrong in the same eight ways every time. This guide is mostly about the eight ways, because that is the part nobody selling it will tell you.
Written by the founder of an engineering company in Tetouan. The market data lives on our nearshore Morocco pillar, sourced and dated. This page is the contracts, the data, the money and the mistakes.
Bring your draft contract. We will tell you what is missing.
01 / The market, briefly
Big enough to be durable, small enough to be honest about
$2.8bn
Digital and outsourced services exported in 2024, per the Office des Changes. IT outsourcing alone was MAD 5.25bn in the first half of 2025.
2030
The state target is MAD 40bn in exports and 270,000 sector jobs under Digital Morocco 2030, with a new offshoring incentive framework from late 2025.
11,000
Degree-level engineers graduating a year. Vendors quote 24,000, which includes technicians. For senior hiring, the smaller number is the honest one.
The full data sheet, with every source dated and linked, is on the nearshore Morocco page. The short version for a procurement file: the sector is growing, the state is invested in it, and the senior talent pool is real but not unlimited.
02 / Engagement models
Which shape fits which buyer
| If you are | Buy this | Because |
|---|---|---|
| A CTO with a working team and one gap in it | One embedded engineer | You already run the process. You need capacity, not a vendor to run it for you. |
| A founder with more roadmap than people, permanently | A dedicated team | The roadmap will move. A standing team absorbs that; a fixed-scope project turns every change into a change order. |
| A procurement lead with a defined deliverable and a budget line | A scoped project | Hard edges suit procurement. Just be honest with yourself about whether the scope is actually fixed. |
| An IT director inheriting a system nobody understands | An audit first, then decide | You cannot scope what you cannot see. A diagnostic before a build is cheaper than a build that discovers the diagnosis. |
The three models are compared side by side, with who manages whom and what ends when, on the dedicated team page.
03 / What it really costs
All-in monthly, with the methodology shown
The rate is the number everyone quotes and it is the wrong number to compare. Two vendors at the same hourly rate can differ by a third on the monthly total once you add what one of them bills separately.
Here is what should be inside a monthly number for a senior engineer, and what is often left outside it.
Should be inside
- The engineer, full time, at a senior rate
- Their equipment and working environment
- Their manager, one to ones and performance
- Recruiting, including for the replacement if they leave
- Cover for illness and holiday, so a gap is the vendor’s cost
- Technical oversight from someone senior to them
Often billed on top, so ask
- A separate management or account fee
- A recruiting or placement fee per hire
- A charge for the overlap when someone is replaced
- Tooling, licences or infrastructure in the vendor’s name
- An exit or transition fee
- Your own time, which is real: a team you have to manage yourself is not cheaper
Our number, as a worked example
$4,800 to $7,200 a month for one senior engineer, with everything in the left column inside it and nothing in the right column billed on top. Lemon.io puts the Morocco senior market at $30 to $41 an hour, which is $4,800 to $6,560 a month at 160 hours, so the bottom of our range is the bottom of the market and the top is the management and the replacement risk.
Get any vendor's number in the same shape and the comparison becomes arithmetic. The rate landscape by region, sourced, is on the nearshore page.
04 / How it goes wrong
The eight failure modes, and the clause that prevents each one
None of these are exotic. They are the ordinary ways an outsourcing engagement fails, and every one of them was avoidable in the contract or in the first week. A vendor page that does not have a section like this is hoping you will not think of them until later.
You bought a rate and then paid for a manager
The hourly number looked like the whole cost. Then a management layer, a recruiting fee and a replacement charge arrived as separate lines, and the monthly total was a third higher than the pitch.
Compare monthly all-in, never hourly. Ask what is inside the number and get the exclusions in writing before the contract, not after the first invoice.
Senior on the call, junior in the repository
The engineer who impressed you in the interview was the sales engineer. The person committing code three weeks later was someone you had never met.
Name the individuals in the contract. Require that a substitution needs your written approval, and that you interview the replacement first.
Async by default, then blaming the timezone
Nobody set core hours. Messages crossed overnight, a two-line question took a day, and by month three the timezone was the official reason the project was late.
Fix shared hours in writing. Morocco on UTC+0 gives four to five hours with New York and most of a day with Europe. Use them, on a schedule, with the engineer in your standup.
Intellectual property assigned on final payment
A billing dispute in month five, and suddenly you do not own the code you have been shipping. The vendor does, until the invoice is settled on their terms.
Assignment on creation. The clause should say the work is yours as it is written. If a vendor will not agree to that, the negotiation is over.
EU personal data moved without a transfer mechanism
Customer records in the staging database, engineers in Morocco, and no standard contractual clauses because nobody asked. The data protection officer found out during an audit.
Morocco has no EU adequacy decision. Sign SCCs and a data processing agreement, and better still keep the data in your cloud region and grant access in place rather than exporting it.
The vendor owns the infrastructure
The cloud account, the domain, the CI pipeline and the monitoring were all in the vendor’s name. Leaving took six months and a lawyer, and some of it never came back.
Everything in your accounts from day one. The vendor gets access, never ownership. Revocation should be a switch you hold.
Nobody wrote down who decides
Two people both believed they owned the roadmap. Six weeks of polite disagreement, then a stalled sprint, then an escalation call about something that should have been a table on page one.
Publish the decision rights before the engagement. Roadmap, architecture, merge, hiring veto, people management. We put ours on the dedicated team page for exactly this reason.
The one engineer who understood it left
No documentation, no runbook, a deploy only one person could run. When they resigned the vendor replaced the seat, and the new person spent a month reading code nobody could explain.
Insist on documentation as a deliverable and on a deploy a new engineer can run from a runbook on day one. Ask the vendor how the last handover went.
05 / Contracts, IP and NDAs
Eight things that belong in the contract
This is what we put in ours, so it is evidenced rather than advised. Your counsel decides what is enforceable in your jurisdiction; we can only tell you what a serious vendor will agree to without an argument.
- 01
Contracting entity and governing law
Named in writing before work starts. Know whether you are contracting with a Moroccan SARL, a US entity or something else, and under which law you would enforce. Confirm enforceability with your own counsel; a vendor page is not legal advice, including this one.
- 02
Intellectual property assignment on creation
The work is yours as it is written, not on final payment. Moroccan law recognises assignment, and OMPIC handles registration where that applies, but the clause is what protects you day to day.
- 03
Non-disclosure before repository access
Signed before anyone opens your code, with the engineers named. A vendor who wants to start first and sign later has the sequence backwards.
- 04
Standard contractual clauses and a data processing agreement
Required for EU personal data because Morocco has no adequacy decision under Article 45 GDPR. The SCCs are the transfer mechanism under Article 46(2)(c); the DPA says what the processor may do.
- 05
Named individuals and a substitution clause
The people in the contract are the people in your repo. Substitution needs your approval, and you interview the replacement.
- 06
Notice period per seat, no exit fee
You are never locked into a headcount. When you stop, documentation and access hand over before the vendor leaves. If there is an exit fee, ask what it is buying you.
- 07
Replacement terms and the overlap
If someone is not working out, what the window is and whether you pay for the overlap. Written down, with a realistic timescale, before you sign.
- 08
Access, revocation and ownership of infrastructure
Your cloud accounts, your repositories, your domains. The vendor holds access scoped to the work, and you can revoke it the same day. Nothing of yours lives on their infrastructure.
06 / Data protection
Law 09-08, the CNDP, and what GDPR requires of you
Morocco has had a personal data law since 2009, Law 09-08, with a regulator, the CNDP. It is not GDPR, and the European Commission has not issued an adequacy decision for Morocco. Those two facts decide everything below.
No adequacy decision means SCCs
Under Article 45 GDPR Morocco is not adequate, so EU personal data transfers rely on standard contractual clauses under Article 46(2)(c). Sign them with a data processing agreement. It is paperwork, not a blocker, and a vendor who has done it before will have the documents ready.
The cleanest answer is not to transfer at all
Keep the data in your own cloud region and grant engineers access in place, scoped and logged. Nothing leaves your infrastructure, so the transfer question shrinks to remote access, which is far easier to document and revoke. This is how we work by default.
Law 09-08 differs from GDPR in ways that matter to a vendor
It uses a prior declaration and authorisation regime with the CNDP rather than internal records, it does not define portability the way GDPR does, its penalties are lower, and cross-border transfers can need CNDP authorisation. Your vendor carries those obligations on their side.
Security is a practice, not a certificate
Named identities with MFA, least-privilege access scoped to the engagement, audit logging on, secrets in a secrets manager, same-day revocation when someone rolls off. Ask a vendor to describe their revocation process. If they cannot, they do not have one.
Sources: IAPP on Moroccan data protection law and EU alignment; DPO Consulting's 2026 guide to Law 09-08. Both linked in the sources list. This is an operator's summary, not legal advice.
07 / Running the team well
Five habits, and the five ways buyers get it wrong
What works
Fix core hours and put the engineer in your standup
Not a status report from an account manager. The person, in the meeting, on a schedule that uses the overlap you are paying for.
Your tools, your repo, your review process
Pull requests reviewed like anyone else’s. The moment the vendor has a parallel process, you have two teams.
Direct the work, let the vendor manage the person
Priorities, acceptance and merge are yours. One to ones, performance and retention are theirs. Blurring that line is how you end up managing someone else’s employee.
Start small and contained
A real ticket in week one, deliberately bounded, so you judge the work before it matters.
Insist on documentation as a deliverable
Runbooks, architecture notes, a deploy anyone can run. It is the only protection against the single point of failure.
What buyers get wrong
Treating it as a handoff
Spec over the wall, silence for three months, surprise at the end. Outsourcing is not delegation of the thinking.
Hiring for the lowest rate
Then discovering the rate was low because the engineer was junior, or the manager was not in it, or both.
Letting the vendor own the infrastructure
Convenient in month one. The reason the exit takes six months.
Skipping the interview
Accepting whoever the vendor assigns, because it was faster. It is never faster.
No named decision-maker on your side
A dedicated team with nobody to point it stalls politely. Someone has to own the roadmap.
08 / Choosing a vendor
Eight red flags
No rate until they have qualified your budget
They are pricing you, not the work.
A very large headcount for a firm you have never heard of
A marketplace or a subcontracting chain, whichever is cheaper that week.
The timezone on their page is still GMT+1
Morocco moved to UTC+0 on 20 September 2026. A stale page tells you how often the rest of it is checked.
No section on what they do not do
Either they have not thought about it or they will not say.
IP or source code released on final payment
A dispute becomes a hostage situation.
They have never heard of standard contractual clauses
They have not handled EU data correctly before, and yours would be the first.
Everything hosted in their accounts, for your convenience
Convenience now, a six-month exit later.
Case studies with results but no mechanism
Percentages without what was actually built. Ask what the hard part was. Real engineers have an answer.
A longer checklist, ten questions written to be used against any vendor including us, is on the nearshore Morocco page. The capability pages for specific roles are on the hire hub: Python, Django, AWS, DevOps, React and Angular, and dedicated teams. For services beyond staffing: the Void Audit, AI integration and engineering consulting. One worked example of a long engagement: Federal Government Advisors.
09 / Questions
Straight answers
Is outsourcing to Morocco actually a good idea for my company?
If you need senior backend, infrastructure or operations engineering and you are in Europe or the US, yes. If you need a machine learning bench or fifty people next quarter, no. The eight failure modes above are what decides it in practice, and all of them are avoidable.
What could go wrong?
The same eight things, every time: hidden fees on top of the rate, a bait and switch on the engineer, no shared hours, IP assigned on final payment, EU data moved without SCCs, infrastructure in the vendor's name, nobody owning decisions, and one irreplaceable engineer with no documentation. Each has a clause or a habit that prevents it.
How are contracts and IP handled?
A named contracting entity and governing law before work starts, IP assigned on creation rather than on final payment, NDAs signed before repository access, named individuals with a substitution clause, notice per seat with no exit fee, and infrastructure in your accounts. That is what we sign; confirm enforceability with your own counsel.
What about data protection?
Morocco has Law 09-08 and a regulator, the CNDP, but no EU adequacy decision, so EU personal data moves under standard contractual clauses with a data processing agreement. The better answer is not to move it: keep it in your cloud region and grant scoped, logged access in place.
What does it really cost, all-in?
Compare monthly totals with the same things inside them, never hourly rates. For a senior engineer we publish $4,800 to $7,200 a month including the manager, equipment and replacement. Lemon.io puts the Morocco senior market at $30 to $41 an hour, so the bottom of our range is the market floor.
How do I manage a team across countries?
Fix core hours and use them, put the engineer in your standup rather than reading a status report, keep the work in your tools and your review process, direct the work yourself and let the vendor manage the person, and insist on documentation as a deliverable. Morocco on UTC+0 gives you four to five hours with New York and most of a day with Europe.
10 / Sources
What this page relies on
- [1]
- [2]
- [3]Lemon.io Software Developer Salary Report25 April 2026
- [4]
- [5]
- [6]
Checked on 23 September 2026.
Bring the draft contract
Thirty minutes with an engineer. Bring the contract another vendor sent you, or the one you are about to sign, and we will tell you which of the eight clauses is missing. You keep the answer whether or not you hire us.