Is there anything you can do to protect yourself with devs in other countries? I know people outsource development all the time ... Any advice on how to go about this properly?
Couple of thoughts
- Modularize the codebase. DB layer. API layer. UI layer. Models. Different groups dont have access to each other's code, only to running APIs and docs
- Build the models yourself, dont outsource that. Whether its a neural network, algo, whatever. Make it yourself and expose it with an API.
- Give the backend API layer to one group and UI layer to another group.
- Everything MUST be in source control. No binaries. You have to build from scratch.
- ** You do all pull requests and merge code. You do the tagging and builds. You have to fully understand it. None of this works if you dont fully understand the pieces.
- Have good test harnesses and dummy data to work with that is representative of real data.
- Dont give PROD DB access to offshore teams, manage that yourself.
- Work with many people on small assignments. If they do well, expand the assignments. Eventually you'll have 5-7 people you trust for larger assignments.
- Write good automated tests against the API layer
You have to be hands on, or this all grinds to a halt since you get a circular blame game of the the blocking item is.
You could take the first step to spend good money to hire a good technical person and pay that person well. Because it will pay off in protecting your IP.
If you're intending to establish a major presence in that other country, and spend a lot of time getting to know the local legal (and economic and labor) system, it might be possible. But, if you're not wanting (or perhaps even able) to invest a lot of time in knowing this other country and how business happens there (including what the laws are and which ones are enforced and how to get them enforced), you should consider it an unavoidable risk that your IP gets leaked.
Keep in mind that like many things in the Philippines, enforcement isn't very consistent and probably seriousness varies greatly by the region.
I came across a PH goverment website leaking copious amounts of PII and couldn't manage to get anyone at the National Privacy Commission to take it seriously. I lived there for about 3 years.
If they launch the same product in China or the Philippines, good luck.
Yes, that really happened to us. Their code didn't work very well, either.
Yes that really happened in real life to a business owner I know.
I generally advise consultants that lost a client to an outsourced shop to check back in 3-6 months.