The true cost of outsourcing business critical development

The hourly rate is the least important number on the quote.

If you run a serious eCommerce operation and you are thinking about Solidus or any custom Ruby on Rails work, you have almost certainly seen developers offering the same job at a fraction of the rate. Budgets are tight, and a rate a third of the size is hard to say no to. I understand the pull.

But the rate is one line in a longer sum. The others are how many hours the work really takes, how much of it gets done twice, how much of your own time goes into managing it, and what it costs you when something goes badly wrong. This article puts all of those into one formula, works it through for an invented shop, and then tells the story of what happened when one of my clients chose on rate alone.

All the worked examples here are made up. Where I use an assumption, I say so, and you should replace it with your own numbers.

Why this story matters to me.

A client came to me wanting to keep development costs low for their custom eCommerce platform. They needed Solidus, which is the right choice when you want proper customisation, the freedom to do whatever you want with your shop, and room to scale.

I did not have the capacity to start straight away, so I suggested several experienced developers who had worked with Solidus for years. One of them had previously worked at one of the companies that contribute to Solidus itself. These were not random profiles off a marketplace. They were people with a track record.

Their rates were not low, I will be honest. But their experience more than made up for it. They could do tasks in a quarter of the time someone less experienced would need, and the work was consistently up to standard. Once you counted the speed and the quality, the real cost was comparable, sometimes lower.

My client wanted a lower rate. So they hired a developer abroad whose rate looked too good to be true. It was. The rest of this article is what I learnt from it, turned into something you can use before you sign.

Total cost of ownership puts every cost in one sum.

Total cost of ownership (TCO) is the full cost of getting a piece of work done and living with it, not just the invoice. For a development job, I break it into four parts: the hours you pay for, the hours that get redone, your own time spent managing the work, and the expected cost of a serious incident.

$$TCO = r \, h \, (1 + f) + o \, c \, h + p \, L$$

Here $TCO$ is the total cost of ownership of the job in euro, $r$ is the developer's hourly rate, $h$ is the hours the work really takes the first time, $f$ is the rework share (the fraction of those hours that have to be done again, so $f = 0.1$ means one hour in ten is redone), $o$ is how many hours of your own oversight each developer hour needs, $c$ is what an hour of your own time costs the business, $p$ is the probability that the work causes a serious incident, and $L$ is what that incident would cost you. The term $p \, L$ is an expected value: the cost of the bad outcome weighted by its chance. Shares and rates such as $f$ and $o$ are explained in Foundations: ratios and rates, and $p \, L$ in Foundations: expected value.

The first term is what you pay the developer. The second is what you pay yourself. The third is what you pay later, on average. A quote only ever shows you part of the first.

Worked example: two quotes for a trade price list.

Comeragh Outdoor is an invented camping and outdoor shop in Waterford, at comeraghoutdoor.example, run by Colm. It takes about €1.56 million a year online, roughly €30,000 a week. Colm wants trade price lists added to his Solidus shop, so that clubs and schools see their own prices after they log in.

He has two options.

• A Solidus specialist based in Ireland at €80 an hour. That rate is the example's assumption.
• A developer abroad at €25 an hour. That rate is the example's assumption too, from the range of €20 to €40 an hour the original version of this article gave.

Every other input below is an assumption for the example, chosen to be plausible, not measured. I give the reason for each so you can swap in your own.

For the specialist:

• $h = 40$ hours. Colm's own estimate after a scoping call.
• $f = 0.10$. One hour in ten redone, because some rework happens on any job.
• $o = 0.10$. Six minutes of Colm's time per developer hour, for answering questions and testing.
• $c = €40$ an hour, what Colm values an hour of his own time at.
• $p = 0.02$. A 2% chance that this job leads to a serious incident.
• $L = €30,000$. One week of lost sales if the shop is broken or offline, plus Colm's time to sort it out.

Step one, the developer cost: $80 \times 40 \times (1 + 0.10) = 3,200 \times 1.10 = €3,520$.

Step two, Colm's own time: $0.10 \times 40 \times 40 = €160$.

Step three, the expected incident cost: $0.02 \times 30,000 = €600$.

Total: $3,520 + 160 + 600 = €4,280$.

For the developer abroad, the example assumes the work takes twice as long, because they do not know Solidus well. My own rule of thumb from the original version of this article was harsher: what takes a less experienced developer 20 hours might take a specialist five. Twice as long is the gentler assumption.

• $h = 80$ hours.
• $f = 0.40$. Four hours in ten redone, because unfamiliar code tends to need fixing after review.
• $o = 0.30$. Eighteen minutes of Colm's time per developer hour, for the extra explaining, checking and the time zone gap.
• $c = €40$, the same as before.
• $p = 0.15$. A 15% chance of a serious incident, because there are no tests, no review and production data is shared.
• $L = €30,000$, the same as before.

Step one: $25 \times 80 \times (1 + 0.40) = 2,000 \times 1.40 = €2,800$.

Step two: $0.30 \times 40 \times 80 = €960$.

Step three: $0.15 \times 30,000 = €4,500$.

Total: $2,800 + 960 + 4,500 = €8,260$.

The hourly rate was less than a third. The total cost of ownership is almost twice as high.

Each bar is one part of the total cost of ownership, in euro, on the vertical axis. The first four bars are the specialist, the last four the developer abroad. The developer hours really are lower abroad, €2,000 against €3,200. Everything else is higher, and the expected incident cost is the biggest bar on the chart. The saving on the rate is real. It is just smaller than the costs it brings with it.

The saving survives only if hours, rework and risk are controlled.

I want to be fair about this, because the formula cuts both ways. A lower rate can be the better deal. It depends on the other three terms, and you can do something about each of them.

Worked example: when the lower rate wins.

Take the same two options for Comeragh Outdoor, and change two things for the developer abroad. First, vary how long the work takes, from the same hours as the specialist up to four times as long. Second, add a version where Colm controls the risk: no production data leaves his systems, the code goes into his own repository with tests, and he pays by milestone. The example assumes that brings $p$ down to the specialist's 0.02.

The developer abroad costs $25 \times 1.40 + 0.30 \times 40 = 35 + 12 = €47$ per hour of work, before the incident term. So:

• With the risk uncontrolled, $p \, L = €4,500$. At 40 hours: $47 \times 40 + 4,500 = €6,380$. At 80 hours: €8,260. At 120 hours: €10,140. At 160 hours: €12,020.
• With the risk controlled, $p \, L = 0.02 \times 30,000 = €600$. At 40 hours: $47 \times 40 + 600 = €2,480$. At 80 hours: €4,360. At 120 hours: €6,240. At 160 hours: €8,120.
• The specialist stays at €4,280 throughout.

The horizontal axis is how many hours the developer abroad really needs for the job. The vertical axis is the total cost of ownership in euro. With the risk uncontrolled, the lower rate never wins, not even at the same hours. With the risk controlled and the same hours, it wins comfortably, €2,480 against €4,280. By twice the hours the two are level, and beyond that the specialist is less expensive again.

So the honest question is not "where is the developer?". It is "how many hours will this really take, how much will be redone, and what have I done about the risk?". Most of the rest of this article is about that last question.

Legal recourse depends on where the developer is.

When you hire a developer in Ireland, a contract means something. If they disappear with a deposit or deliver work that does not do what was agreed, you can sue in a court you know, and the judgment can be enforced.

Abroad, it depends on the country. Since 1 September 2023 the 2019 Hague Judgments Convention has applied in the EU, Ireland included, which makes Irish judgments easier to recognise and enforce in the other countries that are party to it, among them Ukraine, Uruguay and, since 1 July 2025, the UK¹. It only covers proceedings started at a time when the convention already had effect between the two countries². For a country outside the convention and without another arrangement with Ireland, you may face suing someone you have never met, in a court system you do not know, in another language. For a few thousand euro, most businesses simply write the money off.

The exact position for any one country is a solicitor's call. What you can control yourself is how much money is ever at risk.

Worked example: capping what a dispute can cost.

Deirdre runs an invented homeware shop in Limerick and is commissioning a €6,000 checkout rebuild from a developer abroad. Paying half up front puts €3,000 at risk on day one, with no realistic way to recover it.

Instead she splits the job into four milestones of €1,500 each, pays each one only after she has seen the work running on her own staging server, and keeps the code in her own repository from the first commit. The most she can ever lose is one milestone, €1,500, and she owns everything delivered up to that point. The contract is the same length. The exposure is half.

Ask for insurance, and see the certificate.

Here is something most people never think to ask: does your developer have professional indemnity insurance, the cover that pays when a mistake in their work causes your business a loss?

The offshore Solidus developers I have come across, companies and individuals alike, did not offer it. Without it, if their mistake brings your site down during peak trading or leaks customer data, the loss is yours alone.

Ask three things of anyone you hire for business critical work. Do you carry professional indemnity insurance? What is the limit, and does it cover work for clients in Ireland? Can I see the certificate? A developer who has it will send it in a minute.

Vetting someone you have never met is harder than it looks.

References can be invented. Portfolios can be borrowed. Work history can be made up entirely. That is true for any remote hire, wherever they live. It is just harder to check when there is no shared professional network, no company register you can read, and no way to meet in person.

Worked example: a vetting check that takes an afternoon.

Before Colm at Comeragh Outdoor hires anyone, he does four things. He asks for two previous clients and speaks to both on a video call, not by email. He asks for a link to public code the developer wrote, and has the specialist he already trusts spend one paid hour reading it (€80). He gives a small paid test task of four hours, on a copy of his shop with fake data. And he checks that the name on the contract matches the name on the invoice and the bank account.

The cost is the one hour review plus the test task: $80 + 4 \times 25 = €180$. Against the gap between €4,280 and €8,260 in the first example, that is the least expensive insurance he will ever buy.

The dependency trap closes slowly.

This is the one that really catches people, and it happened exactly like this to my client.

You hire a developer on a low rate. They build your system. It works, more or less. Time passes. Then you notice that the documentation is thin or missing, the code has few comments, and nobody else has ever been shown how it fits together. Without anyone deciding it, one person is now the only one on earth who understands how your shop works.

That is when the balance of power shifts. An urgent issue comes up, and the developer on the low rate is suddenly not so low. I have watched developers raise their rates sharply once they knew a client had no way out, to above what a UK specialist would charge. And you cannot simply replace them, because someone new needs weeks to understand an undocumented codebase, and a live shop does not have weeks.

Worked example: what the trap costs in November.

Back to Comeragh Outdoor, in the uncontrolled version. It is November, the busiest month for outdoor gear, and the trade price lists break. The original developer quotes €120 an hour for urgent work, an assumption for the example, and estimates 30 hours: $120 \times 30 = €3,600$.

Colm asks the specialist instead. With no tests and no documentation, the specialist needs about 60 hours just to find their way around before fixing anything, plus 15 hours for the fix itself, the example assumes. That is $80 \times 75 = €6,000$, and more than a week. Colm pays the €3,600, and the next quote will be higher.

In the controlled version, the code has tests and a short written guide. The specialist needs about 10 hours to get oriented plus the same 15 for the fix: $80 \times 25 = €2,000$, in a couple of days. The documentation that seemed like an optional extra on the first invoice is worth €1,600 on the first emergency, and Colm never has to accept a rate he did not agree to. I wrote more about why that independence matters in the benefits of working with a contractor.

Then came the data breach.

All of that is bad enough. It was not the worst of it.

The developer my client hired uploaded more than 14,000 customer records to GitHub: names, email addresses and purchase histories. The repository was private, so it was not open to the world. But customer data that should never have left the client's own systems was now sitting on a third party platform, put there by a developer who either did not understand data protection law or did not care.

When I found it, I removed the data straight away. That is still a personal data breach. The GDPR defines one as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, and under Article 33 a notifiable breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it³. In Ireland that authority is the Data Protection Commission (DPC)⁴. The penalties for the most serious infringements can reach €20 million or 4% of worldwide annual turnover, whichever is higher, under Article 83(5)³.

Giving a developer abroad your data is a transfer.

There is a quieter rule underneath this story. Under the GDPR, making personal data available to an organisation in a country outside the European Economic Area (EEA) counts as a transfer, even if nothing is ever emailed. The European Data Protection Board is explicit that remote access from a third country, even when the data is only displayed on a screen for support or troubleshooting, is a transfer, and its own example is a processor outside the EU remotely accessing data stored in the EU for support purposes⁵. A transfer needs a legal basis under Chapter V: an adequacy decision for the destination country, appropriate safeguards such as the European Commission's standard contractual clauses, or a narrow derogation³. Handing a developer outside the EEA a copy of your production database without any of that is a compliance problem before anything goes wrong.

An example: Deirdre's Limerick shop gives her developer a staging copy in which every name, email address and Eircode has been replaced with fake data. The developer can build and test everything, and no personal data leaves Ireland at all. The cost is a script that runs once. It also makes the 14,000 record story impossible. I go deeper into checking the people and companies who handle your data in vetting vendors before they undermine your compliance.

What happened when I reported it.

I did everything by the book. I reported the breach to the regulator, which for that client was the UK's Information Commissioner's Office (ICO), with full details of what happened, how many records were exposed and how. It was one of several serious breaches I reported around the same time.

The response was underwhelming. Five months later I received a generic email asking whether the issue was still going on. I confirmed that the underlying problems were still there. After that, nothing. No follow up, no action and no investigation that I am aware of.

I am not suggesting anyone should take data protection lightly. I never would, and neither should you. But the lesson I took is that the regulator is not the main thing to fear. Your customers are. The damage to their trust from a breach can be devastating whether or not anyone official ever acts on it.

Contractors in Ireland come with their own test.

Hiring in Ireland does not remove every complication. Whether a contractor is genuinely self employed or in fact an employee is decided by the real relationship, not by the label on the contract. Revenue points businesses to the five step framework from the Supreme Court's judgment in the Karshan case: is there pay for work, does the worker provide the services personally, does the business control what, how, when or where the work is done, what do all the facts say about the true nature of the relationship, and does any legislation change the answer⁶. The Code of Practice on Determining Employment Status, a joint code of Revenue, the Department of Social Protection and the Workplace Relations Commission, sets the same framework out in full⁷.

Who decides? Each of those three bodies decides for its own purpose, PRSI, tax or employment rights, and their decisions do not bind each other⁷. A limited company in between does not settle the question either. Where the Department of Social Protection finds that a personal service company is simply a vehicle for what is really a contract of service, it requires the end user to collect and pay Class A PRSI on what it pays that company⁷. And where a worker is reclassified as an employee for tax, the business has to operate PAYE⁶.

An example: a large invented Cork retailer engages a Solidus contractor for six months to work alongside its own team, on its hours, under its manager. The work is paid, personal and controlled, so all three filter questions point towards employment, and the retailer may find itself operating PAYE and paying employer PRSI on top of the fees. That belongs in the total cost of ownership as well. A contractor who delivers a defined piece of work, on their own methods and schedule, is a different picture, and the decision is worth getting advice on.

A checklist before you sign anything.

Before you engage anyone for business critical work, wherever they are, run through the same questions in order.

The specific checks:

• Legal recourse. Where is the developer, and could you enforce a judgment there? Cap the exposure with milestones either way.
• Insurance. Professional indemnity cover, its limit, and the certificate.
• References. Speak to real clients. Read real code, or have someone you trust read it.
• Documentation and tests. Make them a contractual requirement, and look at them regularly, not at the end. Tests are what make a codebase safe to hand over, which I cover in TDD and BDD in Ruby on Rails.
• Knowledge that is not stuck in one head. The code lives in your repository, under your account, and at least one other person has seen how it fits together.
• Data. Fake data for development, production data only where there is a lawful basis for it.
• The whole cost. Run the formula above with your own numbers before you compare quotes.

When the platform is the business, the shortcut is the expensive route.

If you are choosing Solidus, you are not running a hobby shop. You are running an operation that needs customisation the standard platforms cannot give you. You are probably thinking about automating your marketing, about referrals and retention, about data. At that level, your technology platform is a strategic asset.

The developers who understand Solidus deeply, who build systems that can be maintained and scaled, who document properly and who work within a legal framework that protects you, earn their rate. And you do not always need one full time. Much of this work arrives in bursts, an upgrade here and an integration there, which is exactly what my Task Outsourcing offer is for: an expert a few days a month, exactly when it matters, with monthly terms, honest estimates and everything documented so you are never locked in.

Whoever you hire, compare the total cost of ownership, not the rate. The rate is the number on the quote. The total is the number on your accounts.

Footnotes

1. Hague Conference on Private International Law, Status table: Convention of 2 July 2019 on the Recognition and Enforcement of Foreign Judgments in Civil or Commercial Matters, HCCH, accessed November 2026, https://www.hcch.net/en/instruments/conventions/status-table/?cid=137

2. Hague Conference on Private International Law, Convention of 2 July 2019 on the Recognition and Enforcement of Foreign Judgments in Civil or Commercial Matters, Article 16, HCCH, https://www.hcch.net/en/instruments/conventions/full-text/?cid=137

3. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 4(12), 33, 44 to 49 and 83(5), EUR-Lex, https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

4. Data Protection Commission, Breach notification, https://www.dataprotection.ie/en/organisations/know-your-obligations/breach-notification

5. European Data Protection Board, Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR, version 2.0, 14 February 2023, https://www.edpb.europa.eu/system/files/documents/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf

6. Revenue, Determining the employment status of an individual, Guide to PAYE, published 28 January 2026, https://www.revenue.ie/en/employing-people/becoming-an-employer-and-ongoing-obligations/guide-to-paye/determining-the-employment-status-of-an-individual.aspx

7. Department of Social Protection, Revenue and Workplace Relations Commission, Code of Practice on Determining Employment Status, October 2024, https://assets.gov.ie/static/documents/code-of-practice-on-determining-employment-status-cb301d37-93cb-4fbf-b45c-6997ed370f04.pdf