Software Development in the US
We are an Indian engineering team working with businesses in the US. Written scope before any code, and a fixed quote in USD.
Working hours
Our day ends at 07:30 in the US (08:30 on summer time), before yours begins, so we work asynchronously: written updates land overnight and are waiting when you start.
Quoted in USD
There is no general VAT in the US at present, so the quote is the amount you pay.
Data protection
Work for this market is scoped against state privacy law, principally the CCPA and CPRA in California, agreed before development starts rather than retrofitted afterwards.
Written scope
Every engagement starts with a written scope and a fixed USD quote within 24 hours, so the price is set before work begins.
About Software Development
We are a small, senior software studio in Noida, Delhi NCR building custom software, web apps, SaaS products, and mobile apps for companies in India and abroad. You work directly with the engineers writing your code, not an account manager or an offshore team you never meet.
What the engagement includes
- You talk to the engineers building your software, directly. No account manager relaying messages, no offshore team you never meet.
- A written scope before any code, and a flat quote inside 24 hours, so the price is set before we start.
- Senior developers on your project from day one. We do not sell junior time at senior rates or swap people in after the sale.
- You own your code, your repo, and your hosting. Nothing is locked to us, and you can walk with everything at any point.
- Small team, direct access. When something breaks a year later, you message the people who built it, not a ticket queue.
- Proof we build real things: our own products PlugEV (an OCPP EV-charging platform), CloudNX (cloud hosting), and ToolKiya (online tools), plus 70+ client projects shipped.
What a US build gets asked for later: SOC 2 evidence, BAAs and WCAG 2.1 AA
The SOC 2 question worth asking about custom software is not whether the developer holds a report but whether the system being built will let you pass one, because the day you sell to American companies their security reviewers will ask for yours. A SOC 2 report is an attestation by a licensed CPA firm under AICPA standards rather than a certificate, and the type 2 report enterprise buyers usually want tests whether controls actually operated across a review period, not just whether they were written down. That makes it a property of the software as much as of the company. Change management is the clearest case: the auditor samples production changes and expects each one to trace back to a reviewed pull request, a passing pipeline and an approved deployment, and a team that deploys from laptops cannot reconstruct that trail afterwards. Access works the same way. Named accounts through your identity provider, enforced MFA, admin actions written to an audit log the application cannot quietly edit, and a joiner and leaver record that includes us, since an outside team with production access sits inside the vendor management part of your scope and you should be able to revoke it in one step. The AICPA's own journal warned in 2026 about SOC 2 reports sold as fast and easy, so reviewers now read the report itself rather than accepting the logo on your security page. Which criteria and which period go into scope is for you and your auditor to settle.
Health data in the US falls under one of two regimes, and which one applies decides the contract before it decides the schema. If your customers are covered entities such as providers, health plans or clearinghouses, and your software creates, receives, maintains or transmits their protected health information, you are their business associate, and any developer or host touching it on your behalf is a subcontractor who needs a written business associate agreement with you before the access starts. HIPAA does not forbid access from outside the US, and HHS guidance says so, but the same guidance says overseas processing can raise risks that call for extra contractual protection, and your customers' own contracts may be stricter than the statute. The cleanest design keeps real PHI out of development and staging entirely, with synthetic data there and production access narrow and logged. The Security Rule to build against is still the current one: HHS proposed an overhaul on 6 January 2025 and, as of this writing, has not finalized it. If the product is a consumer health app outside HIPAA that draws data from more than one source, the FTC's Health Breach Notification Rule applies instead, and since 29 July 2024 it counts an unauthorized disclosure as a breach. A health event sent to an analytics or advertising SDK without the user's authorization can therefore require notice within 60 calendar days of discovery, which turns the tracking plan into a legal document. Which regime you are under is for your own counsel.
If a city, county, school district, public university or a recipient of HHS funding will use what you are building, their accessibility deadline becomes your acceptance criterion. The Department of Justice's Title II rule requires state and local governments to meet WCAG 2.1 AA for the web content and mobile apps they provide directly or through contractual, licensing or other arrangements, and ada.gov states plainly that content a vendor provides for them is covered. An interim final rule on 20 April 2026 pushed the dates back a year, to 26 April 2027 for entities with a population of 50,000 or more and 26 April 2028 for smaller ones and special districts, without touching the standard. HHS followed for its funding recipients under Section 504, effective 7 May 2026: 11 May 2027 for those with fifteen or more employees and 10 May 2028 for the rest. The mistake is reading the extension as slack. A contract signed this year covers software that will still be in service after those dates, so expect the requirement in it, and the exceptions are narrow: third-party content is excepted only when members of the public post it, never when a contractor does. In practice that means accessible components from the first sprint, keyboard and screen reader testing on the flows the contract names, and a conformance report you can hand over when a buyer asks, because retrofitting a form-heavy portal means rebuilding its interaction layer. Whether a given buyer or deadline applies to you is for your own counsel.
How we work with US clients
A US engagement gets agreed twice. Once with the person who wants the thing built, and then again with legal, security, procurement and finance, who arrive separately and rarely in the same week. That second round is where a supplier outside the country loses the calendar: a master services agreement to redline, a security questionnaire, a certificate of insurance, and a vendor portal that assumes everyone it onboards can sign a W-9. Send all of it while the scope is still being written rather than in the week you wanted to start, and where the honest answer to a row is that we do not hold something, we write that in rather than leaving it blank.
You are also buying from a company you cannot drop in on, so the evidence has to do the work an office would otherwise do. What we send is live production URLs rather than a deck, a written scope with one fixed number against it, and the names of the people who will do the work rather than a bench that changes after signature. What we will also tell you is the shape of what you are hiring: a small team in Noida that has been building since 2021, not a firm that can put four more people on your project next Monday. If that is what your timeline needs, we say so before the contract rather than after it.
PlugEV
Custom software from the protocol layer up: an OCPP Central System, a NestJS billing backend and an operator dashboard, built as one product and run in production on real chargers.
Full service detail
This page covers how we work with clients in your market. The complete Software Development page, with the full technical detail, process and frequently asked questions, is written in English.
Read the full service page (English)Questions US clients ask
Does our site have to meet ADA accessibility requirements?
If you are consumer facing in the US, build as though it does. Demand letters over inaccessible websites are routine and cheap to send, federal work brings Section 508 with it, and the Department of Justice rule under Title II sets WCAG 2.1 AA for state and local government entities on a timetable your counsel can confirm for your size band. We work to WCAG 2.2 AA and test with a screen reader rather than relying on an automated scan, because automated tools catch perhaps a third of real issues and the other two thirds are the ones that end up in a letter.
How do we know you will still be here in two years?
Nobody can promise you that, and a supplier who does is selling something. We have been building since 2021 and we maintain what we build, which is the honest version of the answer. The useful version is that it should not have to matter. The repository is in your GitHub organization, the domain and hosting accounts are in your company name, the stack is Next.js, Laravel, Flutter and Postgres rather than anything only we can read, and the handover document exists before you ask for it. If we vanished tomorrow, another agency could pick it up without needing to call us.
Can you sign our NDA and work under our MSA?
Yes to the NDA. Send your standard one and it comes back signed within 24 hours, before you describe the project in any detail. Yes to the MSA too, with the caveat that we read it properly rather than signing to be agreeable. The two clauses we usually come back on are unlimited liability, where we ask for a cap tied to the fees, and an IP clause drafted broadly enough to sweep in the internal tooling we bring to every project. Everything built for you transfers to you in full on final payment. We mark up those two and sign the rest.
Something breaks at two in the afternoon in Chicago. What actually happens?
Two in the afternoon in Chicago is past midnight here, half past midnight in summer and half past one in winter, so the truthful answer depends on what you are paying for. Monitoring does not keep our hours and the alert fires whatever the clock says. Whether a person is awake to act on it depends on your plan, because we are not a 24/7 on-call operation as standard, and we would rather tell you that while you are choosing a plan than while your checkout is down. Without out-of-hours cover written into the contract, the realistic answer is that it is picked up at the start of our day, which is the middle of your night, and you should price that in when you decide.
Software Development: common questions
What does a software development company actually do?
It designs, builds, and maintains software for other businesses: custom apps, web and SaaS products, mobile apps, e-commerce, and the backends behind them. A good one also handles scope, design, hosting, and support so you are not stitching solo developers together. buildbyravirai does all of that with a small senior team out of Noida, for clients in India and abroad.
How do I hire a software development company in India without getting a body shop?
Ask who writes the code and insist on talking to them before you sign. Ask for a written scope and a fixed price, not an open hourly meter. Ask whether the seniors on the sales call are the ones who will actually build it. With us you get direct access to the engineers, a flat quote in 24 hours, and the same small team from scope to launch.
How much does custom software development cost?
It depends on scope, so we do not publish one-size ranges that fall apart on contact with a real brief. We write the scope down, quote one flat INR number against it, and get you the exact figure back within 24 hours. There are no surprise invoices and no per-hour meter. If you are a foreign parent company, we can invoice in USD to your entity. Our pricing page has more detail.
What is your team size, and who works on my project?
We are small on purpose. The team is founder and lead developer Ravi Rai plus a project manager, a designer, and an SEO specialist. Senior engineers do the work, you talk to them directly, and nobody is swapped for a junior after the sale. If a project needs more hands than we can staff well, we tell you that up front.
Do you work with international clients and invoice in USD?
Yes. We work with clients in India and abroad, in the US, UK, Canada, and the UAE. We work remotely on written scopes and regular demos, so timezones have not been an issue. We quote in flat INR and can invoice in USD to a foreign parent entity if that is easier for your accounting.
Other markets we work in
Tell us what you are building in the US
Send the scope, or just the problem. You get a written scope and a fixed USD quote back within 24 hours, from the engineers who would do the work.