The software development market in Iraq is growing fast — which is good — but it also means wide variation in quality among those presenting themselves as a "development company." This guide helps you, as an Iraqi or Gulf business owner, tell a serious partner from one who will cost you your project twice. The criteria are general, but we've highlighted what matters specifically in our market.
What to Verify First
- Real past work you can view or try — not just abstract screenshots.
- A clear legal entity: a registered company with a formal contract, not just an individual operating under a fleeting trade name.
- The ability to communicate clearly in your language and understand your business need, not only the technical one.
- A process: how do they run the project, report progress, and handle change?
Local Red Flags
Some signals are common in fast-growing markets and deserve special caution:
- A very low price against huge promises — often an incomplete project is delivered, then successive fees are requested.
- Refusing to sign a written contract defining scope, ownership, and payments.
- Total dependence on one person with no team or documentation — if they leave, your project stops.
- No mention of testing, security, or post-delivery.
- A product run with no repository access, no documentation, and no continuity clause — a black box that stops with the vendor.
A fundamental warning sign: a company that won't put the ownership model in the contract, or that keeps your accounts and data in its own name. The vagueness is the danger, not the model itself.
Code Ownership — Know Your Model Before You Sign
This is where business owners most often make a costly mistake, and usually because the contract is silent rather than because the model is bad. Two models exist in the market: a vendor who transfers the code and intellectual property to you on payment, and a vendor who keeps both and licenses the product to you. If the model is a licence — which is ours at PhiBit, across every type of engagement — insist that the contract states four things explicitly: a full, uninterrupted licence to use the product; the level of repository access you get (ours: read-only access to your project's repository); a continuity clause that protects your business if the vendor stops trading and lets you keep operating and maintaining the product through a developer of your own choosing; and the buyout price should you later want to own it outright under a separate agreement. Under either model, never concede the accounts (store, servers, domain), your data, or your brand — those are in your name from day one. The real risk is discovering the model a year into paying for it.
Post-Launch Support
A product doesn't end at launch — it begins there. Ask before signing: who fixes bugs after launch? With what response time? At what cost? Is there a clear maintenance agreement, or will you negotiate from scratch at the first problem? A product with no maintenance plan is deferred debt that will come due at the worst possible time.
Non-Negotiable Questions
- Who keeps the code and the IP, what licence do I hold, and are my accounts, data, and brand in my own name?
- Do you work under a written contract defining scope, payments, and ownership?
- Who is actually on the team, and what happens if a key person leaves?
- How do you handle security and testing?
- What are the support and maintenance terms after launch?
At PhiBit we work under clear contracts and one unambiguous model, stated in writing up front: the code and IP remain ours, you hold a full, uninterrupted licence to use the product, you get read-only access to your project's repository and a written continuity clause that protects your business, and your accounts, data, and brand stay in your name. We combine local development with a UK-registered company. Email us at [email protected] to discuss your project openly.