Software Outsourcing for Colombian Companies: Law 1581 and a 2-Hour Window

Yes, a Colombian company can outsource software development to a team in Bangladesh. Under Law 1581 of 2012, sending data to a vendor that processes it on your behalf is a "transmission", and Decree 1377 of 2013 lets it run under a written processor contract. RAITHub, in Dhaka, works in English only, quotes a fixed price after a free 15-minute audit, and overlaps Bogotá 08:00–10:00 daily.

This guide is for two readers: Colombian founders and operators who want a web product built outside Colombia, and US startups whose product or operations team sits in Bogotá or Medellín and who want a second engineering team. It covers what the build costs in dollars and pesos, what Colombian data protection law expects when a foreign vendor touches personal data, what local payment methods add to scope, and how the daily overlap works. RAITHub builds web applications and progressive web apps (PWAs), not native iOS or Android apps.

Can a Colombian company outsource software development abroad?

Yes. Nothing in Colombian law stops a company hiring a foreign software team. The question that matters is what happens to personal data: customer records, employee data, anything that identifies a person. If the vendor will see production data, the contract and the setup need to follow Law 1581. If the vendor only ever works with test data and your team controls production, most of that question goes away.

The practical steps are the same as for any serious vendor:

• A written scope and a fixed price, or a dedicated team on a monthly basis.
• An NDA before detailed discussion, and intellectual property assigned to you.
• Code, hosting and third-party accounts in your company's name, not the vendor's.
• A processor contract (in Colombian terms, a contrato de transmisión) if the vendor will process personal data.

For a wider checklist on vetting a team in Bangladesh, see whether it is safe to hire a Bangladesh software agency.

How much does outsourced software development cost for a Colombian company?

A custom web product costs its engineering hours times the rate. For a first version with sign-in, a few roles, one core workflow, local payments and an admin area, plan for roughly 700 to 1,000 hours. The table does the arithmetic for one illustrative scope of 840 hours.

The hour counts and both rates are assumptions chosen to show how the line items combine. They are not quotes and not RAITHub prices. The two rates sit inside the bands firms show on the first page of Clutch's Colombia developer directory, where most listed companies show an average of $25–$49 an hour and a few show $50–$99.

Line item (illustrative)	Assumed hours	At US$40/hour	At US$75/hour
Discovery and written specification	50	US$2,000	US$3,750
UX and interface design for the core flows	80	US$3,200	US$6,000
Sign-in, roles and account management	70	US$2,800	US$5,250
Core workflow (the thing customers pay for)	260	US$10,400	US$19,500
Payments: cards, PSE and a wallet through a gateway, plus reconciliation	90	US$3,600	US$6,750
Admin area and reporting	80	US$3,200	US$6,000
Privacy features: authorization records, access and deletion requests	40	US$1,600	US$3,000
Automated tests and QA	130	US$5,200	US$9,750
Deployment, monitoring and handover	40	US$1,600	US$3,000
Total (USD)	840	US$33,600	US$63,000
Total (COP, at 3,366.90 per USD)		about COP 113.1 million	about COP 212.1 million

The peso figures use the rate of 3,366.90 COP per US dollar published by ExchangeRate-API on 30 September 2026. The peso moves, so if you budget in COP, use the day's official TRM from Banco de la República and agree in the contract which currency the price is fixed in. A quote fixed in US dollars moves in pesos every day; that is a finance decision, not an engineering one.

Two lines are easy to underprice. Payments look like one integration but every Colombian method answers late, which is covered below. Tests look optional until a release breaks checkout. A smaller first version, such as one role and card payments only, can come in well under half the total. The MVP cost estimator lets you change the scope and watch the hours move, and the cost to hire developers in Bangladesh explains how Dhaka rates are built.

What does Law 1581 say about sending personal data to a foreign developer?

Colombian law separates two kinds of cross-border data flow, and which one you have decides what applies. Decree 1377 of 2013 defines them in Article 3 (Decree 1377 of 2013, Bogotá legal database):

	Transfer (transferencia)	Transmission (transmisión)
Who receives the data	Another controller (Responsable), who then decides how to use it	A processor (Encargado) acting on your behalf
Typical example	Selling or sharing a customer list with a partner	A software vendor or hosting provider working on your system
Main rule	Law 1581, Article 26: only to countries with an adequate level of protection, unless an exception applies	Decree 1377, Articles 24 and 25: a written contract with the processor

Article 26 of Law 1581 prohibits transferring personal data to countries that do not provide adequate levels of protection, with exceptions that include the data subject's express authorization, contract performance and a few sector cases (Law 1581 of 2012, Bogotá legal database). A development team working on your system on your instructions is normally a processor, so the transmission rules are the ones to look at first.

For transmissions, Article 24 of Decree 1377 says an international transmission between a controller and a processor does not need to be notified to the data subject or have their consent when there is a contract in the terms of Article 25. Article 25 says that contract must set out the scope of the processing, the activities the processor carries out for you, and the processor's obligations to you and to data subjects, including processing only under your policies, keeping the data secure and keeping it confidential.

The regulator is the Superintendencia de Industria y Comercio (SIC). Under Article 23 of Law 1581, it can impose fines of up to 2,000 monthly minimum legal wages, among other sanctions. DLA Piper's summary of Colombian transfer rules is a readable English overview if you want one before speaking to counsel.

This is general information, not legal advice. Whether your arrangement is a transmission or a transfer, which countries the SIC currently treats as adequate, and what your privacy policy must say depend on your business; confirm with your adviser.

What RAITHub does in practice: it signs a data processing agreement or a transmission contract drafted by your counsel, follows your security controls, and works in accounts you own. Where possible, development runs on test data and your team keeps production access. RAITHub is not SOC 2 or ISO 27001 certified. If your customers send security questionnaires, see answering a first security questionnaire without SOC 2.

What do PSE and Nequi add to a Colombian web app?

Colombian customers expect more than cards: PSE bank transfers, the Nequi and Daviplata wallets, and Bancolombia's transfer button and QR code. Most products reach them through a payment gateway. Wompi, for example, lists all of those among its Colombian methods, and its documentation says plainly that "none of the payment methods provide a synchronous (immediate) result": every new transaction starts as PENDING and ends as APPROVED, DECLINED, VOIDED (cards only) or ERROR (Wompi: payment methods).

That changes the data model. An order is not paid when the customer clicks; it is pending until the gateway says otherwise. The gateway tells you through an event sent to your server, and you must check that the event is genuine before you trust it. Wompi signs each event: you concatenate the values of the fields listed in signature.properties, append the timestamp and your events secret, hash the result with SHA-256 and compare it with signature.checksum. Your endpoint must answer HTTP 200, or Wompi retries up to 3 times over 24 hours (Wompi: events). A minimal TypeScript check, as engineering guidance:

import { createHash, timingSafeEqual } from 'node:crypto'

type WompiEvent = {
  event: string
  data: Record<string, unknown>
  signature: { properties: string[]; checksum: string }
  timestamp: number
}

// Reads a dotted path such as "transaction.status" from event.data.
function valueAt(data: Record<string, unknown>, path: string): string {
  const value = path.split('.').reduce<unknown>(
    (node, key) =>
      node && typeof node === 'object' ? (node as Record<string, unknown>)[key] : undefined,
    data,
  )
  return value === undefined || value === null ? '' : String(value)
}

export function isAuthentic(event: WompiEvent, eventsSecret: string): boolean {
  const payload =
    event.signature.properties.map((p) => valueAt(event.data, p)).join('') +
    String(event.timestamp) +
    eventsSecret
  const expected = createHash('sha256').update(payload).digest('hex')
  const given = event.signature.checksum.toLowerCase()
  return (
    expected.length === given.length &&
    timingSafeEqual(Buffer.from(expected), Buffer.from(given))
  )
}

// Only APPROVED means the money arrived. Everything else is not paid.
export function orderStatus(transactionStatus: string) {
  switch (transactionStatus) {
    case 'APPROVED':
      return 'paid'
    case 'PENDING':
      return 'pending'
    case 'DECLINED':
    case 'VOIDED':
    case 'ERROR':
      return 'failed'
    default:
      return null
  }
}

Budget for the tests around this, not only the integration: an event that arrives twice, one that arrives before the customer is redirected back, a PSE payment abandoned at the bank, a forged event with a bad checksum. The guide to testing payments and webhooks lists the cases.

What RAITHub has and has not shipped: RAITHub built Stripe rent collection for PropDesk, a property management platform with 4 roles and 1,024 automated tests. TheSkinProof, the founder's own venture rather than a client, takes bKash, Nagad, SSLCommerz and cash on delivery, which are wallet and bank flows with the same late-answer shape. RAITHub has not shipped Wompi, PSE or Nequi in production, so that scope is priced and tested as new work, and this section is guidance from Wompi's documentation.

How does a daily 2-hour overlap between Dhaka and Bogotá work?

Dhaka is UTC+6 and Bogotá is UTC−5, and neither observes daylight saving, so the gap is 11 hours all year. RAITHub offers a fixed daily 2-hour overlap in the Dhaka evening, 19:00 to 21:00, which is 08:00 to 10:00 in Bogotá. Everything else is async, with a written handoff every day.

City	Overlap window	Changes with the seasons?
Dhaka (UTC+6)	19:00–21:00	No
Bogotá, Medellín, Cali (UTC−5)	08:00–10:00	No
New York (for US startups with Colombian teams)	08:00–10:00 in winter, 09:00–11:00 in summer	Yes, with US daylight saving

For a Colombian team, the window is the first two hours of the working day: long enough for a standup, a demo or a decision call. The rest works like this: your team writes feedback and questions during its day, RAITHub works on them overnight Bogotá time, and a written handoff is waiting in the morning. The working week is agreed per client at the start, including Colombian public holidays.

If you are a US company with the product team in Colombia, the same 2-hour window covers both, because Bogotá matches New York in the northern winter and sits one hour behind it in summer.

Do you need a Spanish-speaking team?

Be clear about this before you start. RAITHub works in English only: calls, specifications, tickets, handoffs, documentation and support. There is no Spanish-language delivery.

That suits companies whose product and engineering conversations already happen in English, which is common for startups selling to US customers and for US companies with Colombian teams. If your product needs a Spanish interface, the app can be built to read its text from translation files, but your team writes and reviews the Spanish copy. If your operations staff, approvers or end users need to talk to the developers in Spanish, choose a Spanish-speaking team.

Colombian agency, freelancer or a Dhaka team?

Factor	Colombian agency	Freelancer	RAITHub (Dhaka)
Live overlap with Bogotá	Full working day	Depends on the person	2 hours daily, then async with written handoffs
Language	Spanish and often English	Varies	English only
Pricing	Hourly or fixed, varies	Usually hourly	Fixed written quote after a free 15-minute audit; no public rates
On-site meetings	Possible	Possible if local	No; RAITHub has no office in Colombia
Tests and review	Varies by agency	Usually one person, no review	Test suite gated in CI, founder-reviewed architecture
IP	Per contract	Per contract	Assigned to you; NDA standard

For how to weigh fixed price against hourly billing, see fixed price vs time and materials. US companies can use the offshore IP assignment checklist for the contract.

Why RAITHub for this

• A number before you commit. A free 15-minute technical audit, then a fixed written quote with its assumptions listed, as fixed scope or a dedicated monthly team. See pricing and engagement models.
• A predictable slot at the start of the Bogotá day. The same 2 hours every day, all year, with no daylight-saving shifts on either side, plus a written handoff every day.
• Late-answer payments treated as the norm. PropDesk's Stripe rent collection and TheSkinProof's wallet payments were both built around pending states and webhooks. Colombian gateways would be new work, and the quote says so.
• Your data stays under your controls. A transmission contract or DPA, work in your accounts, test data by default, and IP assigned to you.
• Tests in the price. The MVP development service includes a real test suite gated in CI, not an optional extra.

When you don't need us

• You need Spanish-language delivery. RAITHub works in English only.
• You need a native iOS or Android app. RAITHub builds web apps and PWAs, and does not offer native mobile development.
• You need all-day live collaboration or people in the room. A team in Colombia, or in your time zone, fits better than a 2-hour window.
• Your buyers require a certified supplier. RAITHub holds neither SOC 2 nor ISO 27001.
• Off-the-shelf software already does 90% of the job. Pay for the subscription and spend the difference on the business.

Sources checked on 1 October 2026. Rates, exchange rates and gateway documentation change; check the linked pages before you budget. Legal points are general information; confirm with your adviser.

To turn your scope into a fixed number, book the free 15-minute technical audit. Bring the list of user roles, the payment methods your customers use, and whether the team will need access to production data.

Frequently asked questions

Can a Colombian company legally use a software developer in Bangladesh?

Yes. Hiring a foreign vendor is allowed. If the vendor processes personal data on your behalf, Decree 1377 of 2013 treats that as a transmission and expects a written contract setting out the scope, the processor's activities and its security and confidentiality duties. This is general information; confirm with your adviser.

What is the difference between a transfer and a transmission under Colombian law?

A transfer sends data to another controller, who decides how to use it, and Law 1581 Article 26 limits transfers to countries with adequate protection unless an exception applies. A transmission sends data to a processor acting for you, such as a development team, and runs under a contract.

How much does it cost to outsource a web app from Colombia?

It is hours times the rate. An illustrative 840-hour first version comes to US$33,600 at US$40 an hour, about COP 113.1 million, or US$63,000 at US$75 an hour, about COP 212.1 million. A fixed quote after an audit gives the real figure.

What hours does a Dhaka team overlap with Bogotá?

RAITHub offers a daily 2-hour window, 19:00 to 21:00 in Dhaka, which is 08:00 to 10:00 in Bogotá all year, because neither country uses daylight saving. The rest of the work is async with written daily handoffs, and the working week is agreed per client.

Does RAITHub work in Spanish?

No. RAITHub works in English only, for calls, documents, tickets and support. An app can be built with translation files for a Spanish interface, but your team writes and reviews the Spanish text.

Has RAITHub integrated PSE or Nequi before?

Not in production. RAITHub has shipped Stripe rent collection for PropDesk, and TheSkinProof, the founder's own venture, runs bKash, Nagad and SSLCommerz. A Colombian gateway would be scoped, priced and tested as new work.

Who regulates data protection in Colombia?

The Superintendencia de Industria y Comercio (SIC) enforces Law 1581 of 2012. Article 23 lets it impose fines of up to 2,000 monthly minimum legal wages, among other sanctions.