Morocco has established itself as the reference nearshore destination for French companies outsourcing their development: Paris time zone, French as the working language, a pool of engineers trained in recognised schools, rates significantly below the French market (Nearshore, Offshore, Onshore). But this attractiveness has a flip side: the offer is abundant and uneven, from long-established service companies to recent structures set up to ride the demand. For a French executive or CIO selecting remotely, distinguishing the durable partner from the fragile subcontractor is issue number one — well before negotiating the rate. This article proposes a complete evaluation grid in six parts: company solidity, verification of technical competence, working method, contractual framework, GDPR compliance and reversibility. A software company based in Rabat for more than 20 years, CRYSTAL IT is regularly evaluated by French buyers (our IT offshoring services): this grid is the one we recommend applying to us, as to any other provider.
Check the Company's Solidity Before Looking at the Portfolio
The first question is not "can this provider code?" but "will this provider still exist in three years?". A software project lives long after delivery: maintenance, fixes, evolutions, security updates. A provider that disappears leaves you with code nobody knows — the most expensive scenario of all. Longevity is the first indicator: a company that has operated for ten or twenty years has weathered economic cycles, retained clients and built a reputation it has an interest in defending. The size and stability of the team also matter: ask how many developers are permanent employees, and what the average tenure is — high turnover at the provider will become your problem.
Then verify legal existence and real substance: registration in the Moroccan trade register, a verifiable physical address, identifiable executives. A video call from the premises, or better a site visit — Rabat and Casablanca are three hours from Paris — says more than a polished website. Beware of structures that present neither a named team nor a precise address: undeclared cascading subcontracting is the hidden risk of outsourcing, and it often starts with that opacity. An additional indicator of substance: a provider that publishes and operates its own software products in production demonstrates that it knows not only how to deliver, but how to maintain over time.
- Longevity: a company established for more than ten years has a reputation to defend and clients who have tested it.
- Permanent team: ask for the share of permanent employees and average tenure — the provider's turnover becomes your cost.
- Verifiable substance: registration, premises, identifiable executives; a site visit is worth every portfolio.
- A publisher operating its own software in production proves it can maintain, not just deliver.
- Flee opacity about subcontracting: demand to know who will actually write your code.
Test Technical Competence: Beyond Logos and References
A portfolio is declared; a competence is demonstrated. The most reliable method for evaluating a provider remotely is to put it in a real situation: submit a problem representative of your project and observe its questions before listening to its answers. A good provider probes your need, identifies ambiguities, challenges requests that seem misguided; a salesman promises everything, immediately, at any price. Then ask to speak with the technical profiles who would work on your project — not only the salesperson: an hour's discussion with the prospective lead developer reveals the team's real level.
The pilot batch remains the decisive test: a first restricted, real, paid scope, delivered in a few weeks. There you observe everything that matters: code quality (have it reviewed by a trusted third party if you lack the skill in-house), the presence of tests, the clarity of documentation, adherence to announced deadlines, the quality of communication when a difficulty arises. Behaviour in the face of the first setback is the best predictor of the future relationship. A serious provider gladly accepts this format; one that demands a long commitment before demonstrating anything eliminates itself.
- Judge the provider's questions before its answers: a good partner challenges your need, a salesman promises everything.
- Talk to the technical profiles who will do the work, not only the salesperson.
- Impose a paid, restricted pilot batch: code quality, tests, documentation and deadline reliability reveal themselves within weeks.
- Have the delivered code reviewed by a trusted third party if the skill is missing in-house.
- Watch behaviour at the first setback: it is the best predictor of the relationship.
The Working Method: Rituals, Tools and Transparency
Technical competence is not enough if the collaboration is opaque. Question the method precisely: which progress rituals (frequency, participants, format), which shared tracking tools, what delivery frequency? The standard to demand from a structured nearshore: an identified French-speaking project manager, a weekly progress meeting at minimum, regular demos on an accessible environment, and a tracking tool (tickets, backlog) where you see the real state of work at any time. These rituals are not bureaucracy: they are what turns a remote team into an integrated team (Managing a Remote Development Team).
Technical transparency is the second pillar: from day one you must have permanent access to the code repository, test environments and documentation — on accounts that belong to you. It is a simple discriminating criterion: a provider that hosts the code on its own accounts and gives you an export "at delivery" is building you a dependency; one that works in your repositories from the start naturally prepares reversibility (Reversibility of an Outsourced IT Project). Finally, check the compatibility of hours and holidays: Morocco shares the Paris time zone, but ask about the handling of respective public holidays — an organised provider gives you that calendar before you ask.
- Demand the nearshore standard: French-speaking project manager, weekly meeting, regular demos, permanently visible backlog.
- The code must live in your repositories and your accounts from day one — never only at the provider's.
- Frequent, demonstrable deliveries beat a six-month tunnel, however talented the team.
- Ask for the public-holiday calendar and absence management: continuity of service is organised.
The Contractual Framework: What Must Appear in Black and White
The contract is your only protection when the relationship sours — which is precisely when you regret what you did not write. Four chapters are non-negotiable. Intellectual property first: the contract must explicitly organise the assignment of rights over the code developed for you, failing which you pay for software you do not own — French law is counter-intuitive on this point, and we devote an entire guide to it (Intellectual Property and Rights Assignment in a Development Contract). Confidentiality next: a solid NDA, access limited to the strictly necessary, a commitment not to reuse your business specifics.
The engagement model must be crystal clear: fixed price with deliverables, milestones and acceptance criteria, or time and materials with named profiles, daily rates and activity reports — both are valid depending on the project, ambiguity between the two never is (Time and Materials or Fixed Price). Finally, the exit: a reversibility clause detailing the return of code, data, documentation and transition assistance, with reasonable notice. Add service clauses — bug-fix times by severity, post-delivery warranty — and the question of cross-border invoicing, which follows a specific, well-charted regime (VAT and Invoicing with a Moroccan Development Provider). A provider used to French clients will offer these clauses spontaneously: their absence from the standard contract is itself a signal.
- Explicit, written intellectual-property assignment: without a compliant clause, the code stays with the provider even when fully paid.
- Confidentiality: NDA, access limited to the necessary, no reuse of your business assets.
- Unambiguous engagement model: milestone-based fixed price or instrumented time and materials, with written acceptance criteria.
- Complete reversibility clause: code, data, documentation, transition assistance, notice period.
- Quantified service commitments: fix times by severity, post-delivery warranty.
GDPR and Security: Framing Data Without Blocking the Project
Working with a Moroccan provider implies, as soon as personal data is accessible from Morocco, complying with the GDPR framework for transfers outside the European Union: a processing contract compliant with Article 28, and appropriate safeguards for the transfer — in practice the European Commission's standard contractual clauses, since Morocco does not benefit from an adequacy decision. This framework is perfectly workable and thousands of French companies use it; it simply needs to be put in place before the project starts, not after. Our dedicated guide details the complete arrangement (GDPR and IT Outsourcing Outside the European Union).
The selection criterion here is the provider's maturity on the subject: one that spontaneously talks about standard clauses, data minimisation, development environments without real data and access traceability has already worked seriously with European clients. One that answers "no problem, we'll sign whatever you want" has probably never applied what it will sign. Note that Morocco has its own data-protection framework — law 09-08 and the CNDP —, which creates a local compliance culture to build on. On operational security, demand the vital minimum: named accounts, strong authentication, separated environments, and production data never copied to development without anonymisation.
- Transfer outside the EU = Article 28 contract + standard contractual clauses, signed before the project starts.
- Test the provider's GDPR maturity: one who talks about it spontaneously has already practised it.
- Morocco has its own framework (law 09-08, CNDP): a local compliance culture exists.
- Security minimum: named accounts, strong authentication, separated environments, no real data in development.
Comparing Offers: The Final Decision Method
Once two or three providers are qualified on the preceding parts, the final comparison must remain multi-criteria. Weight according to your context, but never let the rate exceed one third of the total weight: the daily-rate gap between two serious Moroccan providers is small compared with the cost of a failed project (The Real Cost of an Offshore Developer in 2026). The criteria that discriminate best, in our experience of tenders: the quality of the questions asked during pre-sales, the precision of the estimate (a quote detailed by batch reveals real understanding of the need), the availability of contacts during the sales phase — it will not improve after signature — and the quality of the pilot batch.
Beware of both extremes: the abnormally low quote, which announces either a misunderstanding of the need or an aggressive amendment strategy; and the promise to do everything — web (our website creation service), mobile (our mobile app development service), ERP (our ERP development service), AI (our AI agent development service), data — with a team of five. Specialisation and team depth can be verified: ask who, by name, masters each promised technology. Finally, call client references — real clients, with projects comparable to yours, that you pick from a list rather than the single contact provided. Thirty minutes on the phone with an existing client is worth all the slides in the world.
- The rate must never weigh more than a third of the decision: the gap between serious providers is small compared with the cost of failure.
- A quote detailed by batch reveals understanding of the need; an abnormally low overall quote announces amendments.
- Pre-sales responsiveness is a ceiling, not a floor: it will not improve after signature.
- Verify promised skills by name and call references with projects comparable to yours.
Choosing a development provider in Morocco comes down to six parts: company solidity, competence demonstrated in a real situation, working method, contract, GDPR compliance and reversibility. No attractive rate compensates for a weakness in any of them — and a provider structured on all six turns outsourcing into a durable advantage rather than a gamble. CRYSTAL IT ticks these boxes by construction: a software company established in Rabat for more than 20 years, permanent salaried teams, its own products operated in production (Crystal ERP, CRYSTAL ASSUR IA, Crystal Auto), long experience of French-speaking buyers and European contractual frameworks (our IT offshoring services). Apply this article's grid to us: it is exactly what we propose to the French companies that consult us, pilot batch included. Contact the team in Rabat — in French, on your schedule — to discuss it without commitment.
Have a project or a question? Let's talk with a CRYSTAL IT expert.
Request a demo
