Why a Developer Start Slips After You Say Yes: The Buyer-Side Delays Nobody Warns You About
A developer start can slip on the buyer side even when engineers are available: contract review, a data processing agreement, a security questionnaire, IT access and decision slots all have to clear first. Here are the gates, who owns each one, and how to run them in parallel.
What Decides Your Real Start Date: The Vendor's Availability or Your Approvals?
Whichever is later. A developer start can slip on the buyer side even when engineers are available, because contract review, a data processing agreement, a security questionnaire, IT access and the calendar slots for decisions all have to clear before work begins. Engineers can typically start within one to two weeks of first contact; a full team usually takes two to four weeks. Those timings hold best when your approvals run in parallel instead of in sequence.
We found no dataset that measures how long these gates take, so we will not guess. A vendor's start timing describes one side of the table, and your side can slip when approvals run one after another. Each approval is often the step nobody owns. The most useful test is your own history: for the last vendor you onboarded, note the days between the yes and the first commit, and which gate took longest.
This article covers the non-technical gates. For repository access, local setup and first tasks, see our guide to new engineer ramp-up.
Which Buyer-Side Steps Can Add the Most Time?
Six gates can sit between a yes in principle and a first day of work, and each needs a named owner on your side. The table doubles as a start-readiness list: write the owner's name next to each gate. The last column shows what StepTo already does on every engagement, so you only plan for the rest.
| Gate | What you own | Ready when | What StepTo already covers |
|---|---|---|---|
| Budget approval | The budget holder approves spend and commitment | Written approval covers the minimum term and notice | Staff augmentation starts from $4,500 per developer per month, with a 3-month minimum, then 30 days notice |
| Contract and NDA | Legal reviews and signs the services agreement and the NDA | Both signed by an authorised person | An NDA and an IP assignment are signed before any engineer starts |
| Data processing agreement | Counsel decides whether one is needed and who drafts it | Signed, or a written decision that none is needed | Raise it on the discovery call; your counsel owns the terms |
| Security review | Your security team sends the questionnaire and reads the answers | Written approval, or open items with owners | Engineers work on company-managed laptops with disk encryption and two-factor sign-in |
| Access request | IT raises accounts, licences and any VPN setup | Each login works for the new user | Engineers work in your repository and tools from day one, and you own the code |
| Interview and decision slots | The people who decide hold time in their calendars | Slots are booked and one named person decides | A 15-minute intro call comes first; if there is a fit, a 60-minute discovery call follows |
Do You Need a Data Processing Agreement Before Engineers See Personal Data?
If the work involves personal data under the GDPR and the vendor processes it on your behalf, you need a binding contract before it does. Article 28(3) of the GDPR says that processing by a processor shall be governed by a contract or other legal act that is binding on the processor with regard to the controller. The contract must set out the subject matter and duration of the processing, its nature and purpose, the type of personal data and the categories of data subjects, and the obligations and rights of the controller. The processor must act only on documented instructions, and its staff must be committed to confidentiality.
That makes the paper a real gate, not a formality. Whether a given vendor counts as a processor in your setup is a question for your counsel; this is not legal advice. The link is an unofficial text; EUR-Lex has the official one.
If the agreement is not signed when everything else is ready, one option is to spend the first week on synthetic or masked data. That is a suggestion for your team, not a StepTo process, and your legal team should confirm it fits your rules.
Adding engineers to a roadmap like this? Spec your team in a minute.
Why Do Security Teams Ask More of Third Parties Now?
Because outside parties feature in more breaches. The Verizon 2025 Data Breach Investigations Report news release says third-party involvement in breaches has doubled to 30%. A security team that reads that figure has a reason to question every new supplier. The release does not say how long reviews take, and we found no source that does.
The practical response is to remove the back and forth: ask your security team to send the questionnaire at the same time as the contract draft, so the answers arrive in one pass instead of in rounds. Our engineering practices page lists what happens on every engagement, including that engineers work on company-managed laptops with disk encryption and two-factor sign-in.
Why Is Access Provisioning the Quiet Blocker?
Because it belongs to someone outside the project, and nobody puts it on the plan. Accounts, licences and a VPN profile each need a ticket to IT, often raised only after the engineer has a name. Gallup reports that only 12% of employees strongly agree their organization does a great job onboarding new employees. The figure covers the general workforce, not engineers, but it fits the pattern: steps that no one owns are the ones that stall.
Name one person who owns the access request from start to finish, and give them the list of systems before the first call. Engineers work in your repository and tools from day one, so the systems on that list are yours. The technical checklist lives in the ramp-up guide.
How Do You Run the Paperwork in Parallel?
Treat the gates as one project with one owner. Below is a suggested buyer plan: a sequence, not a schedule, and not a description of StepTo's process.
On StepTo engagements an NDA and an IP assignment are signed before any engineer starts, so place that step early.
Key Takeaways
- Confirm the budget approval, including the minimum term and the notice period, before the first call
- Sign the NDA, then hold the scope conversation, since the rest depends on what the engineers will see
- Send the contract and data processing agreement drafts to legal together, so one review covers both
- Send the security questionnaire to your security team at the same time
- Raise the access tickets before the first call ends, with a named owner for each system
- Book the interview and decision slots before the paperwork is finished, not after
How Much Slack Should You Leave for Interviews and Decisions?
Enough that no step waits for a calendar. Hold the slots before you need them, and decide in writing who approves. StepTo starts with a 15-minute intro call; if there is a fit, a 60-minute discovery call follows.
The in-house hiring loop is the contrast. SHRM's recruiting benchmarking data puts the median time to fill a nonexecutive position at 39 calendar days, and the Employ benchmarks reported by HR Dive put the average at 63.5 days in 2025, down from 67.7 days in 2024. Neither figure is specific to software engineering. Against those numbers the vendor-side start is short, so a stalled approval costs proportionally more. Our comparison of in-house and staff augmentation timelines sets the two clocks side by side.
What Should You Ask Any Vendor About Their Start Date?
A start measured from first contact and one measured from a signed contract are different claims, so ask when the clock starts. Ours starts at first contact: engineers can typically start within one to two weeks of first contact; a full team usually takes two to four weeks.
The first two weeks are a paid trial, and a developer who is not the right fit is replaced free within the first 30 days. After the 3-month minimum, notice is 30 days. Write the success criteria down before day one; the two-week trial plan helps, and the staff augmentation page has the terms.
Key Takeaways
- When does your clock start, and what must we provide before it can?
- Is the start for one engineer or a full team?
- What is signed before an engineer starts?
- Is there a paid trial, and what are the written success criteria?
- What happens, and who pays, if the first match is wrong?
Which Gate Will Hold You Up Longest?
Time your last vendor start, find the gate that took longest, and start it first next time. Put a name against each line of the start-readiness list and run the paperwork in parallel. To check your approval path against ours, book a 15-minute call through our contact page and bring the list of approvals you expect.
Building a team in Eastern Europe?
StepTo builds dedicated nearshore engineering teams in Belgrade, Serbia. Engineers can typically start within one to two weeks of first contact; a full team usually takes two to four weeks. Two-week paid trial, from $4,500 per developer per month.
Related: The eight engineering practices · Spec the team you want
