2

After events described in this question, my team and I decided to start our own company (limited liability). So far we are still going through setup procedures, and we are currently working with clients who are fine with us being legally freelancers.

One of our prospective clients is happy with the team skills, and wants to open a representative office in my country and hire all of us as employees.

We are not very happy with being employees, as limited company setup has these advantages to us as a team:

  1. Legal. We are better protected from possible layoff, and are free to find other clients/projects in case of any issues.
  2. Portfolio/brand. Working together as a company helps us developer our portfolio and brand name.

His main concerns with our proposed limited company setup are:

  1. Controllability/reliability. He says that working directly with employees streamlines communication, and is easier. I also implicitly understand that he is concerned about degree of control he might lack otherwise. Our insistence on a an independent entity might also be a signal of wavering commitment and long-term cooperation viability issues.
  2. Security. Our client is working in the finance sector, and says that is critical that all work is performed from authorised premises and on secure equipment (laptops with security constraints and VPN).

I've been thinking about the following counter-arguments to the points above:

  1. Our limited company basically can out-staff ourselves as his employees, therefore it will be completely transparent to him. The only difference will be the contract, that will be signed between his company and ours, and not between his company and all of us separately. The contract can explicitly mention exactly who will be working on the project. And moreover, there are no long-term guarantees with employees as well.
  2. As to the security, we can through secure VPN and access their remote machines through ssh or remote desktop, thus still staying within security boundaries.

My question is: are my proposed arguments valid, and what else can I do in order to address client's concerns #1 and #2?

P.S. If this question does not fit well within this site, please let me know whether there is a better place for it to be posted on.

Thanks!

  • If he hires you all as employees, what would you do about your other clients? – Brandin Jun 26 '15 at 13:17
  • @Brandin - we've completed all of our previous projects, and have put new client searches on hold, until we clarify our situation with this new client. – siphiuel Jun 26 '15 at 15:16
  • 2
    Regarding the secure equipment: it's common for external consultants to work on equipment provided by the client in these cases. That they aren't officially employees doesn't matter. It seems like your client just has no experience with hiring contractors. You are right in saying that a well-written contract should be sufficient to establish your commitment to realise the client's projects. – Lilienthal Jul 16 '15 at 8:00
7

You have taken the bold step of creating your own company. That is fantastic because now you get to make the decisions (as a group) on how you want to do business. Negotiating contracts and terms of business is part of that.

There is absolutely no reason why you have to comply.

You get to determine how you do business from now on. This prospective client may well want to employ you all, that doesn't mean you have to do it. If he wants you then he has to comply with your terms of business and that's the way it is.

Unless you absolutely must get this work/contract then just tell him "thanks but no thanks, we are happy in the business we created". If you do have to take his business then things are a little more difficult and you will need to negotiate. In that case your arguments are perfectly valid, but the client probably already knows that. They will ultimately be thinking about costs.

  • Thanks for your answer. The interesting thing here is that in the setup we are proposing to the client, working with an independent entity will be actually less expensive for him, as we will not charge additional costs, and he will not have to setup representative office and therefore deal with all kinds of administrative/accounting expenses. – siphiuel Jun 26 '15 at 13:06
  • 1
    "There is absolutely no reason why you have to comply..." - I'm guessing you have not worked in the financial sector. – jww Sep 27 at 8:19
  • @jww I think you missed the point, they are not compelled to jump through the hoops their potential client requests, they may simply decline to undertake the engagement. That is my point. – Marv Mills 19 hours ago
2

You're dealing with control issues. This company could be looking for investors or partnerships who will feel more confident if certain expertise is in-house. Especially if the technology you're creating is a big part of their strategy and not just some cost center.

If from the company's perspective, they are paying you for full-time, you're not going to have time to find other clients in theory unless you hire additional staff who do not work for this client. Personally, I don't think it is a strong argument for them.

You could also offer them right of refusal when hiring new people for their project. It gives them a little more control. Also, there are aspects of all projects that do not require a full-time person. You could spread a full-time person on your staff to their project only as needed. They get an expert without going to yet another consultant or hiring people they don't need.

Get a more expert opinion on your security claims. The level of security you use to access a corporate network doesn't matter if you're doing it from a compromised machine and/or network. Requiring company reviewed, protected and managed equipment on their network is not uncommon. There is a lot of BYOD in the corporate world, but in some areas of Finance, it's not as prevalent.

1

I suggest you to take a look at the contracts pentesting firms sign with their customers for ideas. They have to deal with some of the same issues you have to, specially since they are breaking into the customer's network to try to get to the crown jewels. A tremendously limited list they usually deal with are:

  • Scope: what can they access and what they should keep away from.
  • Guarantees/Insurance: do you have a general security policy for your business? Spell out how you are going to access their resources and clear with their security team. It is also wise to have insurance in case something goes awfully wrong; pentesting firms do have that.
  • Retainer: would you consider being in their retainer, where they pay you a flat rate every month just to be available to them. This might including having a specific person in your team assigned as the point of contact to them, response time expectations, and which topics are covered, "for X/month you will get a response within Y hours and these topics are included if they take less than Z time to solve. If it is a more complicate issue, these reduced hourly rates are enacted."

Bottom line is define expectations in writing. It shows professionalism and protects you from feature creep-like events.

-1
  1. His main concerns with our proposed limited company setup are:

Security. Our client is working in the finance sector, and says that is critical that all work is performed from authorised premises and on secure equipment (laptops with security constraints and VPN).

  1. I've been thinking about the following counter-arguments to the points above:

As to the security, we can through secure VPN and access their remote machines through ssh or remote desktop, thus still staying within security boundaries.

At (2) it sounds like you want to negotiate access and security controls. I don't see a country tag so I can't really comment on the way things work in your country. I do know in US Financial, things don't work like that.

The firm has policies and procedures and the firm has to follow them. If your new company cannot fit into the existing cogs of the firm then you will most likely find you can't do business with the firm.

I've worked in US Financial as a security architect. If I were performing the security evaluation, as soon as we were at (2) I would have disapproved the arrangement. The firm has policies and procedures, and they don't get re-written for vendors. At that point the vice president, director or managing partner could decide to [attempt to] override the decision.

Being overridden was no big deal to me. For this process, I would write a detailed report on why the arrangement should be avoided and detail the risks involved. I would then send the report to the Risk Committee. The Risk Committee would have another group estimate numbers, like how much money the firm would make and how much money they could lose during an adverse event. The Risk Committee would then make their decision based on the cost/benefit analysis of the relationship.

You should probably state the firm's classification or data sensitivity level of the systems you are working on. Low value data has fewer controls. High value data has more controls. You might find your proposed arrangement is allowed for low value data, but denied for high value data.

You will probably have the greatest chance of success if you are working on a trading platform for the firm. Financial firms are willing to make all kinds of compromises because the platforms make them so much money. I've got lots of stories to tell about trading platforms...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.