Frequently asked questions

What procurement, security and engineering teams usually ask us. Can’t find your answer? Email hello@kestrel.ae.

Engagement models and pricing

How do engagements usually start?

With a two-week discovery at a fixed price of AED 95,000, credited against the build if you go ahead. You get a plan, an estimate and a working view of the risks. Cost and architecture reviews are also fixed price, from AED 55,000.

Fixed price or time and materials?

Fixed price for work that can be clearly defined, such as discovery, reviews or a pilot. Time and materials for longer builds, with an estimate per slice, spend reported in dirhams every fortnight and an optional monthly cap.

What does a typical engagement cost?

Most projects are between AED 1 million and AED 6 million over four to eighteen months. Day rates run from AED 2,500 to AED 6,500 depending on role and experience. Every engagement is quoted in writing before it starts.

Is there a minimum engagement?

Fixed-price reviews start at AED 55,000. Team augmentation has a three-month minimum. We rarely take on build work under AED 400,000, because we can’t do it well at that size.

How much notice do we need to give to stop?

Thirty days, at any point, with everything handed over: code, documentation and a recorded walkthrough.

IP and contracts

Who owns the code and designs?

You do. All code, designs and documents we create for you become yours as soon as the invoice for that work is paid. We keep only our general know-how and the open-source tools we used.

Do you use open-source software?

Yes, under permissive licences we check automatically, and we list every dependency in the handover. We never add copyleft licences to your product without asking.

Will you sign our NDA?

Yes, before the first call if you like. We also use our own mutual NDA if you don’t have one.

Can you name us as a client?

Only with your written permission. Most of our case studies were approved by the client’s communications team, word by word.

Security and compliance

Are you certified?

We’re ISO 27001 certified across all three studios and hold a SOC 2 Type II report, both audited every year. We’ll share the certificates and our latest penetration test summary under NDA.

How do you handle our data and access?

Least-privilege access, through your identity provider where possible, reviewed monthly and removed on the day someone leaves the engagement. Production data stays in your environment unless you agree otherwise in writing.

Are your people background checked?

Everyone is reference and right-to-work checked when they join. For financial services, government and other regulated work, we complete enhanced background checks or your own vetting before day one.

Will you sign a data processing agreement?

Yes. When we process personal data for you, we sign your data processing agreement or ours, which follows the UAE and Saudi personal data protection laws, and the DIFC and ADGM rules where they apply.

Teams in Dubai, Abu Dhabi and Riyadh

How do teams across studios work together?

Most of our teams mix people from two studios, picked for the skills the work needs. Everyone works in English, many in Arabic too, in your tools, and joins your rituals.

What about time zones and working weeks?

Dubai and Abu Dhabi share a time zone, and Riyadh is one hour behind. Our UAE studios work Monday to Friday and Riyadh works Sunday to Thursday, so every team overlaps fully with your working week.

Does it cost more to staff from Riyadh or Abu Dhabi?

No. Day rates are the same in all three studios. We pick people for the skills the work needs, and we’ll tell you the mix we’d suggest and why.

Will we meet the team in person?

Yes. Every engagement starts with the team on site for at least a week, and we visit at least monthly after that. Travel within the UAE is included; flights to Saudi Arabia and the rest of the GCC are quoted up front.

Certified and accountable

Audited every year by independent assessors, so your security team has less to check.

  • ISO 27001

    Information security, certified since 2019 in all three studios

  • SOC 2

    SOC 2 Type II report on our controls, independently audited every year

  • PDPL

    Personal data handled under the UAE and Saudi data protection laws, with a named data protection officer

  • ISO 22301

    Business continuity management, certified across all three studios

Still have a question?

A partner replies within one working day.

Cookie preferences

Cookie policy