How to organize the transfer of development to outsourcing, if I can not transfer the SDK keys?

Question

Outsourcing

Hello.

There is a question, the answer to which seems obvious to me, but you never know there are other options)))

At work, I make applications for clients (in C #, but this is not the point) that automate work with one global insurance accounting system in the USA. Automation is done using the SDK that this system provides, and each client has its own SDK key.

I would like to outsource this work to Russia. Yes, even to India, I don't care )) In any case, I will do a code review before accepting the task. The joke is that, under the terms of the NDA, I cannot transfer SDK keys to anyone. Even if we assume that the contractor signs the NDA, this will not help anything, since according to the terms of the contract, all work with the SDK must be carried out from the states.

I see only 2 options for solving this problem.

1. Implementation of "proxy-sdk", where I will raise my service, which will 1 in 1 proxy requests to a real "global service". But it will not require an SDK key (I will figure out how to authorize the artist, this is not a problem). This option is not liked by the fact that the performer will work with a real base and can mess up a lot there.

2. The implementation of an "empty SDK", where I will also raise my service, which will stupidly return "ok" to all requests. This option is not liked by the fact that the "global sdk" has a lot of validations that are not documented, plus the request may not pass due to a conflict of new data with the data that is already in the "global service" database, and so on.

Answer 1

Let your subcontractor sign the NDA, you are not forbidden to hire subcontractors, and then you raise the machine in the US region in AWS or another cloud service, the contractor accesses it via remote desktop, and conducts all development from it. - I would do so. This is the easiest.

Answer 2

Unfortunately, the scale of the project is not very clear, but in general, it is not necessary to have SDK keys for development. You can outsource development while keeping debugging yourself, for example.
According to claim 1 - development on a real basis is the worst thing you can think of. Putting a product in this mode is too easy.
According to item 2 - it seems to me that this is the most obvious and standard option, in general, the norm is not only for third-party development, but also for an internal team. Organization of the development test circuit.