Is it possible to entrust the development of a service for working with financial transactions to a freelancer at a distance?

Question

Freelance

How can you entrust a remote freelance developer with the development of a service that works with finances, i.e. has direct access to all accounts, wallets, etc.? Unfortunately, there is no "own" developer.
The service has already been launched (finances are on the accounts), but it needs some refinement and support in the "combat" mode.

Answer 1

Let's start with the fact that for the development of anything - access to the accounts is not needed.
The environment for development and production should always be clearly separated.
Somewhere there are obviously test accounts, somewhere you can make them.
Accordingly, connection details should be set in configs and easily changed when uploading to combat servers.
At the same time, you still have the question of whether there are bookmarks in the code (or unintentional vulnerabilities) - but the cost of a full-fledged code audit will be comparable to the cost of development.

Answer 2

Contract agreement + NDA + as advised by Dmitry Entelis - test accounts, and in production, change everything to the current ones.

Answer 3

There is a saying: trust but verify. Those. either hire under a contract with the responsibility of the parties, or check the code with other people.

Answer 4

I had the pleasure of knowing a company where, offline (in person), a programmer developing a payment system, after his (voluntary) dismissal, stole about several million from the company's accounts.
He quit just a month after the launch - he was eager to steal money.
Since there were a lot of "black" people at the firm, they did not pursue him - he knew too much.
The system he developed was turned off for several months (or even years - I don’t remember) out of harm’s way.
A remote developer is perhaps morally less stable, because when you don’t see a person in person, your conscience torments you less.
And from a technical point of view - no better and no worse than a remote worker or full-time employee. Everyone has an opportunity - with the wrong delivery of work.
1. Never give any password keys, etc. The system for changing test access to combat access should be simple and accessible even for a non-specialist. This will require additional time / money in development - but such a system should be by all means.
2. Two audits. Various strangers. After the end of development. Here they scare you that this is comparable to the cost of development - the one who writes this is apparently a junior. Bookmarking code review isn't the cheapest thing in IT, but it's not that expensive either.

Answer 5

You can trust, but it's somehow frivolous ... Then he will move on to another project and?

Answer 6

And how will he differ from "his" developer? Similarly, a full-time developer can be dishonest.
Above, everything was correctly described, it is necessary to separate the environment for developers and sign normal contracts. And the second will not cancel the first. No contract will protect against an unintentional mistake.

Answer 7

Of course, you should be puzzled with a freelancer with many years of experience, which is confirmed by history on the freelance exchange.
You should always have a production and test environment.

Answer 8

NDA and trust. Access to the battle for development is not necessary, as mentioned above. I don't see a problem.

Answer 9

You take big risks. If the project is hardly 500 bucks - please.
A freelancer is a strange substance, it can disappear, not be done on time, and so on. for a very simple reason - no one stupidly makes complex projects on time. But you can't yell at a company of 100 programmers if they don't deliver on time. If you threaten them with court, you will become furious, they will smile and then they will tell their friends about you.
And for one chela who has not even received money yet - please. On freelancers they simply recoup, because they are not sorry. You can shout at him, threaten with terms, not give money. No company will start doing until you send them money. Therefore, the question here is - do you want people whom you do not know to make your financial project, so that you can pay them later? Or maybe not pay? Well, that is - "do not be cunning and you will not be cunning."
One of two things is important for you: either a person is ready to come to you for the sake of the project and you have a place to place him - ask to come to work. Or if you want outsourcing, you will have to hire a company and pay a little more money, but consider that this is money for a guarantee.
Although we understand that only a lazy person does not have a company today. And so a modern company in the person of the founder and board of directors will confuse you even more, and the first one will steal your confidential information, while some freelancers may not care.
It is important that a person understands what he is getting into.
And to prescribe in the contract that the use of this information at least somewhere is legally prosecuted.
In short, like coals. It will be much easier to sleep if your employee works with you, and you can come to him and ask how things are going. Well this is loot.