Why a Moldovan company, and is that a risk?

Most people who visit our site check one thing before they read anything else: where we are. When the answer is Moldova, the next questions come fast. Where exactly is that? Is it stable? What happens to our data? Can we even sign a contract with them?

These are fair questions, and you should ask them of any vendor outside the EU. This post answers each one with sources you can check, and it says plainly where a risk remains and what we do about it.

The short version

Your question	Short answer
Where are you?	Chișinău, Moldova, between Romania and Ukraine. One hour ahead of Amsterdam.
Is Moldova heading towards the EU?	Yes. It has been a candidate since 2022 and opened accession negotiations in June 2024.
Is our data safe under GDPR?	Your data stays in your EU environment. We sign a data processing agreement with the EU’s Standard Contractual Clauses before we get any access.
Who owns the work?	You do. All work product and IP is assigned to you on payment.
How do we pay?	Invoices in euros, net 30. VAT is handled through the reverse-charge mechanism.
Can you come to our office?	Yes. Moldovan citizens travel to the Schengen area without a visa.
What can’t you offer yet?	ISO 27001 or SOC 2 certification, and Dutch client references. More on both below.

Why Moldova at all

Moldova has a large, experienced software engineering community for a small country, and English is the working language of its IT sector. Our engineers use it every day.

Cost is the other reason, and it helps to know where it comes from. Companies registered in Moldova’s IT Park pay a single 7% tax on revenue in place of corporate tax and payroll contributions. That, plus local salaries, is why our rate is lower than a Dutch or German agency’s. It does not come from staffing your project with juniors. You interview every engineer before they start.

The time zone matters more than it sounds. Moldova is one hour ahead of the Netherlands, so your engineers are online for your whole working day, including stand-ups and incident calls.

Is it politically stable?

Moldova has chosen a European direction, and the EU has responded. The EU granted Moldova candidate status in June 2022. The first intergovernmental conference opening accession negotiations took place on 25 June 2024 [1], and negotiations on the first chapters (“fundamentals”) opened in June 2026 [2].

We won’t pretend the region is risk-free. Moldova borders Ukraine, and Transnistria, a breakaway region on the east bank of the Dniester river, has Russian troops stationed on it. You should weigh that.

Here is how we limit the effect on you:

• Your systems stay yours. The code lives in your repositories, the documentation in your wiki, and the data in your cloud, from the first day. Nothing you run depends on our office or our servers.
• Our engineers work remotely. The work doesn’t depend on one building.
• The replacement guarantee is in the contract. If an engineer can’t continue for any reason, we replace them within 21 days at no extra cost.

The practical test is simple: if we disappeared tomorrow, would your platform keep running and could your team pick up the work? With us, the answer should always be yes. Ask us to show you how.

What happens to our data under GDPR?

This is the question your legal team will ask, so here is the precise answer.

The EU recognises some countries as having “adequate” data protection, which makes data transfers to them straightforward. Moldova is not on that list [3]. That means the GDPR’s rules on international transfers apply to us.

You might think that if your data never leaves your EU cloud, no transfer happens. The European Data Protection Board says otherwise: when a processor based outside the EU remotely accesses data stored in the EU, that access itself counts as a transfer [4]. That is exactly our situation, so we treat it as one:

• We sign a data processing agreement before access. It includes the European Commission’s Standard Contractual Clauses [5], the standard legal tool for transfers to countries without an adequacy decision.
• Your data stays where it is. We work inside your EU environment and don’t copy it to our own systems.
• Access is least-privilege. We get access to what the work needs, production access only when the work requires it and only with your approval, and you can revoke it at any time.
• You get our subprocessor list before you sign.

Moldova’s own law is moving the same way. Law No. 195/2024 on personal data protection, which entered into force in August 2026, brings Moldovan rules much closer to the GDPR [6]. Analysts note it still differs from the GDPR in places [7], so the Standard Contractual Clauses remain the legal basis we rely on.

Contracts, IP and invoicing

• Intellectual property. All work product and IP is assigned to you on payment.
• Currency and terms. We quote and invoice in euros, with net 30 payment terms by default.
• VAT. For business-to-business services supplied to a VAT-registered company in the EU, VAT is generally accounted for by you, the customer, under the reverse-charge mechanism. Your finance team will recognise this from other foreign suppliers. Confirm the treatment with your own accountant.
• Price changes. Annual indexation is written into the contract on day one, so there are no surprises at renewal.

Can you come to our office?

Yes. Moldovan citizens with biometric passports have travelled visa-free to the Schengen area since April 2014 [8]. A kickoff week in Amsterdam or Rotterdam needs no visa paperwork, only a flight.

What we can’t offer yet

Two gaps are worth naming before you find them yourself.

We don’t hold ISO 27001 or SOC 2 certification yet. In the meantime, we send you our list of security controls and answer your security questionnaire in writing.

We don’t have Dutch client references yet. We’re new to this market. What we can show is ABAXUS, the real-time billing engine our founder built and still runs in production. If that isn’t enough, our free architecture review and paid Discovery Sprint exist to let you test our work before any long commitment.

Questions to ask any vendor outside the EU

Use these with us or with anyone else you’re considering:

1. Which legal mechanism covers GDPR transfers, and can we see the DPA before the first technical call?
2. Where will our data physically sit, and who on your side can access it?
3. If one of your engineers leaves, how many days until a replacement starts, and who pays for the handover?
4. Does any of our code, data or documentation live on your systems?
5. Who owns the IP, and when does ownership pass to us?
6. What does your answer to our security questionnaire look like? Can we see a sample?

A vendor who answers all six in writing, before you sign, is one worth talking to.

Where to start

Send us your questions, or your security questionnaire, and we’ll answer in writing. If you’d rather talk first, book 30 minutes.

Sources

1. Council of the European Union, EU–Moldova relations.
2. EEAS, EU–Moldova summit, 22 June 2026.
3. European Commission, Adequacy decisions.
4. European Data Protection Board, Guidelines 05/2021 on the interplay between Article 3 and Chapter V of the GDPR, version 2.0, adopted 14 February 2023, Example 11.
5. European Commission, Standard Contractual Clauses for international transfers, Implementing Decision (EU) 2021/914.
6. EU4Moldova, Data protection in the Republic of Moldova marks new era.
7. DLA Piper, Data protection laws of the world: Moldova.
8. Ministry of Foreign Affairs of the Republic of Moldova, 11 years of visa-free travel to the Schengen area.