On this page · 13 sections
- 1. the AI premium is not in the salary data
- 2. Salary is not cost, and the multiple is where budgets die
- 3. the market you are buying into is large, and slowing
- 4. DPDP compliance is now an engineering requirement, not a legal appendix
- 5. Fixed price and time-and-materials fail differently
- 6. the seniority mix predicts delivery better than the headcount
- 7. Total cost of ownership outlives the build
- India-specific considerations
- What we build
- Why eCorpIT
- FAQ
- How eCorpIT can help
- References
Summary. Stack Overflow's 2025 Developer Survey puts the median Indian AI/ML engineer at $17,436 a year and the median back-end developer at $22,086 — the AI specialist earns 21% less, which is the reverse of what most vendor rate cards claim. NASSCOM's Strategic Review priced India's tech industry at $282.6 billion in FY2025E across 5.8 million people. India's DPDP Rules were notified on 14 November 2025 with an 18-month phased compliance window closing in May 2027 and penalties reaching ₹250 crore. Those four figures shape a custom build far more than any hourly rate, and three of them are routinely misquoted.
Most buyers evaluate a custom software development company by asking for a rate card. It is the least informative document a vendor can send you. An hourly rate tells you what one person costs for one hour; it tells you nothing about how many hours the build will take, who is actually assigned, or which of your compliance obligations the vendor has understood. The seven signals below are the ones that move a budget.
1. the AI premium is not in the salary data
Vendor blogs put a 20-35% premium on AI/ML work over generalist engineering. The 2025 Stack Overflow Developer Survey, which reports median total compensation by role and country, does not support that for India.
| Role (India) | Median annual USD | Against back-end |
|---|---|---|
| Senior executive (C-suite, VP) | $55,795 | +153% |
| Engineering manager | $52,308 | +137% |
| Architect, software or solutions | $46,496 | +110% |
| Data engineer | $27,898 | +26% |
| Developer, back-end | $22,086 | baseline |
| DevOps engineer | $20,923 | -5% |
| AI/ML engineer | $17,436 | -21% |
| Developer, full-stack | $13,949 | -37% |
| Developer, mobile | $10,462 | -53% |
Read the bottom half of that table before you accept an AI surcharge. In the same survey the median Indian AI/ML engineer is paid less than the median back-end developer and less than the median DevOps engineer. The plausible reading is a supply effect: AI/ML is where the newest entrants cluster, so the median is pulled down by experience mix rather than by the difficulty of the work. Either way, a vendor quoting you a premium for an "AI engineer" is pricing a title, not a scarcity.
The architect line is the one worth paying for. At $46,496 the median architect costs roughly 2.1x the median back-end developer, and architecture decisions are what determine whether the build needs rewriting in year two.
2. Salary is not cost, and the multiple is where budgets die
A median salary is not a billing rate and never converts directly. Between the two sit employer contributions, bench time, recruitment, hardware, office, management overhead and margin. This is why the same engineer appears at one number in a survey and a very different one on an invoice, and why comparing a survey median to a vendor's hourly rate is a category error.
The practical consequence for scoping: when a vendor's blended rate looks far below the market, the question is not "how are they so cheap" but "what is in the blend". A blended rate averaged across a team that is 70% junior will quote well and deliver slowly. Ask for the seniority mix by name and years, not the blended number.
3. the market you are buying into is large, and slowing
NASSCOM's Annual Strategic Review, published 24 February 2025, put India's technology industry at $282.6 billion in FY2025E, growing 5.1% and adding $13.8 billion in incremental revenue. The breakdown was IT services $137.1 billion, engineering R&D $55.7 billion, BPM $54.6 billion, software products $16.1 billion and hardware $19.2 billion, with exports at $224.4 billion and domestic revenue at $58.2 billion. Headcount reached 5.8 million after 126,000 net additions, and the country housed more than 1,750 global capability centres.
Growth of 5.1% against 126,000 net hires on a 5.8 million base is a market adding people slowly relative to revenue. For a buyer that means the constraint on your project is unlikely to be whether engineers exist. It is whether the ones assigned to you have done your problem before.
Sindhu Gangadharan, Chairperson of NASSCOM, framed the FY2026 outlook this way in the same release: "Enhanced AI implementation, rise of Agentic AI, and the growing maturity of GCCs as value hubs are reshaping industry dynamics."
One caution on this figure, because it is widely misreported. The FY2026 projection of roughly $300 billion is an outlook stated in the FY2025 review, and several outlets have since circulated a $315 billion FY2026 number. NASSCOM's own press-release URL still serves the February 2025 document, so treat any FY2026 total you see quoted as secondary until the primary is republished. We use the FY2025E figures here because those are the ones the primary source actually states.
4. DPDP compliance is now an engineering requirement, not a legal appendix
The Press Information Bureau's notification summary records that the Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, giving full effect to the DPDP Act, 2023 passed on 11 August 2023. The Rules followed consultations in Delhi, Mumbai, Guwahati, Kolkata, Hyderabad, Bengaluru and Chennai that drew 6,915 inputs.
Four provisions in that document translate directly into build work:
| Obligation | Engineering consequence | Deadline |
|---|---|---|
| 18-month phased compliance | Consent, notice and rights systems must be live | Mid-May 2027 |
| 90-day response to data-principal requests | Access, correction, erasure endpoints plus an audit trail | Within the phase-in |
| Separate, purpose-specific consent notice | Consent state modelled per purpose, not one global flag | Within the phase-in |
| Consent Managers must be India-based companies | Vendor selection is constrained by incorporation | Ongoing |
| Breach notice to every affected individual | Breach detection and per-user notification path | Ongoing |
The penalty schedule sets the budget for getting this wrong: up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for not notifying a breach or for violating obligations relating to children, and up to ₹50 crore for other violations.
The 90-day rule is the one teams underestimate. Responding to an erasure request inside 90 days is straightforward when personal data lives in one database and hard when it has been copied into analytics warehouses, log aggregators, email tools and backups. Retrofitting that after launch costs more than designing for it. The real cost is usually the data topology, not the consent banner.
eCorpIT designs applications aligned with DPDP requirements; the certifications we hold are CMMI Level 5, MSME and ISO 27001:2022.
5. Fixed price and time-and-materials fail differently
Neither model is safer in the abstract. They fail in opposite directions, and the choice should follow how well you can specify the work.
| Fixed price | Time and materials | |
|---|---|---|
| Works when | Scope is genuinely stable and documented | Scope will be discovered during the build |
| Typical failure | Change requests price every deviation | Every stakeholder request gets built |
| Who carries risk | Vendor prices risk into the quote | Buyer carries it directly |
| What it selects for | Lowest bid | Longest engagement |
| Control needed | Tight specification up front | Ruthless prioritisation throughout |
Fixed price does not remove risk from a project; it moves the risk into the vendor's estimate, and a vendor pricing an uncertain scope adds a contingency you cannot see. Time and materials does not remove risk either; it converts scope discipline into a standing obligation on the buyer. A capped time-and-materials arrangement with a named seniority mix and a fortnightly re-prioritisation is closer to how modern builds actually run. If you want a structured way to put this to vendors, our mobile app development RFP template sets out the questions that matter.
6. the seniority mix predicts delivery better than the headcount
Two teams of six do not cost the same and do not deliver the same. Using the survey medians in section 1, a six-person team of one architect, two back-end developers and three full-stack developers carries a very different salary base from six full-stack developers, even though both are "a team of six" on a proposal. The first has someone accountable for the system's shape.
Ask three questions before signing. Who specifically is assigned, by name and years. What proportion of their week is on your project. Who makes the architecture call when two approaches conflict. Vendors who answer those precisely tend to deliver; vendors who answer with a blended rate tend to staff the project after you sign.
7. Total cost of ownership outlives the build
The build is a one-off. Infrastructure, third-party services and maintenance recur. Cloud spend in particular tends to be scoped at launch volumes and then grow without anyone owning it, which is why we treat cloud cost management for Indian teams as part of the build rather than an afterthought. If your project involves model inference, the running cost can exceed the development cost within the first year; the economics are set out in our analysis of AI app development cost in India.
India-specific considerations
Three factors change the calculation for buyers contracting Indian teams.
Working patterns have shifted back toward the office. The Stack Overflow 2025 data shows 30.5% of Indian respondents fully in person against 25.6% fully remote, with the balance hybrid. If your model assumed a fully distributed team, check it against how the vendor actually works.
Retention is a live risk. In the same survey 32.7% of Indian respondents describe themselves as not happy at work and a further 42.6% as complacent, against 24.7% happy. Continuity of the specific people assigned matters more in that market than an org-chart headcount, which is another argument for naming individuals in the contract.
Data residency now has a hard edge. The requirement that Consent Managers be India-based companies means part of your compliance stack cannot be sourced offshore, whatever the rest of your architecture looks like.
For a broader cost comparison across geographies, see our breakdown of India versus US app development cost, and for the wider engineering context, the enterprise mobile app development guide and our overview of choosing a software development company in India.
What we build
eCorpIT builds custom web and mobile applications, systems integration, data platforms and AI-enabled features for clients in India, the UK and the US. Typical engagements are a product build from discovery to launch, a modernisation of an application that has outgrown its architecture, or a dedicated team extending an in-house group.
Our delivery sequence is five steps. Discovery fixes the scope, the data model and the compliance surface. Architecture sets the system shape and the non-functional requirements. Build runs in two-week increments with working software at each boundary. Hardening covers security review, performance and the DPDP obligations in section 4. Transition hands over documentation, runbooks and access, with a support window agreed in advance.
The stack we work in most is TypeScript and Node.js, Python, React and Next.js, Flutter and React Native on mobile, PostgreSQL, and AWS, Microsoft Azure and Google Cloud on infrastructure. We are partners of AWS, Microsoft, Google, Shopify and Kaspersky.
Why eCorpIT
We were founded in 2021 and work from Sector 83, Gurugram. We hold CMMI Level 5, MSME certification and ISO 27001:2022. Teams are senior-led, and we name the people assigned to an engagement before it starts rather than after.
On commercials, we quote an engagement model rather than a rate card: a fixed-scope phase for discovery, then a capped monthly team cost with an agreed seniority mix for the build. The mix is written into the contract. That is the number that predicts the outcome, and it is the one we would rather be judged on.
FAQ
How eCorpIT can help
We scope custom builds against the constraints above rather than against a rate card: the seniority mix that will actually deliver, the DPDP obligations that have to be designed in before May 2027, and the running cost that outlives the build. Engagements start with a fixed-scope discovery phase so the estimate rests on a real data model. If you are evaluating partners, contact us with your scope and compliance surface and we will tell you what the build genuinely requires.
References
Last updated 15 August 2026.
