Short answer: Often yes, but not for everything. No single law bans offshore developers across all US state and local work. Some states bar offshore services in their contracts, and some federal data rules restrict where data may be accessed. Work on public content, code with synthetic data and testing is often allowed. Work touching restricted data or production systems usually is not.
Data location is not the same as workforce location
Two questions get mixed up. Where is the data stored? And where are the people who work on the system? A contract can require US data storage and still allow offshore developers who never touch that data. Another contract can bar any services performed outside the US, whatever the data.
Read both the data clauses and the place-of-performance clauses in your contract.
State rules that restrict offshore work
| State | What the rule says |
|---|---|
| New Jersey | All services under state contracts, including subcontracts, must be performed in the US (N.J.S.A. 52:34-13.2). |
| Ohio | Standard terms bar offshore services and remote access to state data from outside the US. |
| Oklahoma | Contract terms state no offshore services, and state data may not be accessed internationally without permission. |
| Georgia | GTA standard SS-15-002 requires state data to stay onshore and bars access from outside the US without an exception. |
| Maryland | Bidders must disclose plans to perform services outside the US. |
| Texas | DIR contracts can require state agency data to stay in the contiguous US when an agency asks. |
Sources: N.J.S.A. 52:34-13.2; Ohio standard terms; Oklahoma OMES contract attachment; Georgia GTA SS-15-002; Maryland SFP 12-111; Texas DIR contract terms. Summaries, not legal advice.
Federal data rules that flow down
- Federal tax information (IRS Publication 1075). Restricts access, processing and storage of FTI to the US and its territories. This affects revenue, benefits eligibility and child support systems.
- Criminal justice information (FBI CJIS Security Policy). Requires fingerprint-based checks for anyone with unescorted access to unencrypted CJI. In practice, offshore staff cannot meet it.
- Student records (FERPA). No explicit offshore ban, but districts must keep direct control of outsourced records, and many state laws and district agreements add US data rules.
- Health data (HIPAA). Does not prohibit offshoring with a business associate agreement and safeguards, but state Medicaid contracts often add stricter rules.
What can usually be done offshore
- Front-end builds and design systems for public websites
- Accessibility remediation of public pages
- Application development in non-production environments with synthetic data
- QA and test automation against test environments
- Documentation and training material without sensitive data
How to structure a compliant hybrid team
- Check the contract first. Look for place-of-performance, data location and remote access clauses.
- Keep data in the US. Host environments in US cloud regions or in agency accounts.
- Use synthetic data. Offshore engineers work on code and test data only.
- Separate production. Production access stays with staff the contract allows.
- Write it down. Put the onshore and offshore split in the statement of work.
This is the model Konnex uses. Read our delivery and compliance page for the full split.
Quick answers
Is there a federal ban on offshore developers for state and local government?
No single federal law bans it. Specific data regimes, such as IRS Publication 1075 for federal tax information and the CJIS Security Policy, restrict access for certain data.
Which states restrict offshore IT services?
Examples include New Jersey, Ohio, Oklahoma and Georgia, with disclosure rules in Maryland. Always check your own contract terms.