Skip to content
Luxembourg · Agentic software engineering

Software Development for Luxembourg Teams, from Ankara

A studio in Ankara is two hours ahead of Luxembourg in winter and one hour ahead in summer, so the two share 7 to 8 hours of a standard working day. The harder questions for a team bringing in outside engineers are on paper. How does personal data reach engineers outside the EU lawfully? For an entity supervised by the CSSF, does the regulator need notice before the work starts?

Curiosive is an engineering studio in Ankara, Türkiye, where AI coding agents do the volume and senior engineers review every change. We build a product end to end or join an existing team as an embedded monthly engagement. Agents handle scaffolding, migrations, test coverage and refactors that touch hundreds of files. Engineers own data models, authentication, permissions, payment paths and anything touching personal data.

24
published portfolio projects
5+
years building for production
12
countries the work runs in
100%
of code read by a senior engineer
1 day
to hear back, from the engineer

Working hours between Luxembourg and Ankara, winter and summer

Ankara is on UTC+3 all year because Türkiye does not use daylight saving time. Luxembourg is on UTC+1 in winter and UTC+2 in summer. In winter Ankara is two hours ahead: our 09:00 start is 07:00 in Luxembourg, our 18:00 finish is 16:00 there, and your 09:00 is 11:00 for us, which leaves 7 shared hours in a 09:00 to 18:00 day. In summer the gap is one hour: we start at 08:00 your time and finish at 17:00, your 09:00 is our 10:00, and the shared window grows to 8 hours. Because the overlap covers most of your day, live calls are easy to place. We still run the work on written, asynchronous decisions, a releasable increment every week and one short weekly call, so progress does not depend on who happens to be online.

GDPR transfers when engineers in Türkiye work on Luxembourg data

Luxembourg supplements the GDPR with the Act of 1 August 2018 on the organisation of the National Data Protection Commission, and its supervisory authority is the CNPD (Commission nationale pour la protection des données). As of 2 October 2026, Türkiye is not on the European Commission's adequacy list, so personal data made available to a studio in Türkiye needs another Chapter V transfer tool, such as Standard Contractual Clauses. EDPB Guidelines 05/2021 treat remote access from a third country as a transfer when the three transfer criteria are met, even if data is only displayed on a screen. The clauses in Decision (EU) 2021/914 include a controller to processor module, and under Clause 14 both parties warrant they have no reason to believe the destination country's laws and practices prevent compliance. A sensible default keeps the transfer small: agent and development work run on seeded or anonymised data, and production access is limited to what a task needs.

CSSF outsourcing notice for financial-sector clients in Luxembourg

Circular CSSF 22/806, as amended by Circulars CSSF 25/883 and 26/915, requires in-scope entities to notify the CSSF at least three months before outsourcing a critical or important function, or one month when the provider is a Luxembourg support PFS. The type of entity matters. For credit institutions, investment firms and payment and e-money institutions, the notification applies to non-ICT outsourcing. For specialised and support PFS, POST Luxembourg and management companies authorised only under Article 125-1 of the UCITS Law, it also covers ICT outsourcing, including to cloud providers. Whether an engagement counts as critical or important is for your compliance team and a lawyer to decide. If it does, raise it before the discovery call, not after a plan is agreed.

AI Act rules a Luxembourg software team should plan around

The AI Act's prohibited practices have applied since 2 February 2025, and its general application date of 2 August 2026 covers the Article 50 transparency duties: a system that interacts with people should be designed so they are told they are dealing with an AI, unless that is obvious. The national implementing Bill No. 8476 was filed on 23 December 2024 and was still in committee, not adopted, as of 5 October 2026. As drafted, it makes the CNPD the default market surveillance authority and single point of contact, with the CSSF covering AI systems placed on the market, put into service or used by entities it supervises. For AI features, design in two things early: a clear disclosure in the interface and a written record of what the feature does with which data.

Working language, currency and the agentic review loop

The 1984 Languages Law allows French, German or Luxembourgish in administrative matters, and the government portal notes that English is widely used, so specs, tickets and review comments are best kept in one agreed language from the start. Our prices are in US dollars while the country uses the euro, which is worth settling in the written scope. In the work itself, an engineer defines the task and its boundaries, a coding agent (Claude Code or Cursor) implements it and runs the type checker, linter and tests, and a senior engineer reviews the diff before merge, with continuous integration re-running the checks. That makes volume work cheaper. It does not make judgement on data models, permissions or security review cheaper, which is where the gates sit. Larger jobs we have shipped include the Webflow to Next.js rebuild of Zing Coach (zing.coach), AI fitness coaching for 1M+ users, and the revival of RateItAll (rateitall.com), with 12M+ reviews.

Questions

The things people ask before starting.

What does ongoing software development cost for a company in Luxembourg?

Work runs as AI-accelerated development, starting from $2,000 per month, with scope agreed in writing. That is our single offer, AI-accelerated development, with capacity and scope agreed in writing after a discovery call. There is no lock-in: the code is yours from the first commit, and repository, database and hosting accounts sit in your name.

Do we need Standard Contractual Clauses to work with developers in Türkiye?

In most cases yes, or another GDPR Chapter V transfer tool, whenever those developers can reach personal data. Türkiye has no EU adequacy decision as of 2 October 2026, and remote access from a third country counts as a transfer when the EDPB criteria are met. Put the clauses in place before any production access.

Does a CSSF-supervised firm in Luxembourg have to notify before outsourcing development?

Possibly, if the work is a critical or important function. For credit institutions, investment firms and payment and e-money institutions the circular's notice covers only non-ICT outsourcing, while for specialised and support PFS it extends to ICT. Your compliance team should assess this before anything starts.

Can Curiosive join our existing engineering team in Luxembourg?

Yes, as an embedded monthly engagement, working remotely from Ankara inside your repository and your review process. Decisions are written down, an increment ships weekly and one short call is held each week. Agents working in your codebase cannot merge anything; a senior engineer reads each change first.

How it starts

What happens after you write to us.

  1. 01

    You describe the product

    One paragraph on what you are building, roughly when you need it, and who it is for. No brief, no form with fifteen fields.

  2. 02

    You get a reply within a day

    From the engineer who would do the work, not a sales team. If we are not the right fit we say so, and where possible we point you somewhere better.

  3. 03

    You get a scoped plan

    Scope, price and timeline in writing before anything is committed. You decide with the numbers in front of you.

No long contract to begin, no lock-in to our tooling, and the code is yours from the first commit.

Start a conversation
Contact

Looking for an engineering partner for the long haul?

A short note about the product, the timeline and who it is for is enough to start. You will hear back from the engineer who would do the work, not a sales team.

Ankara / Türkiye · Working across European and US time zones