How do you prevent source code from leaking out of an offshore development centre (ODC)?

Question

Accepted Answer

Use the development environment's architecture: developers work on systems that make downloading source code locally technically impossible. Training, certificates and audits help, but none of them stops a leak.
When development is outsourced, the outsourcing company's information security, data loss
prevention (DLP) in particular, becomes part of your product security. The options differ in
kind:

Awareness training reduces accidents but stops no one who wants to copy code.
Up-to-date security certificates prove a management system exists, not that your code is
safe.
Regular on-site audits find problems after the fact.
A development system architecture that blocks local download, for example virtual desktops
where code never reaches the developer's own machine, is a technical control and stops the
leak itself.

Further points when choosing and running the centre: know-how, reputation and other customers,
location, physical security, access to source code or escrow, adoption of your policies,
tenant segregation between clients, secure coding and testing of what they deliver, and a
right to audit in the contract.
Go deeper:

Data loss prevention software (Wikipedia) — technical DLP controls and their limits
 Source code escrow (Wikipedia) — how a customer keeps access to code if the supplier fails