Who owns the code and data in custom software development?

Why it matters from the start

While everything works, nobody asks who owns what. The problem shows up when you want to bring in another team, switch vendors, or the agency stops responding. At that point, if the pieces aren't in your name, you depend on them handing everything over.

Making it clear up front isn't distrust. It's like asking for the deed to a house: it protects both sides and avoids arguments later.

The pieces that should be in your name

1. The code: the repository, for example on GitHub, created in your company's account or organization, with access for the development team.
2. The data: the database and its backups, in an account you control.
3. The server or cloud account where the system runs, billed to your company.
4. The domain and email, registered in your name and not a third party's.
5. Accounts for external tools: WhatsApp Business, payment providers, AI services, maps or messaging.
6. The documentation: how it's installed, how it's deployed and where everything lives.

What to check in the proposal or contract

• That it states the code developed for you is yours once paid for.
• That it clarifies which parts are third-party or general-purpose, like open-source libraries or the agency's own components, and under what terms you can keep using them.
• That accounts are created in your company's name, or transferred when the work ends.
• That it includes handing over access and documentation if the relationship ends.
• That there's a non-disclosure agreement covering your data.

Every country has its own rules on intellectual property and contracts. For the final wording, have a lawyer review it.

How to check without being technical

• Ask to be an admin on the repository and the cloud account, even if you never log in.
• Check whose name the server and tool invoices are addressed to.
• Ask for an export of your test data to confirm it can be taken out.
• Ask what would happen if another team had to take over the system tomorrow.

What if you already started without anything in your name

It's more common than you'd think, and it can almost always be fixed. You don't need to end the relationship with the agency: it's enough to ask, politely, for each piece to be moved into your name.

1. Make a list of everything the system uses: repository, server, database, domain, email and third-party tools.
2. Next to each item, write down whose name it's in and who pays for it.
3. Create any company accounts you're missing, such as a GitHub organization and a cloud account.
4. Ask for each piece to be transferred, or to be added as an admin, starting with the code and the data.
5. Once everything is in place, ask for the documentation on how the system is installed and deployed.

An agency that works well shouldn't put up obstacles. If it refuses or adds conditions that weren't in the agreement, that's a sign to review the relationship with someone who can advise you.

Backups: the piece everyone forgets

Having the data in your name doesn't help much if there are no backups, or if they exist but nobody has ever tried restoring them. A mistake, an accidental deletion or a server problem can happen in any system.

• Ask how often the database is backed up and how long each backup is kept.
• Ask for backups to be stored in an account you own, separate from the main server.
• Ask for a restore test at least once, to confirm the backup actually works.
• Write down who is responsible for checking them if the team ever changes.

It's a ten-minute conversation that prevents the worst-case scenario: losing information your business needs to run.