The Default That Catches Founders Off Guard
Most business owners assume they own what they pay for. In software, that assumption is wrong.
Under U.S. copyright law — and equivalents across most of Europe and the UK — the person who writes code owns it. Not the person who commissioned it, funded it, or had the idea. Unless your contract explicitly includes an IP assignment clause that transfers ownership to you, the agency retains the intellectual property rights to everything they build.
This isn't a loophole agencies exploit maliciously. Many smaller agencies simply don't have standard IP assignment language in their contracts. The issue doesn't come up — until it does. And it most commonly surfaces during due diligence for a funding round, an acquisition, or a pivot — exactly when you can least afford surprises.
Industry research consistently finds that around 25% of companies cite IP risk as a primary reason they don't outsource critical software development at all. That's a massive number of businesses foregoing access to outside talent, faster timelines, and specialized expertise — not because outsourcing is inherently risky, but because the legal mechanics are misunderstood.
Key Takeaways
- Copyright defaults to the developer, not the client, in the U.S. and most of Europe
- This applies to code, API integrations, custom algorithms, UI designs, and documentation
- The gap most often surfaces during investor due diligence — when it's too late to fix cleanly
The Four IP Risks in Every Outsourcing Engagement
The copyright gap is just the starting point. Here are the four risks that every decision-maker should understand before signing a contract with a software agency.
Risk 1: No IP assignment clause. The contract is silent on ownership. The agency builds your product. You receive a working application — but the underlying codebase legally belongs to them. If the relationship deteriorates, they can technically restrict your access to what you paid for.
Risk 2: Uncontrolled subcontracting. Many agencies use freelancers or sub-agencies for parts of a project — design, QA, specific integrations. If those subcontractors aren't bound by the same IP agreements as the primary vendor, anything they contribute exists in a legal gray zone. You may not own those components at all.
Risk 3: Reused code without disclosure. Agencies commonly maintain internal libraries, templates, and reusable modules to work faster. When those components end up in your product, your so-called custom software may be sharing infrastructure with dozens of other clients — or inheriting open-source licensing obligations you don't know about.
Risk 4: Data handling without a processing agreement. If your development partner accesses customer or employee data during development or testing — and they almost always do — without a signed Data Processing Agreement (DPA), you may be in violation of GDPR or CCPA regardless of what your own privacy policy says.
Key Takeaways
- Ask for a full list of third-party tools, libraries, and subcontractors used in your build
- Open-source components must be reviewed for licensing compatibility — GPL licenses are particularly restrictive
- If you handle EU customer data, a DPA is legally required before any testing involving real data
Four Agreements You Need Before Development Starts
These aren't optional extras for large enterprises. They're the baseline for any serious outsourcing engagement, regardless of project size.
Non-Disclosure Agreement (NDA). Covers your business concept, technical specifications, user data, and any proprietary processes you share during scoping. Sign this before you share anything — including your discovery call notes. A credible agency will sign without friction.
IP Assignment Agreement. Explicitly transfers all intellectual property rights — code, designs, documentation, trade secrets — to you upon delivery and final payment. This is separate from an NDA. If an agency resists including this clause or offers vague language like 'works made for hire,' treat it as a negotiation failure that requires resolution before signing.
Source Code Escrow (for long-term or mission-critical engagements). A code escrow arrangement deposits your source code with a neutral third party, releasing it to you if the agency ceases operations, enters insolvency, or becomes unresponsive for a defined period. For multi-year partnerships or business-critical systems, this is standard practice.
Data Processing Agreement (DPA). Required under GDPR Article 28 whenever a third party processes personal data on your behalf. This covers all development and testing phases, not just production. U.S. state equivalents (CCPA, VCDPA) have similar requirements.
Key Takeaways
- An NDA protects your ideas during conversations; an IP assignment protects ownership of the output — you need both
- Have your own legal counsel review these documents, not just the agency's templates
- Reputable agencies will have standard versions of all four ready to share during the scoping phase
Questions to Ask During the Sales Process
The conversation before you sign is the best time to surface an agency's IP practices. Good agencies have been asked these questions before and have clear, confident answers.
Ask: Does your standard contract include an IP assignment clause that transfers all rights to us on final payment? The answer should be yes, with the specific clause available to review.
Ask: Do you use internal code libraries or reusable components in client projects? If so, how are those licensed? There's nothing wrong with using libraries — but you need to know what's in your codebase.
Ask: Do you use subcontractors or freelancers? Are they under NDA and IP assignment with you? The answer should be yes to both, and they should be able to show you the standard agreements.
Ask: What does your offboarding process look like — specifically, how do we receive the full codebase, credentials, and documentation? This question reveals whether the agency has thought through the end of the engagement or assumes they'll retain access indefinitely.
An agency that hesitates, gets defensive, or gives vague answers to any of these questions is telling you something important about how they operate — and about what to expect if the relationship becomes difficult.
Key Takeaways
- Ask about offboarding at the beginning — not after problems emerge
- Request to see a redacted version of their standard contract before engaging
- Agencies with strong IP practices are typically faster to answer these questions, not slower
Red Flags That Signal IP Problems Ahead
Beyond the legal documents, behavior during the sales and onboarding process is a strong signal of how an agency treats IP in practice.
They're reluctant to sign an NDA before discovery. Any credible partner will sign a mutual NDA before you share project details. Reluctance here, or excessive negotiation over standard NDA terms, suggests they either don't have a standard process or are protective of something you should know about.
Their contract uses 'works made for hire' language without explicit IP assignment. Works-for-hire doctrine is narrowly defined and more complex than it sounds. Explicit IP assignment — 'all intellectual property created under this agreement is assigned to the client' — is what you need.
They can't give you a straight answer about subcontractors. A transparent agency knows exactly who they work with and can confirm those parties are under appropriate agreements.
They retain admin access to your infrastructure, code repository, or domain 'for convenience.' You should hold the master credentials for your cloud accounts, GitHub repository, and domain registrar. A responsible agency provisions your accounts and works within them — not the other way around.
There's no defined handover process. If an agency can't describe exactly what you receive at the end of the engagement — in what format, through what transfer mechanism, and when — that ambiguity is intentional.
Key Takeaways
- You should hold primary credentials for AWS/Azure/GCP, GitHub, and your domain — verify this before work begins
- Always confirm that your agency's subcontractors are bound by the same IP and NDA terms
- IP assignment and credential handover should be conditions of final payment, not afterthoughts
The Bottom Line
IP concerns stop one in four business owners from outsourcing critical software development. For many of the rest, these risks go unaddressed until they surface at the worst possible moment. The fix isn't complicated — it's contractual, and it has to happen before development starts. If you're evaluating software development partners and want to see exactly how we handle IP ownership, NDA agreements, and credential handover, we're happy to share our standard engagement agreements before any commitment is made. No pressure, no sales pitch — just the documentation you need to make a confident decision.
Building a team in Eastern Europe?
StepTo helps European and US companies build senior-led nearshore engineering teams in Serbia. Let's talk about what your next engagement could look like.
Start a conversation