Who owns the code when you hire a development company?

Who owns the code by default under US law?

Under US copyright law (17 U.S.C. § 101), software code created by an independent contractor belongs to the contractor, not the hiring company. Paying for software development does not automatically grant you ownership of the source code. Unless your contract contains an explicit written assignment of IP rights, your company receives only an implied license to run the software.

This catches non-technical buyers and technical executives off guard. In an employment relationship, code written by a full-time W-2 employee within their job scope automatically belongs to the employer under the statutory "work made for hire" doctrine. Independent software agencies, contract developers, and offshore firms are legally distinct entities. Under the statute, software built by an external contractor does not automatically qualify as a work made for hire unless it falls into specific, narrowly defined statutory categories and is backed by a written agreement explicitly using those words.

If your Master Services Agreement (MSA) lacks an explicit IP transfer clause, the vendor retains the legal right to:

• Reuse the code for competing clients in your vertical.
• Revoke your access to source code repositories during a billing dispute.
• Block acquisition diligence when an acquiring entity asks for proof of clear IP ownership.
• Charge recurring license fees for software you paid $200,000 to build.

To own the software, your contract must specifically override default US copyright law.

How do you ensure complete IP ownership in an MSA?

To ensure total ownership of custom software, your Master Services Agreement (MSA) must explicitly state that all deliverables, code, designs, and documentation are "work made for hire" and include an unconditional assignment of present and future intellectual property rights to your company upon creation.

A contract that simply says "Client owns all deliverables" is legally incomplete. Vendor lawyers routinely fight for ambiguities that keep core components in their hands. A bulletproof ownership clause requires three primary structural components:

1. Explicit Present Assignment Language: The agreement must state that the contractor "hereby assigns" all rights, titles, and interests in the code to your entity. Using future-tense language like "agrees to assign" creates an obligation to transfer rights later, rather than executing the transfer automatically as code is written.
2. Comprehensive IP Scope: The scope must cover patents, trade secrets, trademarks, copyrights, and moral rights. It must cover Git commits, architectural diagrams, terraform scripts, CI/CD pipeline configurations, and database schemas.
3. Power of Attorney Clause: Your MSA should specify that if the vendor dissolves or refuses to sign formal assignment documents required for patent or copyright registration later, your company is designated as their attorney-in-fact to execute those documents.

If an agency pushes back on assigning ownership of standard developer tooling, require them to list those specific tools explicitly in an exhibit rather than granting them blanket retained rights over your codebase.

When does IP ownership transfer happen during a project?

IP ownership should transfer automatically as code is created, but agencies often structure contracts so ownership transfers only upon full and final payment of all invoices. Transferring IP upon payment creates operational leverage for vendors during scope or payment disputes, while transfer upon creation protects your build pipeline and code repositories.

Vendors prefer "transfer upon final payment" because it prevents clients from taking partial work and running away without paying the bill. However, for a 6-month project running $150,000 to $400,000, this creates severe risk for the buyer. If a milestone dispute occurs at month 5, the agency holds 100% of your IP hostage, even if you paid the first four monthly invoices on time.

WRONG: "IP transfers to Client upon payment in full of all outstanding invoices under the applicable Statement of Work."
RIGHT: "IP transfers to Client continuously upon creation. Vendor retains a security interest in unpaid deliverables solely until milestone invoice settlement."

If a vendor insists on tying transfer to payment, negotiate a pro-rata, milestone-based IP release clause. Under this structure:

• Payment of Milestone 1 releases all code created during Milestone 1 immediately.
• Code repositories are committed to your self-hosted GitHub or GitLab organization daily, giving you immediate technical control.
• Disputed line items stall payment for the specific disputed feature, not the core IP of the foundational application.

Never allow a vendor to host your primary codebase in their personal GitHub organization under the promise of "handing it over after the project finishes."

What pre-existing IP and open-source risks hide in custom code?

Custom software rarely consists of 100% brand-new code. Agencies frequently incorporate open-source libraries, internal boilerplates, and pre-existing developer frameworks. If your contract fails to carve out background IP or fails to define licensing terms for vendor-owned tools, you risk owning a shell application that breaks if you part ways with the agency.

When an agency builds a application for $250,000, they rarely write the user authentication, deployment scripts, or administrative UI controls from scratch. They use pre-built components to speed up delivery.

These elements fall into two distinct legal buckets:

Background Technology (Vendor IP)

Agencies often maintain an internal "starter kit" or proprietary UI framework. They will not sell you exclusive ownership of their internal boilerplate because doing so would destroy their business model. Instead, your contract must state that while the agency retains ownership of their pre-existing background technology, they grant your company an exclusive, perpetual, irrevocable, worldwide, royalty-free license to run, modify, compile, sub-license, and sell that background tech as part of your software.

Open-Source Software (OSS)

Developers rely heavily on OSS libraries (MIT, Apache 2.0, BSD, GPL). While MIT and Apache licenses pose minimal legal risk, copyleft licenses like GPL v3 or AGPL can force your company to open-source its entire proprietary stack if integrated incorrectly. Your contract must include an explicit warranty that the agency will not incorporate copyleft OSS into your application without prior written consent.

Work made for hire vs IP assignment: which contract clause do you need?

You need both clauses in your software agreement. "Work made for hire" applies narrowly to specific types of commissioned works under US law, while an explicit "assignment of IP" acts as a legal safety net, transferring all copyright, patent, and trade secret rights to you regardless of legal classification.

Relying solely on "Work Made for Hire" language in a contract with an independent US agency or overseas dev shop is a common contract flaw. If the work fails to meet the strict legal definition of a commissioned work under § 101, the clause defaults to void, leaving the agency with full legal ownership of the code. Always pair it with explicit present assignment phrasing.

How to audit a software contract for code ownership rights

Before signing a Statement of Work (SOW) or transferring a deposit, run your agreement through a technical and legal audit.

1. Verify present assignment language. Search the agreement for "hereby assigns." If the text reads "shall assign upon completion," request an immediate edit to present-tense assignment.
2. Define background IP upfront. Require the vendor to list every proprietary internal tool, starter kit, or pre-built library they plan to use in Exhibit A of the SOW.
3. Mandate clean repository access. Require the team to commit code to your organization's version control system (GitHub, GitLab, Bitbucket) from Day 1. Never accept code delivered as a zip file upon final payment.
4. Inspect open-source license policies. Verify that the contract explicitly prohibits viral copyleft licenses (GPL, AGPL) without approval from your engineering lead.
5. Enforce contractor downstream assignments. Ensure the agency's contract with its individual developers includes signed IP assignments. If a sub-contractor or offshore worker didn't assign their rights to the agency, the agency cannot transfer those rights to you.

What this means for your team

Code ownership is not an academic legal debate. It is a fundamental operational asset that directly impacts your company's enterprise value, audit readiness, and technical independence.

If you are evaluating external development partners, hiring dedicated contract teams, or taking over a legacy codebase with unclear title, we can help. Talk to our senior engineering team at NextGen Coding Company to review your architecture, structure clean development engagements, and ship software you own 100% from day one.