Who Owns the Source Code? What Your Company Must Retain in Software Projects

Short answer

When a business hires a software agency or freelance team to develop a custom web application, mobile app, or internal system, who actually owns the underlying source code and intellectual property (IP)?

Under standard commercial law and copyright frameworks, creating a software product does not automatically transfer IP ownership to the paying client unless explicit IP transfer clauses and full payment fulfillment terms are defined in the software contract.

Key components of software ownership:

Contractual IP Assignment + Git Repository Ownership + Cloud Infrastructure Ownership + Domain & Store Account Admin Rights =

Complete Software Asset Ownership

IP and Asset Ownership Matrix:

1. Essential Contract Clauses for Code Ownership

#### Clause 1: Work for Hire & Intellectual Property Transfer

The contract must explicitly state that all custom source code, documentation, UI/UX designs, database schemas, and written algorithms created during the project constitute "Work for Hire" and belong exclusively to the client upon creation or full payment.

#### Clause 2: Third-Party & Open Source Licensing Transparency

While custom business code should belong to the client, software relies on open-source libraries (e.g., React, Next.js, PostgreSQL) governed by MIT, Apache 2.0, or GPL licenses. Ensure no restrictive GPL licenses force your proprietary code to become open-source.

#### Clause 3: Pre-existing Vendor Frameworks (Background IP)

If an agency uses pre-built internal starter templates or libraries (Background IP), the contract should grant the client a perpetual, non-exclusive, worldwide, royalty-free license to use, modify, and maintain that background code without ongoing fees.

2. Operational Control: Verifying Ownership in Practice

Having IP rights on paper is useless if you lack technical access keys.

Ensure your company controls:

• GitHub / GitLab repository root permissions
• Domain registrar account (GoDaddy, Namecheap, Google Domains)
• Cloud portal root billing (AWS, Azure, Vercel)
• Third-party API accounts (Stripe, Twilio, SendGrid)

Code Ownership Checklist

• [ ] Include explicit IP Assignment and Work for Hire clauses in software contract
• [ ] Define Background IP perpetual, royalty-free licensing rights
• [ ] Require source code to be developed inside client-owned Git repositories
• [ ] Publish mobile applications under client-owned Apple and Google accounts
• [ ] Store environment secrets (`.env`) in client-managed password vaults