A UK founder we spoke to last year had a hard lesson. He paid a European agency £120k over 8 months to build a fintech MVP. Six months post-launch, the agency approached him claiming they still owned the code and demanding a licensing fee to continue using it in production. His contract had no IP assignment clause; it referenced work being done for him but did not explicitly transfer ownership. He spent £15k on legal advice, negotiated a settlement of £30k to secure clean IP, and had to explain the situation to prospective investors during his seed round.
That is the IP protection conversation many founders discover too late. Software outsourcing contracts often reference the work but skip the specific clauses that transfer ownership. Paying does not automatically transfer IP. Most jurisdictions default ownership to the person who wrote the code.
This article is a practical checklist for founders, CEOs, and CTOs signing software outsourcing contracts. Who owns code by default. The eight clauses that protect IP. NDA vs assignment vs non-compete. Third-party code considerations. What to include before signing.
This is not legal advice. It is a founder-friendly guide informed by contract patterns we see across UK and US engagements. Have a solicitor review actual contracts before signing.
Who Owns the Code By Default (UK, US, and Common Law)
Default ownership surprises most founders.
United Kingdom. Under the Copyright, Designs and Patents Act 1988, copyright vests in the AUTHOR (the person who created the work). For software, this means the developer or agency who wrote the code owns it by default. Paying does NOT transfer ownership. Assignment must be explicit and in writing; even a signed development contract does not transfer IP unless it contains a specific assignment clause.
United States. Under the US Copyright Act, copyright vests in the AUTHOR. Work-for-hire doctrine can apply, but only for employees or work commissioned in one of nine specific categories (general software is NOT in the list). Assignment must be explicit.
Common law jurisdictions generally. Australia, Canada, India, Ireland, New Zealand, and most Commonwealth countries follow similar patterns. Developer owns unless explicit assignment.
What this means. If your contract does not contain an explicit IP assignment clause, the agency probably owns the code regardless of how much you paid. Some agencies do not realise this; others exploit it. Both create risk.
WIPO on software IP internationally publishes country-by-country guidance if you are working with agencies in unfamiliar jurisdictions.
Work-for-Hire vs IP Assignment vs License
Three mechanisms often confused.
Work-for-hire. US legal doctrine (limited UK equivalent) automatically vesting ownership in the commissioning party. Only applies to employees or nine specific commissioned work categories in the US. General software outsourcing does NOT qualify. Do not rely on work-for-hire language alone.
IP assignment. Contractual transfer of all copyright and IP rights from creator to client. The standard for outsourced software. Must be present-tense ("hereby assigns") not future-tense ("will assign") to avoid disputes about whether assignment has actually occurred.
License. Agency retains ownership; grants client usage rights. Weaker because the agency can license the same code to competitors or revoke on breach. Occasionally appropriate (for productised platforms the agency sells to multiple clients) but rarely the right structure for custom software.
Which to use. For custom software built specifically for your business, use IP assignment. For platforms the agency has built as a product and adapts for you, license may work but negotiate perpetual, irrevocable, transferable rights.
The 8 Contract Clauses That Protect Your IP
Include all eight in outsourcing contracts.
1. IP assignment clause. Explicit transfer of all IP, copyright, patents, trade secrets, and derivative rights covering both existing and future work under the engagement.
2. Present-tense assignment. "The Contractor hereby assigns to the Client all right, title, and interest" not "The Contractor will assign." Future-tense clauses have been challenged successfully.
3. Waiver of moral rights. Developer waives right to be named as author, right to object to modifications, and other moral rights. Particularly important in UK where moral rights are automatic.
4. Warranty of originality. Agency warrants the code is original and does not infringe third-party IP. Protects against later infringement claims.
5. Third-party code disclosure. Agency lists all open-source and third-party components with license terms. Enables client to verify license compatibility before production.
6. IP infringement indemnity. Agency indemnifies client if third-party IP claim arises from the code. Cap negotiable; unlimited indemnity for wilful breach is standard.
7. Confidentiality survives termination. NDA continues after contract ends. Standard duration 3-5 years, covering source code, business logic, customer data, and commercial terms.
8. Return or destruction of materials. Agency returns all client materials on termination and destroys copies. Includes source code, credentials, documentation, and any derivative work.
NDA vs IP Assignment vs Non-Compete
Three distinct protections often confused.
NDA. Protects confidential information you share with the agency (business logic, customer data, trade secrets). Every outsourcing engagement needs one regardless of size.
IP Assignment. Transfers ownership of created work. Different from NDA; NDA protects what you share, assignment transfers what they create. Every custom software engagement needs it.
Non-Compete. Restricts agency from working with competitors. Limited enforceability in most jurisdictions (UK courts require narrow scope and legitimate interest; US enforceability varies by state, banned in California). Targeted non-solicitation of your employees is often more useful and more enforceable.
The rule. NDA and IP Assignment in every contract. Non-Compete only when there is specific competitive risk and jurisdiction allows meaningful enforcement.
Third-Party Code and Open Source Considerations
Modern software includes many open-source components; license compatibility matters.
Permissive licenses (MIT, Apache 2.0, BSD) are compatible with proprietary use. Copyleft licenses (GPL, AGPL) can require your entire codebase to be open-sourced if you distribute software that includes them. LGPL is middle ground. Most SaaS is not "distribution" so risk is limited, but on-premise or mobile deployments trigger the requirement.
Standard protection. Contract requires agency to disclose all third-party components with licenses. Client reserves right to review and require removal before production. Warranty of originality covers non-disclosed components.
What to check. Request a Software Bill of Materials (SBOM) at each milestone. Verify no copyleft contamination and no unlicensed or unattributed code.
Escrow Arrangements for Long-Term Protection
Third-party escrow protects against agency risk. An independent provider (Iron Mountain, NCC Group, EscrowTech) holds source code, documentation, build scripts, and credentials, with copies updated at defined intervals. Materials release to the client on trigger events: agency dissolution or insolvency, uncured breach, delivery failure for a defined period, or the agency ceases support.
When to require. Engagements above £100k or where the software is business-critical. Standard for enterprise engagements; uncommon for small builds. Cost £2k-£8k annually plus £500-£2k setup, typically split between parties.
What We Include in WhiteStone Contracts
Standard IP protections in every WhiteStone engagement: full present-tense IP assignment (client owns all IP from moment of creation); moral rights waiver per UK and applicable law; warranty of originality with no third-party infringement; SBOM delivered at each milestone listing all open-source components; full indemnity for IP infringement (uncontested for wilful breach); perpetual NDA that survives termination; source code delivered at each milestone rather than only at final payment; and third-party escrow for engagements above £50k with costs split.
We built a barcode and QR-based site management platform for a UK property developer. Full IP assignment applied from day one; source code delivered at each milestone; SBOM tracked throughout. When the developer expanded to additional projects, they had clean IP to license to their subsidiaries without renegotiating with us.
You can see our shipped work at our portfolio. If you want a contract review before signing, get a contract review with WhiteStone.
Common Failure Modes
Assuming payment transfers ownership. Founder pays agency £100k, assumes IP transferred. No assignment clause in contract. Agency legally owns the code. Discovered during due diligence for funding round.
Future-tense assignment. Contract says "will assign IP on completion." Agency delays completion or disputes trigger; assignment never actually happens. Present-tense ("hereby assigns") avoids this.
Ignoring third-party code. No SBOM requirement in contract. Agency includes GPL library. Client discovers post-launch; forced to remove component or open-source their platform.
Frequently Asked Questions
Who owns the code by default in a software development contract?
Under UK Copyright, Designs and Patents Act 1988 and US Copyright Act, the AUTHOR (developer or agency who wrote it) owns the code by default. Paying does NOT automatically transfer ownership. Assignment must be explicit in the contract. This is the biggest single risk in outsourcing.
What is a "work for hire" clause?
US legal doctrine automatically vesting IP in the commissioning party, but only applies to employees or 9 specific commissioned categories (audiovisual works, translations, and similar). General software outsourcing does NOT qualify. Use explicit IP assignment instead.
Do I need an NDA if the contract has IP assignment?
Yes, they cover different risks. NDA protects confidential information you share (business logic, customer data, trade secrets). IP assignment transfers ownership of created work. Every outsourcing contract needs both.
What are the most important IP clauses to include?
Eight: present-tense IP assignment, moral rights waiver, warranty of originality, third-party code disclosure, IP infringement indemnity, perpetual NDA, return/destruction of materials, and milestone source code delivery. Missing any creates specific risk.
When should I require escrow?
Engagements above £100k or business-critical software. Third-party provider holds source code and credentials; releases on agency dissolution, breach, or failure. Cost £2k-£8k annually plus setup.
The One Thing to Remember
In most jurisdictions, the developer owns the code by default. Paying does not transfer ownership. Every software outsourcing contract needs explicit, present-tense IP assignment plus the seven other clauses to protect your position. Founders who assume payment transfers IP discover the problem too late, usually during a funding round or when the agency licenses the same code to a competitor. Get a solicitor to review actual contracts before signing.
If you want a contract review before signing your next engagement, browse our custom software development services or come to the call.
