The control that matters most
Not the contract — the repository. Code pushed continuously to an account you own means that whatever happens to the relationship, you hold your product. Nearly every offshore horror story involves a client who did not have the code.
Contracts matter and are worth getting right. But practical controls protect you far more reliably than the theoretical ability to enforce terms across a border.
The two legal instruments you need
| NDA | IP assignment | |
|---|---|---|
| Covers | Confidentiality of information | Ownership of created work |
| Prevents | Disclosure to others | Vendor retaining rights |
| Without it | Your information may be shared | You may not own what you paid for |
| Common gap | Rarely omitted | Frequently omitted or weak |
Paying for software does not automatically make you its owner. In many jurisdictions the author holds copyright unless there is a written assignment. An external vendor is not your employee, so the employment exception does not apply. If your contract does not explicitly assign IP, you may hold a licence to use rather than ownership — and you will discover this during due diligence at the worst possible moment.
Contract terms that actually matter
- Assignment, not licence. The word matters. "Assigns all right, title and interest" is ownership; "grants a licence to use" is not.
- Effective on final payment, and covering everything created under the engagement.
- Scope defined broadly — source code, build scripts, documentation, designs, test suites, configuration, and for AI work, prompts and evaluation sets.
- Pre-existing material licensed. If the vendor reuses their own framework, you need a perpetual irrevocable licence to it — otherwise your product depends on something you cannot control.
- Third-party component inventory with licences, delivered at handover. Critical if you will distribute the software.
- Non-reuse of your specific business logic, distinguished from generic patterns.
- Moral rights waived where the jurisdiction recognises them.
- Survival — these terms outlive the engagement.
The practical controls
These do more work than the contract, because they mean you never need to enforce it:
| Control | Protects against |
|---|---|
| Your repository, from day one | Losing access to your own product |
| Your cloud and hosting accounts | Infrastructure held hostage |
| Your domain registrar account | The most damaging single loss |
| Milestone payments | Paying for undelivered work |
| Named individuals under NDA | Information spreading beyond the team |
| Access reviews | Departed staff retaining access |
Set up the repository before the kickoff call. Create a GitHub or GitLab organisation in your company name, invite the vendor as collaborators, and require all work to be pushed there daily. It takes fifteen minutes and eliminates the single worst offshore failure mode entirely.
Data protection, separately from IP
If the vendor will access customer data, personal data or production systems, that is a distinct concern from code ownership:
- Use anonymised or synthetic data for development wherever possible.
- Restrict production access to named individuals, time-limited, logged.
- A data processing agreement if personal data is involved, particularly for European data subjects.
- Specify where data may be stored and processed.
- Define deletion obligations at engagement end.
What you cannot fully prevent
Being realistic rather than reassuring:
- Knowledge transfer. Engineers who worked on your system understand your domain afterwards. No contract changes that.
- Generic pattern reuse. Common architectural approaches will inform their later work.
- Cross-border enforcement difficulty. Litigation across jurisdictions is slow and expensive regardless of what the contract says.
This is why practical controls matter more than legal ones. A contract is what you rely on after something has gone wrong. Holding the repository means it mostly cannot.
Handover checklist
Before final payment, confirm you have received:
- Complete source in your repository, with full commit history.
- Build and deployment scripts, tested by someone on your side.
- Documentation sufficient for a new engineer to run the system.
- Third-party dependency list with licences.
- All credentials, transferred and then rotated.
- Architecture and data model documentation.
- For AI systems: prompts, evaluation sets, and model configuration.
- Signed confirmation that IP assignment is effective.
If something has already gone wrong
- Secure what you can access — repository, registrar, hosting — before raising the dispute.
- Document the current state and what is missing.
- Review what the contract actually says, not what you assumed.
- Negotiate first. A retrospective assignment for a fee is far cheaper than litigation.
- Assess rebuild cost as your fallback position — knowing it strengthens the negotiation.
Setting up an offshore engagement and want the terms right first? Ask us what we would sign — we assign IP on final payment and work in your repository from day one. See our offshore buyer's guide and source code ownership.