How to Protect Rights to a Custom-Made Online Store

Hello! I am Maksym Petrov, a lawyer at BrandR. In my practice of creating online businesses, I constantly observe the same critical mistake: a founder invests tens of thousands of dollars in layout, complex backend, integration with ERP and warehouse systems, but legally remains a “tenant” of their own website. When the client decides to change contractors, scale the project, or attract investment, it suddenly turns out that the source code of the online store belongs to a freelancer, the control panel is registered to the technical lead’s personal email, and the domain is registered to a web studio.

An online store is a complex digital asset that simultaneously combines a computer program, a database, graphic design, trademarks, and commercial structures. Below, we will analyze in detail how to build flawless legal protection for an e-commerce platform, how to avoid traps set by unscrupulous developers, and what to do if a conflict has already escalated into an active phase.

What to Do When a Developer Blackmails You with Source Code

Conflicts between a client and a developer most often arise at the final stage of a project: during launch on the “production” server or approval of the list of modifications. An unscrupulous developer suddenly changes passwords to the content management system (CMS), blocks the repository, or deletes backups, demanding additional payment that was not provided for in the technical specifications. According to provisions contained in the Civil Code of Ukraine (Book Four: Intellectual Property Law), the absence of an agreed procedure for transferring rights frequently provokes contractors into exercising pressure.

The first 24 hours after an incident are critical. If a developer has blocked access to the control panel or servers, any chaotic actions or emotional negotiations in messengers will only worsen your position. You must immediately activate the legal and technical response protocol.

If you find yourself in a similar crisis where a developer threatens to destroy the database or sell developments to competitors, use the step-by-step legal algorithm of actions during code blackmail. To eliminate such risks in the future, timely copyright registration at the stage of readiness of the platform’s baseline release always acts as a preventive barrier.

Legal Algorithm of First-Line Actions During Blackmail

When a contractor openly issues ultimatums, business owners are tempted to make concessions: pay unofficially “to a card” or sign unfavorable supplementary agreements. As a lawyer with many years of experience in the commercial sector, I strongly caution against this step. Practice shows that the first unauthorized payment is inevitably followed by a second, and the client never regains actual control over the project.

It is important to understand the criminal and civil qualification of such actions by the contractor. If the parties have concluded a website development contract that agrees on the payment schedule and work stages, arbitrary blocking of the website’s operability, changing passwords, or withholding code constitutes a breach of contractual obligations. If the developer modifies the client’s server settings or unauthorizedly changes user accounts for the purpose of blocking, this falls under the features of Article 361 of the Criminal Code of Ukraine (unauthorized interference in the work of information and communication systems). In cases where extortion of funds is accompanied by threats to damage the database, disclose customers’ personal data, or destroy the business, such actions may be qualified as extortion (Article 189 of the Criminal Code of Ukraine) or arbitrariness (Article 356 of the Criminal Code of Ukraine).

Claims work must begin immediately. The pre-trial claim must contain a clear statement of facts: contract number and date, amounts of payments made, references to clauses on the transfer of rights, and a specific deadline (typically from 24 to 72 hours) for the transfer of the full source code archive and commits in the repository. The claim should be duplicated by email specified in the contract details and sent by courier with delivery confirmation.

Evidence Fixation and Judicial Recovery of Access

In the event of a legal dispute, the court operates exclusively with admissible and proper evidence. The main mistake entrepreneurs make is deleting emotional dialogues in Telegram or clearing cache. Electronic correspondence is of critical importance. According to the Law of Ukraine “On Electronic Documents and Electronic Document Management,” screenshots of email and messengers are recognized by courts if they allow establishing the authors of the correspondence, the date, and the exact content of the messages.

The following tools are used to build an ironclad evidentiary base:

• Protocol of web resource inspection: Involving a lawyer or judicial expert to record the inaccessibility of the website, the fact of traffic redirection, or the presence of blocking messages using specialized software.
• Independent computer-technical expertise: Appointed in court proceedings to establish the authorship of the code, the presence of third-party backdoors or artificially created errors that prevent the normal operation of the store.
• Requesting logs from providers: An attorney’s request to hosting providers and mail services demanding to preserve and provide routing tables and authorization logs in the control panel.

Transitioning to a constructive dialogue often happens precisely at the moment when the contractor realizes that the client is no longer in the position of a victim, but is methodically preparing a lawsuit for the recovery of direct losses and lost profits. However, to avoid falling into such traps altogether, it is critically important to prepare the right contract in advance.

Development Contract: Intellectual Property Protection

No personal trust, recommendations from acquaintances, or portfolio of a well-known studio can replace a thoroughly vetted contract. A website development contract is primarily a document on the assignment of rights to an intangible asset, and only secondarily a technical instruction for the contractor. The basic rule of Ukrainian intellectual property legislation is categorical: if the contract does not explicitly state that intellectual property property rights pass to the client in full, they remain with the author-developer.

According to Article 1107 of the Civil Code of Ukraine, any disposition of property rights must be clearly formalized. Clients often believe that signing an ordinary works contract makes them the full owner of the code. This is a dangerous illusion: under a works contract, you only pay for the service of creating an object, but you do not acquire the exclusive right to dispose of it, sell it, modify it, or replicate it.

Mandatory Provisions of the Rights Transfer Contract

To neutralize any claims from developers in the future, the contract must contain the following essential terms for protecting intellectual property:

• Full scope of rights: The contract must provide specifically for the transfer of exclusive property rights in full to all created objects (the computer program as an object of law, graphical interface, layout, scripts, databases), rather than a standard non-exclusive license.
• Territory and validity period: The transfer of rights must be valid without territorial restrictions (worldwide) and for the entire term of copyright validity determined by the law.
• Moment of rights transfer: It is legally sound to establish the transfer of property rights in stages — from the moment of signing an interim or final acceptance certificate and full payment for the respective stage of work.
• Right to modification and alterations: The client must have the unconditional right to decompile, rework, rewrite code, involve third-party developers, and create derivative works without the need to obtain permission from the initial contractor.
• Guarantee of patent and copyright purity: The contractor guarantees that the website’s source code does not contain plagiarism or foreign proprietary modules and is created without violating the rights of third parties. If open-source libraries are used, the contractor is obliged to provide an exhaustive list of them indicating the license types (MIT, Apache 2.0, GPL), guaranteeing the absence of “viral” licenses that force the disclosure of commercial code.

Comparison of Typical and Secure Development Contracts

Web studios and freelancers usually offer their own contract templates that exclusively protect the contractor’s interests. Below is a comparative analysis of a standard online template contract and a contract with full IP protection for the client.

As we can see, even the most detailed contract remains a declarative document if the parties have not fixed the actual performance of work with primary accounting and legal documents. Let us move on to the procedure for formalizing the delivery and acceptance of results.

Transfer of Property Rights and Acceptance Certificate

The completion of development is not the moment when the studio manager sends you a message saying, “Look, everything is working on the test domain.” Legally, the work is considered completed and the asset created only when the corresponding acceptance certificate of rights has been signed, and the entire digital array has been physically moved under the client’s control. According to the Law of Ukraine “On Accounting and Financial Reporting in Ukraine,” the certificate is a primary document confirming the execution of a business transaction and allowing the intangible asset to be placed on the company’s balance sheet.

The procedure for accepting an IT project requires a clear chronology. Trying to sign a general template certificate without a technical audit of source files often leads to the client paying money for unworking compiled code without comments or architectural documentation.

Stages of Rights Transfer During Development

To minimize financial risks, large projects are broken down into sprints and milestones. For each sprint, the client accepts a specific tangible result: interface layouts in Figma, frontend layout, authorization microservice, or payment gateway integration module.

Payment for each stage must be accompanied by an interim certificate, which clearly states: “Intellectual property property rights to the results of work for stage No… pass to the client in full from the date of signing this certificate.” If the contractor breaks the final deadlines or refuses to continue work, you will already own the rights to half of the created functionality and can smoothly transfer it to another team.

Signing the Certificate and Checking Source Files

Before putting a seal and signature on the final certificate, be sure to verify the composition of the digital archive. The contractor must provide not just a link to a working web resource, but a complete development kit:

• Full website source code with all comments, development branches, and commit history in Git repository format;
• Structure and full database dump (SQL dump) without test “garbage”;
• All original design layouts (vector files, Figma components with editing rights);
• Web server configuration files, build scripts (Docker containers, CI/CD pipelines);
• Full list of administrator accounts, hosting accesses, DNS management panels, and API keys of integrated services.

The text of the certificate itself must indicate exact identifiers: repository name, unique hash of the last accepted commit (Git commit hash), volume of transferred files in gigabytes, and a direct wording: “The contractor confirms the full assignment of exclusive intellectual property property rights to the specified objects in favor of the client, and the cost of rights assignment is fully included in the remuneration amount under the contract.”

Protection of the Store’s Unique Interface and Design

The software backend is hidden from users’ eyes, but competitors can copy the design, catalog structure, placement of conversion buttons, and visual style of the online store within hours. In e-commerce, cases of “mirror cloning” are frequent, where fraudsters completely copy the frontend of a successful store, connect their own payment terminal, and intercept search traffic for branded queries.

According to the norms defined by the Law of Ukraine “On Copyright and Related Rights”, website design is protected as a work of fine art or a compilation work. However, practical design protection has significant pitfalls that freelance designers rarely think about.

Legal Status of Graphical Elements and Interface

For comprehensive protection of visual identity, copyright alone may not be enough. Copyright protects the form of expression, but does not protect the idea itself, concept, or functional business logic of element placement. Therefore, experienced entrepreneurs use multi-level protection:

• Copyright on layouts: Protects graphic images, banners, unique icons, and page UI design. Protection arises automatically from the moment of creation, but requires documentary confirmation of authorship and transfer of rights from the specific designer. If you need official protection of your visual style, mandatory qualified registration of copyright for the website design is carried out in the state registry.
• Trademark (TM): The store’s name, brand slogan, and logo must be registered as verbal and combined signs for goods and services under the relevant Nice classification classes (in particular, class 35 – retail services). This grants the absolute right to prohibit third parties from using similar designations.
• Industrial design: The appearance of the store’s interface or its individual screens can be registered as an industrial design. This secures a monopoly on the page’s visual solution and serves as a powerful argument in patent disputes.

Preventing Competitors from Copying Your Corporate Identity

If you discover a direct clone of your store, the most effective tool to combat it is out-of-court blocking of the offender via the DMCA Takedown Notice procedure and local registrars’ rules. The action algorithm consists of three consecutive steps:

1. Identifying the infringer’s hosting provider: Using WHOIS services and DNS checkers, the data center and hosting where the clone site is physically located are determined, as well as its domain name registrar.
2. Submitting an official DMCA complaint to hosting: A legally grounded copyright infringement complaint is sent to the hosting provider with links to the primary source, content creation dates, and proof of your property rights. Most international providers (Cloudflare, DigitalOcean, Hetzner, AWS) block access to the clone site within 24–48 hours to avoid joint and several liability.
3. Removal from Google Search Results: At the same time, a request is submitted via the special Google Copyright Removal form (Lumen Database). After brief moderation, the infringer’s pages are completely removed from search results, depriving the clone of traffic.

State Copyright Registration for the Platform

In accordance with Ukrainian legislation, copyright to a work arises automatically at the moment of its creation and does not require mandatory registration. However, in business, the presumption of “automatic emergence” often shatters against the complexity of litigation. If your rights are challenged by an unscrupulous contractor or competitor, you will have to provide tons of paper printouts, order expensive expertise, and prove the creation date of each fragment of code.

State copyright registration at the National Intellectual Property Office (IP Office) changes the situation 180 degrees: it secures the official presumption of copyright ownership. Upon receiving a Certificate of Copyright Registration for a work, your opponent will be the one forced to refute your primacy in court.

You can check the status of registered objects or find analogs through open Intellectual Property Databases. The document submission procedure and application expertise standards are regulated by the official Register of Regulatory Legal Acts in the IP Sphere.

Benefits of an Official Certificate for Digital Business

Having a Certificate provides the owner of an e-commerce platform with a number of strategic commercial and legal tools:

• Legitimate company capitalization: Having a certificate allows evaluating the software and seamlessly placing the platform on the legal entity’s balance sheet as an intangible asset (IA) according to NP(S)AO 8 standards, increasing the company’s net assets for attracting bank loans and investments.
• Blocking counterfeits and clones on marketplaces: International platforms and social networks (App Store, Google Play, Meta, Amazon) require official documents to resolve conflicts. The state certificate number guarantees immediate satisfaction of complaints against infringers.
• Simplified recovery of compensation in court: Having a certificate eliminates the need to spend tens of thousands of hryvnias on initial technical expertise of authorship. The court immediately accepts the certificate as proper evidence, paving the way to recover statutory compensation from the infringer (from 10 to 50,000 living wage minimums) instead of hard-to-prove losses.

This is why professional copyright registration is the baseline security standard for any online store into which significant financial resources have been invested.

Case Study: Successfully Protecting a Store from Cloning

Let us consider a typical practical case from the practice of BrandR lawyers protecting e-commerce projects, which clearly demonstrates the difference in time and money costs with and without a certificate.

Infrastructure Assets: Domain, Hosting, and Ad Accounts

In addition to code and design, this case relies on critical external infrastructure. Losing control over a domain name or ad accounts can instantly paralyze sales, even if all website source files are sitting on your disk.

Often, web studios “for the client’s convenience” buy a domain on their partner account with a registrar, set up hosting on their own system administrator, and configure ad campaigns inside their corporate Facebook Business Manager. This creates a colossal risk of corporate blackmail.

Regaining Control Over Domain and Hosting

Remember the main rule: ownership of a domain (or rather, the status of Registrant / Licensee) is determined exclusively by the data entered into the domain name registry. If the “Registrant” field indicates the legal entity or passport data of the developer, they are the legal manager of the domain, no matter how much money you transfer for its renewal.

If the contractor registered the domain in their name and refuses to transfer the auth-code (transfer code):

1. Gathering primary financial documents: Find all bank statements and payment orders confirming that payment for domain name registration was debited from your bank account (or reimbursed to the contractor under the contract).
2. Contacting the domain name registrar: Submit an application to the registrar with evidence of abuse of trust by the technical contractor. If the domain is located in the Ukrainian zone (.ua, .com.ua), a key factor is the presence of a registered trademark. According to the Uniform Domain Name Dispute Resolution Policy (UDRP / UA-DRP), the TM holder has a preferential right to the domain name and can sue for it or transfer it to themselves through a simplified procedure.
3. Changing hosting DNS records: If the hosting is registered to the contractor, but the domain is in your hands, immediately deploy the saved website backup to a new independent hosting (registered to your enterprise) and redirect domain A-records to new IP addresses.

What to Do If an Agency Appropriates an Ad Account

Marketing agencies often set up Google Ads or create a Meta Business Manager inside their structure, arguing this by “agency discounts.” After terminating the contract, the business faces a choice: lose years of accumulated optimization history, pixels with collected retargeting audiences, and analytics, or pay a buyout fee.

To regain control over advertising assets through official platform support:

• Meta Business Support Dispute Procedure: A request is submitted to review ownership rights of the Business Manager (Business Ownership Dispute). Meta requires official documents: an extract from the Unified State Register of Enterprises and Organizations of Ukraine, invoices for ad payments from the company’s bank card, an official statement letter on enterprise letterhead signed by the director, and notarized proof of rights to the respective domain name. If payments were made from the client’s card, Meta transfers primary ownership of the Business Manager to the legitimate business owner.
• Google Ads Dispute: Google resolves disputes in favor of whoever owns the Payments Profile. If you paid for advertising directly from your settlement account, Google Ads support, after verifying legal documents, appoints your email address as the primary account administrator and removes the unscrupulous agency.

Comprehensive Legal Protection of Your Solution

The solution is the heart of a commercial digital business. Investing in modern design, a fast backend, and marketing means you should not leave the building’s foundation open to corporate raiding, unscrupulous contractors, or competitor plagiarism. Legal security of the solution rests on three pillars: a vetted development contract with full transfer of exclusive rights, primary acceptance certificates for source files, and an official state certificate.

Protect your digital assets in advance — before the solution reaches multimillion-dollar turnovers and becomes a target for copying or blackmail. The BrandR team of experts is always ready to take on all the routine of contractual work, intellectual property registration, and protecting your business’s interests.

Frequently Asked Questions (FAQ)