By default, the right to a website’s source code belongs to the individual—the direct developer-author—regardless of who paid for the development. The mere fact of transferring funds or paying an invoice does not transfer intellectual property rights to a business. A company becomes the full owner of the code only if there is a written assignment agreement for property rights or proper documentary execution of a work-for-hire within the staff.
- Payment does not equal ownership: A bank receipt or a standard act of rendered services only grants the right to use a copy of the product, while the intellectual property property rights remain with the programmer.
- In-house developer vs. freelancer: Even an employee working in an office requires clear job descriptions and work assignments; otherwise, the created website source code will be considered their personal development during free time.
- Subcontracting chain: When ordering development from a web studio or outsourcing agency, it is necessary to check contracts with the ultimate contractors to avoid claims from third parties.
- Technical fixation: A legal contract must rely on cryptographic hashes (SHA-256), Git repository commits, and a complete transfer of administrator rights in cloud services.
- State copyright registration: Obtaining a certificate from the IP office ensures the presumption of authorship, simplifies legal Due Diligence, and allows instant blocking of clone sites via DMCA.
A dangerous illusion still prevails among entrepreneurs: “If we paid $10,000 to create an online store or SaaS platform, it means all the software automatically belongs to our company.” In practice, courts review disputes every month where customers suddenly discover they only own the picture on the screen, while the backend, database, and scripts legally remain the property of the former programmer or contractor. Let’s examine in detail how copyright for a computer program works, where legal traps arise, and how to reliably protect your business’s digital asset.
Structuring Code as a Work-for-Hire In-House
Before turning to third-party web studios or looking for freelancers, a company should sort things out with developers already on staff. A common mistake among founders is believing that an employment record for the position of “programmer” or “web developer” automatically strips the employee of rights to the written source code.
Accordingly to civil codes and special legislation norms, a computer program created by an employee in connection with the performance of official duties is a work-for-hire. However, for the created object to truly acquire the status of a “work-for-hire,” the mere fact of paying a salary is not enough. If the company lacks documented task assignment processes, the employee can easily prove in court that they wrote the architectural core during non-working hours, on their own laptop, and granted the employer only a temporary launch license. More details on how to execute a work-for-hire for code without errors were discussed in a separate guide, and below we will focus on the main rules of HR record-keeping in IT.
Employment Contract and Developer Job Descriptions
The legal foundation is laid during hiring. If a developer signed a standard employment contract without detailed responsibilities, a serious risk arises. The programmer’s job description must contain a direct indication that their job function is writing, testing, optimizing, and modifying the source code of the company’s specific software systems.
In addition, it is critically important to tie the salary to the assignment of property rights. The employment contract should explicitly state: “The employee’s salary includes author’s remuneration for the assignment to the employer of all intellectual property property rights to any objects (including computer programs, source code fragments, scripts, databases) created in the process of performing official duties.” The absence of a section on author’s remuneration leaves room for the developer to demand separate payments for using their code for the company’s commercial purposes.
Distribution of Property Rights under Specialized Law
According to copyright laws (specifically updated statutory provisions), property rights to a work-for-hire pass to the employer from the moment of its creation in full, unless otherwise provided by the employment contract or a separate contract between the parties. This rule applies by default, but it has an important caveat: the work must be created specifically “in connection with the performance of official duties.”
To eliminate any uncertainty and so-called “dual power” over the product, interaction with the developer must be accompanied by internal documents: written technical specifications (or tasks in Jira/ClickUp/Trello integrated into the internal corporate development regulations), orders for project creation, and internal acceptance acts of results. If the project was created without a clear employer task, forensic examination may side with the employee, recognizing the code as their personal creative work outside working hours.
| Analysis Criterion | Employment Relations (In-house Employee) | Civil Law Contracts (Independent Contractor / Outsourcing) |
|---|---|---|
| Moment of Property Rights Transfer | From the moment of code creation (unless otherwise provided by the employment contract) | Only after signing the acceptance certificate and full payment (if stipulated in the contract) |
| Required Primary Documentation | Job description, employment contract, work-for-hire regulations, specifications/sprints | Commissioning contract or rights assignment agreement, specifications, code acceptance certificate |
| Remuneration Payment | Salary must explicitly include author’s remuneration for creating works | Separate service price and separate remuneration amount for rights assignment (lump-sum payment) |
| Personal Non-Property Rights | Remain with the developer; written consent for anonymous publication is required | Inalienable; the contract must regulate the use of code without mentioning the author’s name |
| Main Legal Risk | Recognition of code created outside job duties during free time | Obtaining only a non-exclusive launch license instead of code ownership |
However, in the realities of business, most developers are engaged not via employment records, but under civil law contracts with independent contractors or development studios. And here, completely different legal rules of the game apply.
Transfer of Rights to Code from a Contractor
When you cooperate with third-party contractors—freelancers, IT agencies, or outsourcing companies—a strict presumption rule applies: the customer has no rights to the software until they are explicitly transferred under a written contract. A standard contractor agreement or typical service provision contract regulates exclusively the development process and the fact of paid work, but by no means the legal status of the created digital product.
Why the Fact of Payment Does Not Transfer Rights
One of the most destructive mistakes an entrepreneur can make is considering a paid invoice as proof of acquiring ownership of the source code. In civil law, there is a fundamental distinction between a material object (or a service for its creation) and intellectual property rights. When you pay an invoice for development, you are paying the contractor for time spent, architecture writing, and server configuration. But the code itself is a computer program—a work protected by copyright norms.
Without a direct clause on the complete assignment of property rights, the customer defaults to receiving only an ordinary non-exclusive license to use a copy of the program for the intended purpose arising from the essence of the contract. This means you have the right to keep the site on hosting, but you have no right to sell the source code along with the business, transfer it for completion to other contractors, or license your own development to partners.
Features of Cooperation with Contractors and Studios
When interacting with contractors, it is necessary to clearly control the legal status of the person signing the contract. If you hire a web studio (LLC or agency), the issue of the Chain of Title arises. The contractor company itself does not know how to write code—code is written by specific individuals: the studio’s in-house developers or subcontractors involved by it.
If the studio has not executed agreements on the transfer of exclusive property rights or works-for-hire with its programmers, it legally has no right to transfer this code to the end client. In judicial practice, an immutable Roman principle applies: “No one can transfer more rights than they have themselves” (Nemo dat quod non habet). If the studio lacks primary rights from the author, any contract between the studio and your business regarding software transfer is legally null and void.
To protect yourself when concluding a contract with an independent contractor or IT company, use a proven set of mandatory clauses:
- Rights assignment clause: A clear provision that all intellectual property property rights to the created website source code and all its modules are assigned (transferred) to the Customer in full from the moment of signing the acceptance certificate.
- Warranties and Indemnities: The contractor’s obligation to guarantee that they own all necessary rights to the code, that the software does not violate third-party rights, and in case of claims, the contractor independently and at their own expense will settle all disputes and compensate the customer’s losses.
- Separation of custom code and libraries: The performer’s obligation to provide an exhaustive list of Open Source / Free Software components used in development, indicating their licenses (MIT, Apache 2.0, GPL, etc.).
- Transfer of rights to third-party modules and platforms: The obligation to create or transfer all ownership powers (Owner/Admin) for repositories, hosting accounts, app stores (App Store / Google Play), and bot control panels.
- Assignment price in the cost structure: Fixation that the total cost of work under the contract includes both payment for development services and irrevocable remuneration for the transfer of property rights.
Even after fixing these provisions in general terms of cooperation, the key document remains a special agreement on the assignment of property rights.
Agreement on the Transfer of Property Rights to Code
To eliminate any legal threats in the future, the parties must conclude a full-fledged commissioning contract or an agreement on the assignment of property rights. According to the Civil Code, this particular document ensures the irrevocable transfer of the digital asset into the buyer’s ownership. If your business is scaling, attracting venture capital investments, or preparing for sale, professional transfer of intellectual property rights is the first parameter auditors will check during Due Diligence.
Essential Terms of the Rights Assignment Agreement
If the contract is drafted vaguely or as a template, the court may recognize it as unconcluded. For reliable fixation of rights, the agreement must contain the following essential terms:
1. Precise identification of the computer program: It is not enough to write “source code of a web resource” in the contract. It is necessary to indicate the working title of the project, the functional purpose of the site, programming languages (e.g., Python/Django, TypeScript/React), the project repository, and a link to the technical specification detailing the architecture.
2. Full scope of assigned property rights: According to legislation, the customer must obtain the exclusive right to use the work in any way, the exclusive right to permit or prohibit the use of the work by other persons, the right to public display, reproduction, modification, adaptation, decompilation, making changes, integration with other systems, and distribution of source code without restriction on the territory of action (territory — the entire world) and throughout the entire term of copyright validity.
3. Amount and procedure for paying author’s remuneration: Free transfer of rights between commercial entities is strictly controlled by tax authorities and courts. The contract must clearly state which part of the amount is payment for development, and which part is author’s remuneration (lump-sum payment) for the assignment of rights. For example: “Remuneration for the transfer of property rights to software is 20% of the total contract amount and is considered fully paid from the moment of final settlement.”
Inalienability of the Author’s Personal Non-Property Rights
The most common mistake made by non-specialized lawyers is writing the phrase into the contract: “The developer transfers all copyrights to the code to the customer, including the right of authorship.” This wording is absolutely void by law.
In addition, it is worth paying attention to Open Source components. If the developer used libraries under viral copyleft licenses (e.g., GNU GPL v3) in the project, then under the terms of such a license, any derivative code created using this library must also be distributed as open source software. This creates a catastrophic risk: your commercial closed code may end up under the threat of mandatory opening to the whole world. The contract must directly oblige the contractor to use exclusively libraries with permissive licenses (MIT, BSD, Apache 2.0) and coordinate any other software with the client.
Acceptance Certificate and Fixation of Source Code
Even a flawlessly drafted agreement on the assignment of property rights turns into abstract paper if the parties cannot prove exactly what code was created and transferred. In the event of a legal dispute, the court must be provided with evidence: whether what is running on the company’s server today is indeed the object for which funds were paid under the contract.
Transfer of Repositories and Provision of Technical Accesses
Today, development is not transferred on CDs or flash drives. The entire software lifecycle is concentrated in Git version control systems (GitHub, GitLab, Bitbucket). The legal closure of a project must be accompanied by clear technical control transfer procedures.
The main security rule: the customer should never accept work in someone else’s repository. The project must initially be created inside the Customer’s organization (Organization Account) on GitHub/GitLab. If the contractor developed in their own repository, the final transfer must involve an Owner Transfer, revocation of all SSH keys, personal access tokens (PAT), and accounts of previous developers. Additionally, the company must change master passwords and API keys for databases, cloud servers (AWS, GCP, Hetzner), and payment systems.
Fixation of Code Versions in Paper Acts
How to materialize digital source code for court and accounting? A standard two-line act “Development services provided in full, parties have no claims” does not protect the business. The acceptance certificate must necessarily include technical identification of the software.
For this, hash sums and commit tracking are used. When the final version of the code is uploaded, the repository archive is generated. Using a standard cryptographic algorithm, the control sum of the file (SHA-256 hash) is calculated. This unique string of characters is the digital fingerprint of your program. Changing even a single character or space in any project file will irreversibly change the hash. Entering this hash and the number of the last commit into the acceptance certificate makes code substitution by the developer technically impossible.
Key Action: Code review for third-party Open Source libraries under aggressive copyleft licenses (GPL, AGPL) and backdoors.
Goal / Requirement: Checking dependencies in package.json, requirements.txt, composer.json for legal compatibility with the customer’s business model.
Result: Obtaining an audit report on codebase cleanliness and the absence of hidden licensing risks.
Key Action: Transferring the role of primary Owner in the Git repository to the customer’s corporate account.
Goal / Requirement: Complete revocation of accesses, SSH keys, certificates, and API tokens of all third-party programmers and contractors.
Result: Technical control over the infrastructure completely passes into the hands of authorized persons of the customer company.
Action: Exporting the final slice of the project (master/main branch) and calculating the control hash sum of the code archive using the SHA-256 algorithm.
Requirement: Fixation of the last commit identifier (Commit Hash), repository link, and data size in bytes.
Result: Creation of a unique immutable digital passport of the transferred software version.
Authority / Action: Drafting and signing an expanded acceptance certificate of property rights with the integration of all technical data (hashes and commits).
Basis: Fulfillment of essential terms of the rights assignment agreement or commissioning contract.
Result: Legal transition of exclusive property rights to the program from the contractor to the customer in full.
Decision: Submitting an application for state copyright registration to obtain a protection certificate.
Result: Ensuring judicial presumption of authorship, readiness to pass Due Diligence, and the ability to block infringers via DMCA.
With correctly signed contracts and acts with hash fixation in hand, a business receives solid legal protection. However, in the public space and when working with hosting providers, the most weighty argument remains an official state certificate.
State Copyright Registration for a Program
Although copyright arises at the moment of creation of a work and does not require mandatory registration for its protection, abandoning official registration creates serious procedural complexities. If a former developer or unscrupulous partner makes claims to your service, you will have to order an expensive computer-technical examination and spend months proving the chronology of development in court.
Official registration and issuance of protective documents are carried out by the National Intellectual Property Authority, operating under the structure coordinated by the Ministry of Economy of Ukraine. The obtained certificate of copyright registration for a computer program establishes a legal presumption of authorship: the registered person is considered the owner of the work until proven otherwise in court.
Patent Office Application Procedure
An application for state copyright registration of a computer program can be filed by both an individual (author) and a legal entity (employer or customer under an assignment agreement). The procedure is regulated by special rules fixed in the official system.
The package of documents includes: 1. A standard application form with information about the author and applicant; 2. Documents confirming the fact of property rights transfer (employment contract, order for creating a work-for-hire, or rights assignment agreement with an act); 3. Document on payment of the official state fee; 4. Materials of the work: a abstract describing program functions and source code fragments (code depositing).
An important practical nuance that developers often forget: submitting the complete source code of the project with all secrets and architectural keys is unnecessary and even harmful. According to IP office rules, for depositing, it is enough to provide a printout (or electronic PDF document) of up to 20–30 pages, including the initial and final fragments of the program’s source code reflecting its structure. This allows securely fixing the work in the state archive without revealing the trade secret of your system’s core to competitors.
Using the Certificate for Anti-Copying Protection
The presence of an official state certificate turns a computer program into a full-fledged company asset. First, it can be put on the balance sheet of a legal entity as an intangible asset (IA), which increases business capitalization for banks and investors. Second, it significantly facilitates out-of-court rights protection on the internet.
Scenario WITHOUT a Certificate:
Competitors stole the layout and unique delivery calculator script of an online store. The owner sends a complaint to the hosting provider (DigitalOcean) and a DMCA complaint to Google. The provider demands legal proof of code ownership. Provided bank statements of payments to a freelancer are rejected as irrelevant. The infringer continues collecting customer traffic. The customer has to prepare a lawsuit, spend over $2,500 on forensic examinations, and wait for consideration for over 8 months.
Scenario WITH a Certificate:
The company submits a copy of the Copyright Registration Certificate along with a DMCA complaint to Google and the infringer’s hosting. For foreign providers, the official state certificate is an indisputable document of ownership. The search engine removes clone pages from results within 48 hours, and the hoster blocks the infringer’s account until circumstances are clarified. The conflict is resolved in 3 days without legal costs.
In addition, the certificate is critically necessary when removing pirated mobile clone apps from the Apple App Store and Google Play Store. Corporate moderators require clear proof of rights (Certificate of Registration), without which complaints are often left unconsidered.
Specificity of Bots, Apps, and Content Gaps in Practice
Modern IT infrastructure rarely limits itself to a regular website. Entrepreneurs order mobile application development, Telegram bots, and databases. Each of these objects has its own legal specificity, which most general practice lawyers completely ignore.
Who Owns a Telegram Bot and Mobile App
Creating a Telegram bot consists of two different components: the program backend (Python or Node.js code processing commands) and the bot itself as an interface in the messenger linked to a token in @BotFather. A common trap: the customer receives the bot code, but the developer created it from their personal Telegram account. Whoever controls the creator account in BotFather can change the token, reset the Webhook, or redirect client requests to a third-party server at any moment. The bot development contract must contain the performer’s obligation to transfer administrator rights via special Telegram functionality or register the bot directly from the client’s corporate number.
A similar situation arises with mobile apps for iOS and Android. If the developer uploaded the app to their own developer account (Apple Developer Program or Google Play Console), the company is “on the hook.” App rights transfer requires a separate account transfer procedure within platforms, for which both parties must have active paid developer accounts. Until the app is transferred to the customer’s account, the performer remains the software copyright holder in the eyes of Apple and Google.
Rights to a Database: How It Differs from Code
A site without data is just an empty frame. Customers often confuse the source code of a content management system (CMS) and a database of customers or products. According to copyright laws, databases are protected as independent objects (compiled works under copyright), as well as by a special sui generis right (the database maker’s special right).
If the contractor collected and systematized a nomenclature of 50,000 products for you, created links and structure, they can claim separate rights to this database unless the contract states that exclusive property rights to the database structure and content are assigned to the customer. Always separate the concepts of “computer program” and “database” in contracts.
Outstaffing and Subcontractor Risks
In outstaffing, you hire personnel who formally belong to another IT company but work on your product under your direct management. The main risk is that the outstaffing company itself often registers its developers as independent contractors under service agreements. If these internal contracts do not provide for the automatic assignment of property rights to the created code in favor of the agency, the chain of rights transfer breaks.
If such a developer decides to leave with a scandal, claims will be directed precisely at the end customer using the product in business. To make such scenarios impossible, in the outstaffing contract, the customer must have the right to audit the contractor’s agreements with final performers, as well as a clause on the mandatory provision of mirror rights assignment acts for each released release.
What to Do If a Developer Blocked the Repository and Demands Money
This is a classic blackmail situation: the release is scheduled for Monday, but over the weekend a freelancer or dismissed employee changes GitHub passwords, removes rights from corporate emails, and demands payment of a “bonus” to return access. The action algorithm in such a crisis must combine legal and technical levers:
1. Fixation of blackmail evidence: Make notarized or expert-secured correspondence (screenshots from Telegram, corporate mail, Slack). Save server and repository access logs confirming the fact of blocking by a specific person.
2. Analysis of the criminal-legal plane: The actions of a programmer who unauthorizedly changes credentials and blocks the operation of company information systems fall under criminal liability provisions for unauthorized interference in automated systems. In addition, extorting money under the threat of data destruction or release disruption qualifies as extortion. An official written claim referencing the opening of criminal proceedings and an appeal to Cyberpolice in 80% of cases returns the contractor to a constructive dialogue within a few hours.
3. Appealing to service administration (GitHub / hosting): If the rights assignment agreement or employment contract was signed, send an official appeal to GitHub or GitLab support providing copies of contracts, statutory documents, and payment evidence. Platforms have regulated corporate conflict resolution procedures to restore access to legal organization owners.
Digital Asset Security and Legal Support
The source code of a website, mobile application, or web service is the foundation of modern business capitalization. Relying on the fact that “the contractor is decent and nothing will happen” is unacceptable for an entrepreneur building a sustainable company. By law, the developer always remains the owner of the code until proven otherwise by legally flawless documents.
Digital asset protection must be built comprehensively: through clear job descriptions and work assignments of in-house specialists, agreements on the assignment of exclusive property rights with contractors, technical fixation of hashes in Git repositories, and state software depositing in the IP office registry. If you plan to launch a complex IT product or want to check the legal cleanliness of an already developed platform, BrandR specialists will help conduct an audit, draft secure contracts, and properly execute the transfer of intellectual property rights in accordance with legislation.
