The NDA Isn't Enough: What Real IP Protection Looks Like in a Dev Engagement

Founders sharing a product idea with a development vendor almost always ask for an NDA, and almost never ask the questions that actually determine whether their intellectual property is protected in practice. An NDA covers confidentiality: the vendor can't disclose what you've told them. It says nothing about who owns the code once it's written, what happens to your data and access if the relationship ends, or whether you can actually take your system elsewhere if you need to.

Ownership of the code isn't automatic, and it should be explicit

In most jurisdictions, absent a clear contractual assignment, a vendor writing custom code for you doesn't automatically transfer full ownership to you the moment they're paid. This varies by contract structure and jurisdiction, which is exactly why it needs to be explicit in writing, not assumed. Before any work starts, the contract should state plainly that you own the resulting code, data, and designs outright upon payment, not that you're licensed to use something the vendor retains rights to.

We've seen founders discover, well into a relationship, that a previous vendor's contract left ownership ambiguous, which becomes a real problem the moment they want to switch vendors or bring development in-house.

Access and portability: can you actually leave if you need to

Real protection means you're never locked into a single vendor by default. That means: you hold the actual domain, hosting, and infrastructure accounts, not accounts controlled by the vendor with you as a secondary user. You have access to the full, current source code repository at all times, not just at project handoff. And your production data is exportable in a usable format, not trapped in a proprietary structure only the original vendor's tools can read.

None of this is about distrust of a specific vendor. It's about the relationship surviving a disagreement, a vendor going out of business, or simply a decision to change providers, without your business being held hostage by infrastructure you don't actually control.

What happens to your data if the engagement ends

A clear contract specifies what happens to your data and access on termination, not just what happens to confidentiality obligations. This should include a defined transition period, a commitment to hand over full access and documentation, and clarity on whether the vendor retains any copy of your data after offboarding and under what conditions, if any.

What we put in writing before any work starts

An NDA before any sensitive detail is shared, always. But alongside it: explicit IP ownership assignment upon payment, your name on all domain and infrastructure accounts from day one, full repository access maintained continuously rather than delivered only at the end, and a written offboarding process covering data handover and access transition if the engagement ever ends. This isn't unusual to ask for. It's a sign of a vendor confident enough in the relationship that they don't need lock-in to keep your business.

If a vendor resists putting any of this in writing, treat that resistance itself as the answer to whether your IP is actually protected, regardless of what the NDA says.