Protecting IP when outsourcing software development: contracts, access and EU data rules

This guide is for founders, CTOs and procurement leads who have chosen, or are shortlisting, an outsourcing partner. Our software development outsourcing guide covers cost, vendor selection and team models; this page goes deeper on one question: how the code, designs and data you pay for stay yours. It is general guidance, not legal advice.

In this guide

• Three kinds of IP in every outsourced project
• Contract clauses to put in writing
• Technical controls that matter more than any clause
• Personal data: GDPR Article 28 and transfers outside the EU
• AI coding assistants and IP
• Alternatives and selection criteria
• How Netbase handles IP
• What delivery record exists, and what does not
• Limits of this guide
• Frequently asked questions
• Next step

Three kinds of IP in every outsourced project

Most disputes start because the parties never separated what was made for you from what the vendor already owned. Separate four kinds of material, because each one needs a different clause.

Payment alone does not move ownership. The US Copyright Office explains that a work made by an independent contractor is a "work made for hire" only in listed categories and with a written agreement, and computer programs are not among those categories. Outside that rule, a contractor's copyright passes only by a written transfer, so ask for an explicit assignment whatever country your vendor is in.

Contract clauses to put in writing

• Assignment of custom work. Every right in the code, designs and documentation created for you is assigned to you, on creation or on each payment, not only at the end of the project.
• Background IP licence. A perpetual, sufficient licence to any vendor module embedded in your product, so you can run, change and hand over the product without the vendor.
• Open-source policy. Which licences are allowed, who approves exceptions, and a component list delivered with every release.
• Confidentiality. A mutual NDA with the company, plus written confirmation that every contributor, including subcontractors, is bound by it.
• Subcontractor flow-down. The same assignment and confidentiality terms bind anyone the vendor brings in, and you approve them first.
• Deliverables. Source code, build scripts, infrastructure definitions, credentials handover and documentation, not only a running application.
• Warranty on infringement. The vendor states that it has not knowingly copied third-party code, and agrees what happens if a claim appears.
• Exit. Handover sessions, a documentation standard and a notice period, so ending the contract does not strand the product.

Source code escrow helps when you license a vendor's product and need continuity if the vendor fails. For bespoke work you own, escrow is no substitute for assignment plus the code in your own repository.

Personal data: GDPR Article 28 and transfers outside the EU

When the vendor touches personal data of people in the EU, IP protection meets data protection. Under Article 28 of the GDPR, a controller may only use processors that give sufficient guarantees, and the processing must be governed by a contract that sets out, among other things, that the processor acts only on documented instructions, binds its staff to confidentiality, applies appropriate security, assists with data-subject rights, deletes or returns data at the end, and allows audits. A processor may not engage another processor without the controller's prior written authorisation, and the same obligations flow down to it. In Germany this contract is known as the AVV (Auftragsverarbeitungsvertrag) under the DSGVO. The European Commission has published standard contractual clauses for this controller-processor contract (Implementing Decision (EU) 2021/915).

A vendor outside the EU adds a second layer: Chapter V of the GDPR on international transfers. Vietnam, for example, has no EU adequacy decision on the Commission's list. Transfers there usually rely on the Commission's standard contractual clauses for international transfers (Implementing Decision (EU) 2021/914), and the EDPB's Recommendations 01/2020 describe how an exporter assesses whether extra technical or organisational measures are needed. Two practical rules help: keep production personal data out of development and test environments, and give the vendor anonymised or synthetic data unless the task truly needs real records.

Alternatives and selection criteria

Choose by four criteria: how central the code is to your competitive position, how much personal data the team will touch, how fast you need capacity, and whether you can run the product without the vendor after the contract ends. For the contract type itself, see dedicated team vs fixed price; for a long-running team that keeps knowledge in-house over years, see the AI-first offshore development center guide.

How Netbase handles IP

Most Netbase projects are delivered on fixed-price contracts agreed after discovery, and the IP terms are the same in every model. In Netbase custom development the client owns the IP created for it; Netbase productized modules and Business Division products are licensed, not transferred. That split is what lets a client start from reusable modules, for example through the SaaS product accelerator, while the code that makes the product theirs stays theirs. If you are commissioning a first product, the SaaS MVP architecture and delivery roadmap shows where those modules sit.

Netbase contributors work under NDA, and NDAs and data processing agreements are available to clients on request. Security practice covers secure code review and version control, TLS in transit and AES at rest, role-based access control, MFA for admin dashboards, vulnerability scanning and penetration testing, and disaster recovery. Netbase holds ISO 27001 certification and a SOC 2 Type II attestation and aligns with the GDPR for data privacy in Europe; these cover Netbase's own operations, not your product or its hosting. Details are on security and compliance and engagement models, and dedicated development teams run under the same terms.

What delivery record exists, and what does not

• What exists. Since 2020 Netbase has worked as offshore development and managing partner on a multi-tenant cloud ERP for a US client that is sold as SaaS. The public record withholds the client's name and product, which shows client confidentiality kept in published material.
• What does not. No published Netbase case study states its contract IP clauses, and Netbase does not publish its contract templates. This page makes no claim about dispute history, and the ERP record is not evidence of any particular clause.

Limits of this guide

• It is general information, not legal advice; copyright, employment and data-protection rules differ by country, so take local legal advice before signing.
• The US work-for-hire rule is cited to show why written assignment matters; it binds US law only.
• The EU adequacy list and the standard contractual clauses change over time; check the Commission pages on the day you sign.
• Netbase terms are stated as Netbase publishes them; the certification wording covers Netbase's operations only.

Next step

Share your draft contract or your vendor's terms and we will book a solution review to check the ownership split, the access model and the data terms before you sign. You can also browse more Netbase insights.

Related services and solutions