Who should own your software's source code?

Owning a software project isn't just holding a file with code. It's several pieces, and each one can end up with a different party:

• The repository: the code with its full change history, in an account belonging to your organisation (GitHub, GitLab or similar).
• The infrastructure: the cloud or hosting accounts where the application runs, in your company's name.
• The domain and the system's email.
• The database and its backups.
• Credentials for third-party services: payments, email delivery, maps, messaging.
• Documentation to deploy and run the system without depending on whoever built it.

If any of those pieces sits in the vendor's accounts, you depend on them in practice, even if the contract says the code is yours.

Some parts of any project can't be transferred by any vendor, and that's fine:

• Open-source libraries: they're used under their own licences. They can usually be used in commercial products, but it's worth knowing which ones are in use.
• Third-party services: you pay to use them, you don't own them. What matters is that the account is in your name.
• The vendor's own tools reused across clients: if the project depends on them, the contract should state what licence you get and whether it's permanent.

• That the economic rights to the code written for you are assigned to you.
• Which pre-existing vendor components are used, and under what licence.
• When ownership transfers: with each payment, at the end, or otherwise.
• Who opens the cloud, domain and service accounts, and in whose name.
• What documentation is delivered at the end.
• What happens to the code and accounts if the relationship ends early.

Copyright law in most countries, including Mexico and the United States, protects software. This guide is general: to draft or review a specific contract, talk to a lawyer.

• Everything is hosted in the vendor's accounts and you're “given access”.
• You don't see the repository until the end of the project.
• The application only runs inside a vendor platform.
• Documentation “isn't included” or is quoted separately at the end.
• The contract doesn't mention code ownership.

The repository is created in your account from the first commit, so you see progress from day one. The application is deployed to your accounts and doesn't depend on a platform of ours. If you work with another team tomorrow, they take everything.