Protecting Your IP When You Outsource Software Development to India

Many US contracts lean on a work-made-for-hire clause. That works for employees. For an outside contractor, the US Copyright Office's Circular 30 on works made for hire explains that a commissioned work qualifies only if it falls into one of nine listed categories and both parties sign a written agreement saying it is a work made for hire. Computer software is not on that list, so the clause on its own can leave copyright with the vendor.

The fix is an assignment. Under 17 U.S.C. 204(a), a transfer of copyright ownership is not valid unless it is in writing and signed by the owner of the rights being conveyed. Well-drafted agreements use both: work-made-for-hire language where it applies, and an assignment of everything else as the fallback.

When you hire an Indian company, its developers are usually its employees. Section 17(c) of India's Copyright Act, 1957 makes the employer the first owner of a work made in the course of employment under a contract of service, absent an agreement to the contrary. So the vendor company owns your code first, and it then has to assign it to you.

Section 19 of the same Act sets out how that assignment must be made, and its defaults catch out foreign buyers:

• The assignment must be in writing and signed, and it must identify the work, the rights assigned, the duration and the territorial extent.
• If the period of assignment is not stated, it is deemed to be five years from the date of assignment.
• If the territorial extent is not specified, it is presumed to extend within India.
• If the assignee does not exercise the assigned rights within one year, the assignment is deemed to have lapsed, unless the assignment says otherwise.
• The assignment should also specify the royalty or other consideration payable.

A clause lifted from a US template that simply says "Vendor assigns all rights to Client" can leave you with rights limited to India that expire after five years. The remedy is plain drafting: assign worldwide, for the full term of copyright, state that the rights do not lapse for non-exercise, and name the fees under the agreement as the consideration.

• Present assignment of future work. "Vendor hereby assigns" rather than "will assign", covering code, designs, documentation and test assets as they are created.
• Pre-existing material. Vendors reuse their own libraries and tooling. List them, and take a perpetual, royalty-free license to use them inside your product.
• Open-source policy. Require a list of every third-party package and its license, and your approval before any copyleft license enters code you distribute.
• Staff agreements. The vendor confirms that every developer on your project, including any contractor it brings in, has signed terms that give the company the rights it is assigning to you.
• Sub-contracting. No sub-contractors without your written consent, with the same obligations flowing down if you agree.
• Confidentiality. Covers your business information, data and code, survives termination, and requires return or deletion at the end.
• Delivery of code. Work is committed to your repository continuously, not handed over at the end.
• Disputes. Pick governing law and a dispute forum you can realistically use. Many US companies choose arbitration with a neutral seat; ask counsel which suits your size and risk.

As of mid-2026, India had not enacted a standalone trade secrets statute. The 22nd Law Commission of India proposed a draft Protection of Trade Secrets Bill in its Report No. 289 in March 2024, and the EU IP Helpdesk's overview of that draft describes the current position as patchwork protection through contract law, criminal law and principles of equity. In practice, your NDA and your access controls carry most of the weight. Share pricing logic, ranking rules, customer lists and model prompts only on a need-to-know basis.

Clauses tell you what you can claim after something goes wrong. Controls stop it going wrong in the first place:

• Repositories live in your GitHub, GitLab or Bitbucket organization, with vendor developers added as members.
• Single sign-on and multi-factor authentication for every vendor account, with access granted per repository.
• Secrets in a managed vault, never in code, tickets or chat.
• No production data in development; use masked or synthetic data sets.
• Cloud, domain, app store and payment accounts registered to your company, with vendor staff added as users you can remove.
• Branch protection, so nothing reaches the main branch without review.
• A written offboarding step: when a developer leaves the project, their access goes the same day.
• An automated dependency and license scan in the build pipeline.

If you hold the repository and the accounts, a dispute becomes a commercial disagreement rather than a hostage negotiation.

Closing out an engagement cleanly

Plan the end on day one. At handover, ask for a final tagged release in your repository, written deployment and environment notes, a list of every credential the vendor held so you can rotate it, and written confirmation that copies of your code and data on the vendor's machines have been deleted. Then remove vendor accounts and check the access logs a week later.

Questions to ask a vendor before you sign

• Will you sign an assignment that is worldwide, for the full copyright term and not subject to lapse?
• Which of your own libraries will end up in our product, and on what license?
• Do all your developers sign IP and confidentiality terms with your company?
• Will the code live in our repository from the first commit?
• Who will have access to production, and how is that access logged?
• What happens to our code and data on your side when the project ends?

Hesitation on any of these tells you a lot about how the relationship will go.

We are a software company in Greater Noida, India, with more than 10 years in business and 963+ projects delivered. On every custom software development engagement, source code and accounts are set up in the client's name, we sign an NDA on request, and the written scope and fixed quote follow a short discovery call. You see working software on a staging server every two weeks, so nothing waits on our side for a final handover.

We work with clients over video calls and shared project boards. India runs on UTC+5:30, which puts it 9.5 hours ahead of US Eastern time in October and 10.5 hours ahead from 1 November 2026, so plan a regular early-morning Eastern call. Our published work, built for Indian businesses, is in our case studies, and there is more about the company for your due diligence.

Is an NDA enough to protect my IP?

No. An NDA covers confidentiality, not ownership. You also need a signed copyright assignment, and the code should sit in your own repository so you are not depending on either document alone.

Can the vendor reuse code it wrote for my project?

Only what the contract allows. Generic, pre-existing tools usually stay with the vendor under a license to you. Code written specifically for your product should be assigned to you and kept confidential.

What happens to ownership if I stop paying?

Many agreements tie the assignment to payment. That is reasonable, but make each paid milestone transfer the work delivered up to that point, so a later dispute does not cloud everything already built.

Should the contract be governed by US or Indian law?

Either can work. What matters is that the assignment meets Indian formalities, because the first owner is an Indian company, and that the dispute process is one you can realistically use. Ask counsel to check both points.

If you are planning to outsource a build and want to see how we would handle ownership, access and handover for your project, book a short scoping call. We will walk through the contract terms and controls we use before any work starts.