Source code escrow and code ownership: what to put in a bespoke software contract

You do not automatically own the code you pay for, and source code escrow matters most when you license software rather than own it. On every engagement we run, our clients own 100% of the code and IP, with full source, documentation and infrastructure access handed over at the end of the build.

Why the law does not give you ownership by default

The Copyright, Designs and Patents Act 1988 treats a computer program and its preparatory design material as literary works (s3(1)(b) and (c)). The author who creates the work is the first owner of copyright (s9(1) and s11(1)). Where an employee creates software in the course of employment, the employer is first owner subject to any agreement to the contrary (s11(2)).

UK IPO guidance on ownership of copyright works states that when you commission a work, the first legal owner is the creator, not the commissioner, unless agreed otherwise in writing. A freelancer under a contract for services usually keeps the copyright. Courts may find an implied licence to use the work for its commissioned purpose, which does not transfer ownership.

The case of Clearsprings Management v Businesslinx [2005] EWHC 1487 (Ch) shows the practical effect. A client that commissioned a web-based database system without an ownership clause received only a non-exclusive, perpetual, royalty-free licence, not the copyright. The court implied only the minimum needed and accepted that developers reuse pre-existing code. An assignment of copyright is not effective unless in writing signed by or on behalf of the assignor (CDPA s90(3)). Moral rights to be identified as author and to object to derogatory treatment do not apply to computer programs (s79(2)(a) and s81(2)).

This article is not legal advice; confirm your specific contract with a solicitor.

What we hand over as your supplier

We are the supplier side of the table. Agreeing to full assignment means we give up the chance to reuse your bespoke business logic in other products, or license that build to anyone else. You receive the complete repository, deployment scripts and accounts in your name.

Where projects actually go wrong

The recurring problem we see in rescue and takeover work is loss of access and documentation, not a dispute over legal title. When we built the compliance platform in our Saeker case study, the client’s original developer had left and the in-house legacy system had become almost impossible to maintain, so it was replaced. Nobody was arguing about who owned the old code; the difficulty was that nobody remained who could work on it.

A similar pattern appears in AI-built “vibe-coded” apps. When we audit a vibe-coded app we usually find exposed secrets and API keys in client-side code, databases with row-level security never configured, access control enforced only in the front end, and missing input validation. We have audited such apps several times and brought them into production through our vibe code rescue service, and an early step is always confirming that the repository and hosting accounts sit in the founder’s own name.

What source code escrow actually does

Escode (part of NCC Group) defines source code escrow as source code held by a neutral third party. The arrangement joins three parties: the developer or licensor, the licensee, and the escrow agent. Common release events include supplier insolvency, failure to support or maintain, material breach, and end-of-life without alternative. Deposits should include build instructions and scripts, libraries and dependencies, configuration files and documentation.

The Escrow Company (formerly Escrow London) publishes prices of £1,795 a year for software escrow and £2,995 a year for SaaS access continuity, which deposits production-environment access credentials with quarterly verification, as published on their site in October 2026. The setup fee is not published. This is one provider’s published price, not a market average. Escrow providers offer verification levels from a basic file integrity check to full independent build verification.

The Escrow Company also offers “data holding” agreements where the beneficiary owns the IP of a bespoke application, with code deposited from the developer’s Git repository during development. Pinsent Masons notes that escrow is to a licensee’s benefit for software they are licensed to use.

Our view, not a statement of law, is that if you own the IP and hold the repository and hosting accounts yourself, escrow adds less. It remains valuable where you license software from a third party and need a fallback if they fail.

Licence versus ownership

The table below summarises the two positions and what protects you in each.

Situation	What you hold	What protects you
You license it	A non-exclusive right to use the software	Escrow, support covenants, exit clauses, release events
You own it	Copyright, source code, infrastructure access	Written assignment, repository in your name, documentation handover

If you license, the contract should specify the scope of use and the events that release the source to you. If you own, the contract should confirm assignment and practical handover.

Clauses to put in your bespoke contract

Based on the situations above, we recommend a practical checklist for any bespoke software contract.

• Assignment of copyright in writing, signed by the supplier (CDPA s90(3)).
• A background IP licence so you can run the delivered software without further fees.
• A schedule of open-source components and their licences, plus identification of third-party platforms such as Bullhorn, Salesforce, FreeAgent or Xero that you do not own; we build integrations with those systems, but the client owns the code we write, not the external API or its terms.
• Repository and hosting accounts created in your company name.
• Documentation and handover obligations with clear acceptance criteria.
• A clause covering what happens if the supplier stops trading, including escrow release or direct handover.

If you are acquiring a business or taking over a legacy system, our due diligence services can review whether these clauses exist. For a plain language summary of ownership, see our code ownership FAQ.

Frequently Asked Questions

What about third-party APIs and open-source components?

You cannot own the underlying platforms you integrate with, such as Bullhorn, Salesforce, FreeAgent or Xero. We build integrations with those systems, and you own the code we write, but their APIs and terms remain with the vendor. A clear schedule of open-source licences protects you from unexpected obligations.

Can my developer reuse code they wrote for me?

If the contract assigns copyright to you, the developer cannot reuse that bespoke logic without your permission. The Clearsprings case showed courts accept that developers reuse pre-existing code not assigned. Our standard terms give you 100% ownership of the code and IP we produce, so we cannot later license that exact build to another party. Review background IP clauses carefully.

Do I need escrow for a bespoke SaaS I own?

If you own the bespoke SaaS and hold the repository and hosting accounts, escrow adds less protection because you already control the code and deployment. Pinsent Masons notes escrow benefits licensees of software they do not own. Where you merely subscribe to a third party’s service, a SaaS access continuity product may be worth considering. Our vibe code rescue work often recovers such control.

If you are planning a build and want ownership baked into the contract from day one, speak to our bespoke software developer team or estimate the investment with our cost estimator.