You Paid For It, You May Not Own It: A 12-Clause Scorecard for Source Code and IP in Outsourcing Contracts

The scenario: two and a half years in, and the code will not move

A 30-person industrial parts trading company spent NT$1.8M in 2023 on a custom quoting and order system. It ran well. In 2026 they wanted an ERP integration module. The original vendor quoted NT$950,000 with a five-month wait. The purchasing manager asked for the source code so she could get a second quote. The reply: "The contract grants you a licence to use the system. The source code is our company asset." They pulled out the original four-page agreement. Not one line mentioned copyright ownership. They ended up spending NT$2.2M and six months rebuilding from scratch.

This was not vendor malice. When the contract is silent, the law decides for you — and the default does not favour the party paying the bill.

Five myths about "I paid, therefore I own it"

• Myth 1: paying for work automatically transfers copyright. Under Article 12 of Taiwan's Copyright Act, where a work is commissioned, the commissioned party is the author unless the contract says otherwise; and if the contract does not allocate economic rights, those rights stay with the commissioned party — the vendor. The paying party only gets the right to use the work within the scope of the commission. Modification, sublicensing and handing it to a different vendor are not included by default.
• Myth 2: getting the source code means owning it. Possession of a copy is not the right to modify, sublicense or assign. Those are three separate clauses.
• Myth 3: "ownership vests in the client" is enough. "Ownership" is not precise language under copyright law and leaves wide room for interpretation. The correct construction is an assignment of economic rights, plus a separate waiver clause for moral rights, which cannot legally be assigned in Taiwan.
• Myth 4: third-party packages come with the deal. No vendor can assign you components covered by OSI-approved open source licences. Worse, an AGPL-3.0 component inside a service you offer publicly can trigger a source disclosure obligation.
• Myth 5: delivery equals handover. Rights and control are different things. The repo sits in the vendor's GitHub, the domain in the vendor's registrar account, the API keys in the vendor's password manager. You own it and still cannot reach it.

The framework: a three-layer rights map and a one-question decision tree

Negotiations stall because both sides argue about "the code" as one undivided thing. Split it into three layers and the conversation takes ten minutes:

• L1 — client-specific layer. Your business logic, data model, screens, reporting rules, pricing algorithms. This layer must be a 100% assignment of economic rights to the client. Not negotiable.
• L2 — vendor-general layer. The vendor's internal framework, shared component library, deployment scaffolding, CI templates. A perpetual, worldwide, irrevocable, transferable, sublicensable non-exclusive licence is enough. No assignment needed.
• L3 — third-party layer. Open source packages, SaaS APIs, fonts, stock assets. Nobody can assign these. They can only be disclosed: the vendor supplies an SBOM and a licence inventory.

The one question: if you removed this code from the project, could the vendor still use it to serve other clients?

• Yes → it is L2. Handle with a licence.
• No, and removing it only breaks your system → it is L1. Handle with an assignment.
• The vendor did not write it at all → it is L3. Handle with disclosure and inventory.

Three company profiles, three different conclusions

Note the pattern: the smaller the company, the more often it is talked into "let us keep the contract simple." Small companies are precisely the ones that cannot afford a rebuild.

The hidden cost of leaving it unwritten

• Rebuild cost: replacing a mid-size system after two years of use runs NT$1.5M–3M and five to eight months.
• Loss of negotiating leverage: with no second quote possible, renewal and change-request rates run 20–35% higher on average.
• Audit blockage: ISO 27001 or medical device quality systems require source traceability. A retroactive assignment costs NT$30,000–80,000 in legal fees, takes two to six weeks, and the vendor can simply refuse.
• M&A discount: when due diligence finds core system IP outside the target company, it shows up directly in valuation or in a holdback.
• Account recovery: domains, SSL certificates and cloud accounts registered under the vendor take two to eight weeks to negotiate across.
• Invisible client-side hours: your internal owner spends 40–80 hours handling all of the above. Nobody books that to the project.
• Open source remediation: replacing a misused copyleft component costs 80–200 engineering hours.

Add it up and the NT$20,000–50,000 legal review you skipped is usually the highest-return line item in the whole project.

A 12-dimension clause scorecard

Score each item 0, 1 or 2 (0 = absent, 1 = present but vague, 2 = explicit and enforceable). Maximum 24. Do not sign below 16.

How ScriptWalker handles it, and what we do badly

Our default project contract: L1 economic rights assign automatically to the client on payment of each milestone, at no extra charge; L2 is granted as a perpetual non-exclusive licence; L3 ships with an SBOM. The repo is created inside the client's own GitHub organization from day one and we are collaborators. GitHub's repository transfer does preserve commit history, webhooks and deploy keys — but starting in your organization removes the transfer process and the negotiation around it entirely.

Honestly, here is what we are not good at:

• We do not assign our internal framework (L2). If your procurement policy demands 100% assignment of everything including pre-existing vendor components, we cannot meet it. Find a team willing to write from zero; expect 30–50% higher cost.
• We do not offer notarised third-party escrow. We do quarterly tagged encrypted snapshots sent to a client-designated mailbox. Formal escrow needs a separate provider, roughly NT$30,000–60,000 per year.
• We cap infringement indemnity at total contract value. We will not accept uncapped liability.
• We do not do patent strategy. Copyright only. Patents belong with a law firm.

Clients we are a poor fit for:

• Contracts under NT$300,000 that also demand full escrow and audit rights — the governance costs more than the build.
• Buyers who want L2 assigned but will not fund the rewrite.
• Companies with an existing system whose vendor licensing paperwork cannot be produced, asking us to "just take it over and sort it out later."
• Procurement that optimises for the lowest price and the broadest clauses, pushing all risk onto the vendor.

A 90-day ownership readiness playbook

• Days 1–30, inventory. List every live system, where each repo actually lives, who holds the domains and SSL certificates, which entity owns the cloud accounts. Scan existing contracts for ownership language. Produce a first-pass SBOM. None of this needs vendor cooperation.
• Days 31–60, amend and migrate. Send a rights-clarification letter to the incumbent vendor and execute an assignment addendum. Transfer repos, domains and cloud projects into the company entity. Stand up a company password vault and retire personal-account custody.
• Days 61–90, institutionalise. Write the 12 clauses into your standard procurement template. Write the source-delivery definition into the acceptance checklist. Automate quarterly snapshots. On day 90 run a tabletop drill: if you switched vendors today, could a new team stand the environment up within two weeks? Wherever it fails is your real gap.

A 12-question checklist before you sign

• ☐ Does the contract say "assignment of economic rights" rather than "ownership"?
• ☐ Are moral rights addressed with a non-exercise clause?
• ☐ Are L1 and L2 clearly separated instead of lumped as "deliverables"?
• ☐ Is the L2 licence perpetual, transferable and sublicensable?
• ☐ Is assignment tied to payment rather than to final project closure?
• ☐ Does source delivery include everything needed to build and deploy?
• ☐ Is the GitHub repo inside your organization?
• ☐ Are domains, SSL and cloud accounts registered to the company?
• ☐ Is there an SBOM and third-party licence inventory?
• ☐ Is there an open source compliance warranty excluding copyleft?
• ☐ Is the indemnity cap at least the contract value?
• ☐ Is there a 30-day return-and-delete obligation on termination?

Fewer than nine ticks, send the contract back for revision. It is far cheaper than a rebuild.

Frequently asked questions

I already signed an old contract with no ownership clause. Is it recoverable?

You can sign an addendum, but your leverage is worse. The practical move is to bundle the assignment addendum into your next change request or renewal as a condition of the deal — success rates are far higher than asking for it standalone. If the vendor refuses outright, push for the compromise: escrowed source snapshots plus an automatic licence triggered by vendor insolvency.

If I demand full IP assignment, will the quote be inflated?

L1 assignment should not cost extra — that code was written for you. If a vendor adds more than 10% for L1 assignment, it usually means they planned to resell your code. Conversely, demanding assignment of the L2 general layer justifies a 30–50% premium, because you are asking them to rewrite their own asset.

The vendor says the source code is useless to us because we cannot maintain it. Fair point?

Partly, but that is a capability question, not a rights question. You are not buying the ability to maintain it yourself; you are buying the option to have someone else maintain it. Long-running research, summarised in the Standish Group CHAOS reports, consistently shows failure and overrun rates rising sharply with project size — and "only one vendor can save us" is exactly what turns a mid-size project into a large rewrite.

Is this overkill for a simple one-page website?

Yes. For contracts under NT$200,000 with an expected life under two years, items 1, 5 and 6 of the scorecard are enough: a clear assignment, a clear definition of source delivery, and accounts registered to you. The governance cost of the rest exceeds its protective value.

Send us your contract. Thirty minutes, free

You do not need to be a client. Send us your existing outsourcing contract, or a draft you have not signed yet, and we will score it against the 12-dimension card above, flag the three highest-risk gaps, and hand back sample clause language you can paste straight in. Take it to any vendor you like. You are not obliged to work with us.

• Email: [email protected]
• Phone: 0916-224-047
• LINE: @ufv9089p