# Software outsourcing contract checklist: IP, data, payment and exit *Web page: https://kweepa.com/insights/software-outsourcing-contract-checklist · Published 2026-11-01 · Updated 2026-11-01 · 8 min read* > A contract is where good intentions become something you can enforce. What to settle before work starts, in plain words. It is general information, not legal advice: have a lawyer review the final text. **Who it is for:** companies about to sign an outsourcing agreement ## The documents, and what each is for An outsourcing relationship is usually governed by several documents, each with its own job. Know which you are being asked to sign. - **NDA (non-disclosure agreement)**: Keeps what you share confidential. Sign it before you share details. - **MSA (master services agreement)**: The general terms that apply to all the work: ownership, confidentiality, liability, payment terms, law and how the relationship ends. - **SOW (statement of work)**: One piece of work: what is delivered, when, by whom, for what price and how it is accepted. Each project or period has its own. - **DPA (data processing agreement)**: The terms for personal data: what the partner may do with it, how it is protected and what happens to it at the end. - **SLA (service level agreement)**: Targets for support: how soon a problem is answered and how soon it is fixed. > **General information, not legal advice** This is a list of questions to settle, not a contract and not advice. A template is a starting point. Have a lawyer who knows the law that will apply read the final text. ## Who owns the code The most important clause is the shortest to forget. - **Assignment:** the partner assigns to you, in writing, all rights in the code, designs and documents made for you, and confirms that its staff and subcontractors have assigned their rights to it. - **When the rights pass:** on creation, on delivery or on payment, and what happens if you stop paying. - **What the partner keeps:** its own tools, libraries and know-how that it used before and will use again, with a licence for you to use them inside your system. - **Open-source and third-party parts:** a list of what is used and under which licences, so that nothing in the system forces you to publish your own code. - **Delivery:** the source code, the build instructions, the documentation and the credentials, in a repository you control, from the first day and not only on request at the end. - **Infringement:** a promise that what is delivered does not copy somebody else's work, and a statement of who bears the cost if it does. > **Do not rely on a default** The rules on who owns software that one company commissions from another differ between countries and between kinds of work. Settle ownership in the contract, and have a lawyer check that it works under the law that applies. ## Confidentiality, security and data You are letting people into your code and often into your customers' data. - **Confidentiality:** who is covered (staff and subcontractors), what is covered, for how long, and what must be returned or deleted at the end. - **Security:** the controls the partner will keep, such as access, devices, secrets and reviews, and how fast it must tell you about an incident. - **Personal data:** if the partner will see personal data, add a data processing agreement, and ask your adviser how data protection law applies to sending it to the partner's country. The European Commission's own page says that standard contractual clauses can be used as a ground for transfers of personal data from the EU to other countries, and other countries have rules of their own. - **Subcontractors:** whether the partner may use them, and whether you must approve each one. - **Location:** where your data and code are kept, and which staff may reach them from where. ## Scope, acceptance and warranty A vague scope is the usual source of a dispute. - **Scope:** what is delivered, written in a statement of work, with the assumptions and the exclusions beside it. - **Acceptance:** how you test, how long you have, and what happens when something fails the test. - **Warranty:** a period after delivery when defects are fixed at no charge, and what counts as a defect. - **Dependencies:** what you must provide, such as access, decisions and content, by when, and what happens if it is late. ## Payment, changes and delays Money and change are where goodwill is tested. - **Payment:** milestones or monthly fees tied to work that you have seen and accepted, and not only to time that has passed. - **Currency, tax and charges:** which currency, who bears bank charges and exchange rate movements, and who pays any tax that applies. Ask your accountant. - **Changes:** how a change is requested, priced and agreed, with a rate card. - **Delays:** what each side owes the other if it is late. - **Late payment:** the terms, and whether the partner may pause work or hold back delivery if you pay late. ## Liability, law and disputes These clauses decide what you can do when something has gone wrong. - **Liability:** the limits on what each side can claim, and what is outside the limit, such as a breach of confidentiality, an infringement of rights or a loss of personal data. - **Insurance:** whether the partner carries professional indemnity or cyber cover, and what it covers. - **Governing law and place:** which country's law applies and where disputes are settled, in a court or by arbitration. Choose on purpose, with advice, and ask where a judgment or an award could be enforced. - **Language:** the language of the contract and of notices. - **Notices:** the addresses and the people to whom notices go. ## Ending the relationship Write the way out when you are friends. - **Notice and reasons:** how either side ends the agreement, with or without a reason, and with how much notice. - **Help to hand over:** the partner's duty to document, to hand over and to answer questions for a set time. - **Return and deletion:** your data and credentials are returned or deleted, and the partner confirms it in writing. - **What survives:** confidentiality and ownership continue after the end. - **Getting your code quickly:** if the partner fails, you can reach your code and accounts at once, which is why they should be yours from the first day. ## Red flags Any one of these is a reason to ask more questions. - A contract that says nothing about who owns what. - Rights that pass only on a final payment that is never defined. - The partner holds the repository or the accounts. - No right to take the work to another company. - Limits of liability that protect only one side. - An exclusive commitment of years with no way out. - A refusal to discuss any change to the draft. ## Keep reading - [Dedicated development teams](https://kweepa.com/services/dedicated-teams): Engineers who work on your product as part of your team, for as long as you need them. - [How to outsource software development: a step-by-step guide](https://kweepa.com/insights/how-to-outsource-software-development): How to outsource software development step by step: what to hand over, how to brief a partner, how to test one, and how to stay in control of the work. - [How to choose a software outsourcing partner: a due diligence checklist](https://kweepa.com/insights/choose-a-software-outsourcing-partner): A due diligence checklist for choosing a software outsourcing partner: what to ask, what proof to see, how to run a paid pilot and which red flags to act on. - [Talk to us about your project](https://kweepa.com/contact?service=dedicated-teams) ## Questions people ask ### Who owns the code when you outsource software development? It depends on the contract and on the law that applies, and the default rules differ between countries. Do not rely on a default: ask for a written assignment of rights to you, covering code, designs and documents, and a list of anything the partner keeps. ### What is the difference between an MSA and an SOW? An MSA, or master services agreement, holds the general terms that apply to all the work: ownership, confidentiality, liability, law and ending. An SOW, or statement of work, describes one piece of work: what is delivered, when, for what price and how it is accepted. ### Do I need an NDA before I talk to an outsourcing company? Yes, if you will share anything confidential, such as your idea, data or plans. Sign it before you share details, check who it covers and for how long, and remember that it does not replace the confidentiality terms of the main contract. ### What is a data processing agreement? A data processing agreement sets out what a partner may do with the personal data it handles for you, how it must protect it, which subcontractors it may use and what happens to the data at the end. You need one if the partner will see personal data. ### What should an exit clause in a software contract include? How either side can end it and with how much notice, the partner's duty to document and hand over, the return or deletion of your data and credentials, what survives the end, and quick access to your code and accounts. ### Can I use a software outsourcing contract template? A template is a good starting list of questions, but it does not replace advice. Have a lawyer who knows the law that will apply read the final text, and make sure it fits the way you will really work. ### Which country's law should govern an outsourcing contract? There is no single answer. A buyer may prefer its own law and a partner its own, and some choose a third country or arbitration. Take advice on where a judgment or an award could be enforced, and choose on purpose. ## Next step Talk to us: https://kweepa.com/contact?service=dedicated-teams · Email: ops@kweepa.com Publisher: Kweepa Technologies, Nakuru, Kenya (https://kweepa.com/)