Question 1

Who owns the code that's built for me?

Accepted Answer

You do — 100%. All code written during the engagement is your intellectual property. This is guaranteed by the service agreement, which includes a full IP assignment clause. You own every file, every commit, and every line written under your subscription, with no retained rights by the development team.

Question 2

How is IP ownership transferred?

Accepted Answer

It's transferred automatically as work is completed. All code is committed to repositories you own and control (your GitHub or GitLab organisation). There is no separate IP transfer process at the end of the engagement — ownership is yours from day one.

Question 3

Do you use any proprietary frameworks I'd be locked into?

Accepted Answer

No. We build exclusively on standard, widely-used open-source technologies — React, Next.js, Node.js, Python, PostgreSQL, and others. There are no proprietary internal frameworks, shared component libraries you don't own, or platform dependencies that require us to keep running. Your software can be handed to any developer in the world and they'll be able to understand and continue it.

Question 4

Is an NDA required or available?

Accepted Answer

Mutual NDAs are available and standard practice for clients who need them. If your project involves sensitive business logic, unreleased product ideas, or confidential data, we'll sign a mutual NDA before any work begins. You don't need to ask — just mention it during onboarding.

Question 5

What secure coding practices do you follow?

Accepted Answer

Our standard practices include: input validation and parameterised queries to prevent SQL injection, output encoding to prevent XSS, environment variables for all secrets and credentials (never hardcoded), HTTPS enforced on all endpoints, dependency audits using npm audit and similar tools, and authentication using established libraries rather than custom implementations. For applications handling sensitive data, we apply OWASP Top 10 as a baseline standard.

Question 6

How are credentials and API keys handled?

Accepted Answer

Credentials are stored in environment variables, never in code. Production secrets are stored in secure secret managers (like Vercel's environment variables, AWS Secrets Manager, or similar) that you control. The development team never has access to production credentials unless it's explicitly required for deployment setup, and access is removed after.

Question 7

What happens to my data if I cancel the subscription?

Accepted Answer

Nothing changes regarding data ownership. Your code repositories remain in your control (they always were). Any data stored in your own databases or infrastructure stays with you. We don't store copies of your codebase or production data. After cancellation, developer access to your repositories can be revoked immediately.

Question 8

Can I get a full code handover if I want to switch to an in-house team?

Accepted Answer

Yes. Because the code lives in your repositories throughout, there's nothing to 'hand over' — it's already yours. We can prepare a technical handover document (architecture overview, environment setup guide, dependencies explained) to help a new developer onboard quickly. This is included as a task in the queue.

Question 9

Do you follow GDPR or other data regulations?

Accepted Answer

We build software with privacy-by-design principles for clients operating under GDPR, CCPA, or similar regulations. This includes proper data minimisation, user consent flows, data deletion capabilities, and avoiding unnecessary storage of personal data. For applications in heavily regulated industries (healthcare with HIPAA, finance with PCI-DSS), compliance requirements are scoped during the discovery call and may require additional specialist work.

Question 10

How is the codebase protected from vulnerabilities over time?

Accepted Answer

Active subscriptions include dependency updates as ongoing work. When security vulnerabilities are found in packages you're using, updating them is treated as a high-priority task. We also conduct periodic reviews of authentication, access control, and data handling as part of maintenance engagements.

Question 11

Can you audit code that another developer wrote?

Accepted Answer

Yes. Code reviews and security audits of existing codebases are available. We'll review your current code against security best practices, identify issues, and deliver a prioritised list of recommendations — which can then be addressed as tasks in the subscription queue.