What our NDA and contract cover
Aranv sets out who owns the source code we write for you, what our NDA and contract cover, and how we handle access to your systems and data, so you can settle these points in writing before a software or AI project starts.
Who owns the source code. Copyright normally belongs to whoever created the work, which for outsourced software is usually the vendor. Custom software does not clearly fit the short list of commissioned works that can be made for hire (see the US Copyright Office’s Circular 30), and a copyright transfer must be in a signed document. We recommend a contract that assigns custom code, designs and documentation to you as each invoice is paid.
Pre-existing and open-source code. Most products also use libraries that existed before your project, some ours and many open source. The contract lists them and gives you a lasting license to use and change them in your product, and we record each open-source license.
How ownership and access are set up
Agreed in writing before the build
- 01 NDA before details A mutual NDA is signed before you share designs, data or business plans.
- 02 Contract sets ownership The statement of work names what you own and what is licensed to you.
- 03 Repository in your account Code lives in your GitHub or GitLab organization, with our developers added.
- 04 Access removed at the end Accounts and keys our team used are revoked and listed in a handover record.
This is what we usually agree with clients, not legal advice. Your lawyer should review the final terms.
What gets agreed, and where
Four documents and settings answer most questions buyers ask.
Non-disclosure agreement
What counts as confidential, who may see it, how long the duty lasts and how copies are returned or deleted.
Contract and statement of work
Assigns custom code and designs to you and lists the pre-existing and open-source parts used.
Repository and accounts
Source control, hosting and domain accounts opened in your company’s name, so control stays with you.
Access and data rules
Named accounts, multi-factor sign-in, separate test environments and clear limits on copying production data.
Handover pack at the end of a project
When the work ends, control of the system should already sit with you. The handover pack confirms it: every repository, hosting account, domain and outside service, plus a record of what we returned, removed or deleted.
What we do
- Repository and account inventory
- Credentials returned to your admin
- Our access removed and listed
- Data copies returned or deleted
- Open-source license register
- Build and deploy instructions
Your data and AI model providers
AI features raise extra questions: which provider receives your text, whether it may keep or train on it, and how the contract treats prompts and outputs. We record each provider and its data settings, and agree which records stay out of model calls entirely.
What we do
- Providers that process your data, listed
- Training and retention settings noted
- Records kept out of model calls
- Prompts and settings in your repository
- Contract terms covering AI outputs
How we approach a project
NDA for app development. We sign an NDA before you share designs, data or plans. It should limit use of your material to the project, cover everyone on our side who sees it, and say what happens to copies at the end. An NDA protects information, not the idea itself, so the ownership terms in the main contract matter more.
Data security and system access. We ask for named accounts with the lowest permissions the work needs, use multi-factor sign-in, and keep credentials in a password manager rather than email. Development runs on test or masked data where possible. Our AI governance and security work covers model providers, and DevOps services set up cloud access controls.
Questions to ask any vendor. When does ownership pass to us? Is the repository in our account from day one? Who will see our data, and where is it stored? See How We Work for the delivery side and the AI project readiness checklist for AI work.
How we work
- Ownership written into the contract
- Only the access the work needs
- Named accounts instead of shared passwords
Our Process
-
NDA and first call
We sign the NDA, then agree what you can share and who sees it.
-
Contract terms
Ownership, licensed parts, data handling and exit steps go into the statement of work.
-
Access setup
Your admin creates named accounts for our team, each limited to its tasks.
-
Exit and handover
Data is returned or deleted as agreed and closed accounts are listed.
Why Aranv on security and IP
Terms settled before code
Ownership, licensed components and exit steps go into the statement of work before development starts, rather than being negotiated later under deadline pressure.
Your accounts from day one
We work inside repositories and cloud accounts opened in your company’s name, so you can see the work and control access at any time.
Named people, limited access
Each person on our team gets a personal login with only the permissions their tasks need, and you can remove one without affecting the rest.
Open questions put in writing
If a data or ownership point has no clear answer yet, we say so and write the agreed position into the contract instead of leaving it to memory.
Let’s talk about your next step.
Tell us about your workflow, current tools and goals.
Security, NDA and IP FAQs
-
Who owns the source code when we hire a software company?
Whoever the contract names, so the wording matters. Without a written assignment, copyright usually stays with the firm that wrote the code. We recommend terms that assign custom code to you once paid for, with pre-existing components licensed to you for use in the product.
-
Will you sign our NDA?
In most cases, yes. We review your template and may suggest small changes, such as an end date for confidentiality duties. If you have no template, we can propose a mutual NDA for your lawyer to review.
-
How do you protect customer data during development?
Mostly by keeping it out of development. We test with sample or masked data and limit production access to named people and tasks. If a law such as HIPAA applies, its requirements shape hosting, access and vendor agreements, which we settle with your compliance lead before the build.
-
Is our data used to train AI models?
Not unless the contract allows it. For AI features we pick provider plans and settings that keep your inputs out of model training where that option exists, and we document which providers process your data.
-
What happens to our access and data when the project ends?
We follow the exit steps in the contract: credentials handed back, our accounts removed, and copies of your data returned or deleted, each noted in a handover record.
Let’s talk about your next step
Contact Aranv to discuss your workflow, current tools, and goals. Meet with our team or send an inquiry.
Book a meeting with our team
Choose an available date and time for a 30-minute conversation about your project.
Tell us about your project
Share a few details so we can discuss a useful next step.
Prefer email? sales@aranv.com