What ownership of source code, data and infrastructure means

"You own everything" sounds clear until the relationship ends.

Then the questions arrive. Is the repository in your account? Can you deploy without the agency? Does "your data" mean a complete database export or a CSV missing file relationships? Who controls the domain, DNS, analytics and backups? Did copyright actually transfer in writing?

Ownership is not one clause. It is a set of rights, accounts, credentials and practical capabilities.

Paying for software does not settle copyright by itself

Canada's copyright guidance says the author or creator is generally the first owner in the ownership chain. A commissioned project therefore needs a written agreement that says what is assigned, what is licensed and what pre-existing tools remain with the supplier. Innovation, Science and Economic Development Canada: About Copyright

Software is also made from layers. Your contract should distinguish:

• Foreground work: code, designs, schemas, content and documentation created specifically for the project.
• Background IP: the vendor's pre-existing libraries, internal tools and know-how.
• Open-source components: software used under licences such as MIT, Apache or GPL.
• Third-party services: hosting, maps, payment processors, model APIs, email and other subscriptions.

Owning custom code does not mean owning React, WordPress, Stripe or an open-source package. It should mean you receive the rights needed to use, modify, host and transfer the delivered system without the original vendor's permission.

This is general commercial guidance, not legal advice. Have a Canadian lawyer review material software agreements.

Source-code ownership

Practical source-code ownership includes:

• the complete repository and history;
• administrator rights in the version-control organization;
• build and deployment instructions;
• dependency and licence information;
• environment-variable names and setup documentation;
• database migrations and infrastructure configuration;
• tests needed to verify the system;
• rights to modify and appoint another developer;
• a clear assignment or sufficiently broad perpetual licence in the contract.

A ZIP file delivered at the end is better than nothing, but it is not the same as an active repository in the client's account from the beginning.

Data ownership

Data control has at least four parts:

1. Access: authorized people can see the information they need.
2. Portability: records can be exported in documented, usable formats.
3. Integrity: relationships, identifiers, timestamps and history survive the export.
4. Deletion and retention: the business can apply its legal and operational rules.

A CSV of contacts may not be a complete export if the system also contains deals, activities, permissions, consent records, attachments and audit history. Ask for a data dictionary and a sample export before signing, especially when the platform will become operationally important.

Privacy responsibility does not disappear when a processor holds the database. British Columbia's PIPA says an organization remains responsible for personal information under its control, including information not in its custody, and requires reasonable security arrangements against unauthorized access, use, disclosure, modification or disposal. BC Personal Information Protection Act, sections 4 and 34

Infrastructure ownership

The safest default is for the business to be the primary owner of production accounts and to grant the vendor the access it needs.

That includes:

• domain registrar;
• DNS provider;
• cloud or hosting account;
• database and storage;
• email-delivery service;
• analytics, tag manager and search accounts;
• payment processor;
• source-control organization;
• monitoring and backup services;
• app-store or third-party developer accounts.

The vendor should not be the only person who can renew the domain, change DNS or retrieve a backup. Shared admin credentials are not a solution. Use named accounts, multifactor authentication and roles.

Owning content is not the same as owning a portable site

Hosted builders illustrate the distinction. Wix says users own their content, while its functioning sites must run on Wix infrastructure because the platform uses proprietary SaaS technology. Wix Terms of Use and Wix hosting/export guidance

WordPress core, by contrast, is GPL-licensed and includes a content export, but a particular WordPress site's portability still depends on access to its theme, plugins, media, database, hosting and licences. WordPress licence and export documentation

Neither model is automatically wrong. The contract and architecture should match how costly it would be for the business to leave.

The exit test

A useful ownership clause should pass one practical question:

If the vendor disappeared on Friday, could a competent replacement restore, operate and change the system on Monday without negotiating for missing assets?

For a small marketing site, recovery may take longer than a weekend. The point is not instant perfection. The point is whether the business has the legal rights and technical materials needed to recover at all.

Contract questions worth answering in writing

• Who owns newly created code, designs, content and database structures?
• When does assignment occur: at creation, payment or final acceptance?
• Which background components are licensed rather than assigned?
• Are the granted rights perpetual, worldwide, transferable and modifiable?
• Are open-source and third-party licences documented?
• Which party owns every production account?
• What exports are available, in what format and at what cost?
• How often are backups made, and has restoration been tested?
• Who controls encryption keys and secrets?
• What happens to client data in vendor systems after termination?
• What transition support is included and what is billable?
• Can the client appoint another supplier without a consent fee?

A clean handoff package

At launch, the business should receive:

• repository and administrator access;
• architecture and deployment notes;
• an inventory of services and recurring costs;
• data model and export instructions;
• domain, DNS, analytics and search access;
• backup and restoration procedure;
• account and role register;
• third-party licence list;
• operating runbook and known issues;
• written confirmation of the agreed IP transfer.

NIST's security guidance supports least privilege and logging of privileged activity. In a small-business context, that means each vendor and employee gets only the access required, important administrative actions are attributable, and access can be removed without changing one shared password used by the entire team. NIST SP 800-171 Rev. 3

What we mean when we say client-owned

At Most AI Labs, client ownership means source code, production infrastructure, data and administrative accounts sit under client control, with third-party services billed transparently. That is a statement about our delivery model, not a claim that every client owns the open-source frameworks or vendor platforms used underneath. The current commercial wording lives on the pricing page and service pages; those should remain the source of truth if terms change.

Real ownership is boring on purpose. It is visible in account settings, repository permissions, exports, documents and a contract. If it exists only in a sales sentence, it has not been designed yet.

Source check

Copyright, platform and privacy statements were verified against Canadian government guidance, BC legislation and vendor documentation on August 22, 2026. Legal outcomes depend on the actual agreement and circumstances; this article is not a substitute for legal advice.

Sources

• ISED Canada: About Copyright
• Justice Laws: Copyright Act
• BC Laws: Personal Information Protection Act
• Wix: Terms of Use
• Wix: exporting or hosting a site elsewhere
• WordPress: GPL licence
• WordPress: content export
• NIST SP 800-171 Rev. 3: least privilege and audit records