How to choose a software house, and who owns the code
What the law says about source code, what to write in the contract and how to compare suppliers before you sign.
Is the code yours if you paid for the development?
Not necessarily: payment alone does not transfer the rights to the code. Italian copyright law requires the transfer of economic rights to be proved in writing (article 110 of Law 633 of 1941), and for software commissioned from an outside supplier it has no express rule. The source code is the text of the program as developers write it: it is the only form in which another developer can understand the software and change it.
The law reserves to whoever holds the rights to a program its reproduction, modification and distribution (article 64-bis). For software written by an employee there is a rule: the economic rights belong to the employer, unless otherwise agreed (article 12-bis). For software written by an outside company or freelancer, there is none.
| Who writes the software | Who holds the economic rights | Where the rule comes from |
|---|---|---|
| Your employee, within their duties | you, unless otherwise agreed | article 12-bis of Law 633 of 1941 |
| A supplier, with a written assignment | you, for what the assignment names | the contract, which article 110 wants in writing |
| A supplier, with a license | the supplier; you have the use the license describes | the contract |
| A supplier, with a contract that says nothing | a judge decides, case by case | no express rule, different rulings |
| A supplier reusing components it already owned | the supplier, unless it assigns them or publishes them under an open license | the contract and the component's license |
So when the contract is silent, a judge decides. The Court of Bologna, on 18 May 2016, gave the rights to the company that had commissioned the software from a freelancer, applying the employee rule by analogy. According to the editors of Brocardi, who report the ruling, this is the prevailing view among trial courts. The Court of Cassation, in ruling 19335 of 2022, decided a case about graphic files, not software, but on a principle that matters here too. For the Court the employee rule does not extend to commissioned works, and the client acquires the rights only to what the contract names as the object of the service. The client was entitled to the final files, not to the working files, and had to pay separately to get them.
On 23 October 2026 we asked the same question, in five forms, to Google, its AI Mode, ChatGPT and Perplexity. The answers split: some say that without a clause you only get a license to use, others that the rights are yours, and Google's AI Mode, on the same question, says both. Without a written clause you cannot know in advance how it ends, and you find out at the worst moment: when you change supplier or the relationship breaks down.
A technical contribution
Laws and rulings are summarized from the sources listed at the bottom, read on the date at the top of the page. Like the other guides, this is a technical contribution, not legal advice; have your lawyer read any contract that matters.
What is the difference between assignment and license?
With an assignment the economic rights to the code pass to you: you can use it, change it, have anyone you like change it and, if you need to, sell it. With a license the rights stay with the supplier, and you can use the software on the written terms: for how long, on how many workstations, with or without the source code.
| Model | What you can do | What you cannot do | When it makes sense |
|---|---|---|---|
| Assignment of the code written for you | use it, change it, hand it to another supplier, sell it | whatever the contract excludes by name | the software runs a process that sets you apart from competitors |
| License with the source code | use it and change it within the license | assign it to others, change the terms without the supplier | supplier components that also serve its other projects |
| License to use the program only | use it as intended | change it or have others change it | a ready-made product, the same for many customers |
Even with a license alone, the law gives you something. Unless otherwise agreed, whoever lawfully acquired a program may do what is needed to use it for its intended purpose, including correcting errors (article 64-ter). A backup copy, the same article says, cannot be forbidden by contract. Correcting an error, though, is not adding a feature, and without the source code even a correction is hard.
English-language guides often talk about “work for hire”, commissioned software that belongs to the client automatically, and WIPO, the World Intellectual Property Organization, also lists it among the possible models. Under Italian law, for an outside supplier, that automatic rule does not exist: you need the assignment.
What must the contract say about the code?
Seven things: the assignment of the rights, when they pass to you, the supplier's components, third-party and open source ones, the handover, personal data and the exit. Each must be written in words that leave no room for interpretation.
| Clause | What it says | Why |
|---|---|---|
| Assignment | the economic rights to the code written for you pass to you, including the right to change it and have others change it | without it, a judge decides |
| Timing | when they pass: at each paid milestone, at final payment or at delivery | if they pass only at final payment, the code belongs to the supplier until the last payment |
| Supplier components | which ones, by name, and under which license: perpetual, free of charge, with the right to modify | the assignment covers the new code, not what the supplier already had |
| Third-party and open source | the list of components, the license of each and any recurring costs | some open licenses have commercial consequences for your product |
| Handover | repository, documentation, instructions to install it, credentials, and from when | a right without the code in hand is of no use to you |
| Personal data | who processes it on your behalf, with which measures, and what happens at the end of the relationship | article 28 of the GDPR |
| Exit | what you receive, and how fast, if you end the relationship | it is the day the contract really gets read |
Timing matters more than it seems: if the assignment comes only with final payment, a dispute over the last invoice also locks the code. With us each paid milestone transfers to you ownership of the part of the project it covers, and the assignment is written in the contract, which you can read before you commit.
Pre-existing components are where contracts are most often silent. WIPO advises writing down what stays with the supplier: tools, libraries and methods it owned before the agreement. The components of ours that we reuse from project to project, such as Volcanic Backend, are public and open source under the MIT license. The license lets anyone use, change and distribute them, on the sole condition of keeping the copyright notice. You need no permission from us to touch them, and another supplier can maintain them; third-party ones we name in the quote.
Escrow is the deposit of the source code with a third party, who hands it to you if the supplier closes down or breaches the contract. It is useful when the supplier keeps essential components for itself; if the code is already yours and sits in a repository of yours, it covers a residual risk, and we provide it on large-scale initiatives.
For the Italian public administration the rule exists and is clear. The Digital Administration Code requires tenders to make the commissioning administration always the holder of all rights to the software developed for it, unless that is excessively costly for documented technical and economic reasons (article 69). It is a good model for a private company too: if the law asks it of those who spend public money, you can ask it as well.
What must you be handed over, and from when?
The code and everything needed to run it without the supplier, from day one and not at the end of the project. The repository is the archive of the code with its whole history: every change, who made it, when. It must sit on an account of yours, not on the supplier's with access granted to you.
| What | Why you need it | From when |
|---|---|---|
| Repository with the full history | another team picks up from there, and sees why each part is built the way it is | from day one, on an account of yours |
| Instructions to build and install | to bring the software back up without whoever wrote it | at every release |
| API documentation, in Swagger/OAS format | to connect other systems to the software | at every release |
| Credentials for servers, databases, domains and services | if they are in the supplier's name, you do not control them | from day one, in your name |
| Infrastructure configuration | to move the software to another cloud or to your own servers | at every release |
| Backup restore procedures | a backup nobody has ever restored proves nothing | before going live |
| List of components with their licenses | to know what is not yours and what it costs | at every release |
A right on paper, without the code in hand, forces you to ask for it, perhaps from a supplier you have fallen out with. We advise you to create the accounts yourself from the start, and give us access: if one day you change supplier, there is nothing to get back. What we hand over at the end of the project, from the infrastructure configuration to training whoever takes our place, is in the frequently asked questions.
Which criteria matter in the choice?
The ones you can check before signing: similar projects, the people, the method, the price, ownership of the code, security and data, the exit and the supplier's solidity. Promises all look alike, evidence does not.
| Criterion | How you check it | Warning sign |
|---|---|---|
| Similar projects | cases described with the problem, the solution and the results; a reference you can call | logos only, and nobody to call |
| People | names and roles of the team before signing, and who actually writes the code | you meet the team after signing, or the work is subcontracted without telling you |
| Method | frequent releases you try yourself, with regular meetings | you see the software only at the end |
| Price | a range with the ceiling written in the contract, and estimated recurring costs | a single figure with no scope, or a price far below the others |
| Code | written assignment, your repository, components named | the code stays with the supplier, with no alternative |
| Security and data | how they handle access, backups and personal data, in writing | no written answer, no data processing agreement |
| Exit | what you receive if you change supplier | the answer is a quote |
| Solidity | how long the company has existed, how much experience its people have, which insurance it holds | declared certifications you cannot verify |
In the AI assistant answers we read for this guide, the criteria carry percentage weights, from 10 to 25%, and the suppliers to compare range from three to five, or four to six. None of them says where those numbers come from. What matters more is asking everyone the same questions, in writing, and comparing the answers line by line: the line a supplier skips is the one to clear up first.
The analysis comes before the quote, and a supplier that gives you a price without asking how you work is guessing. With us the analysis that leads to the quote is free for a project of medium complexity. For a complex project or a tight timeline we run a feasibility study: it takes 1 to 2 weeks, costs up to 2,500 € and, if you sign, is deducted from the project. The study stays yours even if you do not sign.
That applies to us too. Volcanic Minds was founded in Turin in September 2022; the founder has worked in software for over twenty years and the collaborators are seniors with at least ten years in the trade. We keep the age of the company and the experience of its people apart, for the same reason we say we do not hold ISO certifications yet.
Would you rather talk it through?
Book a call with people who work on these topics every day: we will look at your case together.
Does it matter that the software house is nearby?
It matters for the moments when you need to be in the same room, not for everyday work. The kickoff, reviews with management and critical releases go better in person, and when the software goes into a workshop or a warehouse the process is understood faster by watching it. Development, on the other hand, works well remotely, with regular meetings and a version to try at every release.
Being nearby does not replace the other criteria: a supplier around the corner without a written assignment is still a risk, a distant one with contract, repository and releases in order is not.
We are in Turin, at Corso Vinzaglio 24, and we work in person when it matters, remotely by choice for the operational work. When we meet in person and when we work remotely is in the frequently asked questions.
An example: three quotes for a pharmacy's management system
The example is illustrative: the pharmacy and the three quotes are made up, and the figures are left out on purpose, because here we compare the clauses.
A pharmacy with eight people wants a custom management system to book its services, such as blood pressure checks and electrocardiograms, organize shifts and send reminders to customers. The program it uses to sell medicines stays as it is, connected through an API. Three quotes arrive.
| Item | Quote A | Quote B | Quote C |
|---|---|---|---|
| Price | the lowest, a single figure | mid-range, a single figure | a range, with the ceiling in the contract |
| Code | license to use, the code stays with the supplier | assignment at final payment | assignment at each paid milestone |
| Supplier components | not named | named, under a perpetual license | named, open source under the MIT license |
| Repository | none | handed over at the end of the project | on an account of the pharmacy from day one |
| Fee | yearly, per workstation | none | none; hosting and maintenance estimated separately |
| Health data | not mentioned | data processing agreement attached | data processing agreement attached, with deletion or return at the end of the relationship |
| Exit | not provided for | for a fee | written in the contract |
Booking an electrocardiogram brings health data with it, which the GDPR places among the special categories of personal data (article 9). The supplier that handles it on the pharmacy's behalf is a processor. Article 28 requires a contract stating, among other things, that at the end of the service the data is deleted or returned, at the pharmacy's choice: quote A lacks it.
Quote A costs less in the first year and more every year after, and if the supplier closes down the pharmacy is left without the software it works with. B leaves the code with the supplier until the last payment and hands over the repository only at the end. C is the only one in which the pharmacy, at each payment, owns what it has paid for. The three are compared over three years, not the first one: development, fees, hosting and maintenance, item by item. What an essential management system costs, and how to read two quotes, is in the guide on costs.
Sources and further reading
- Italian Law no. 633 of 22 April 1941 on copyright, article 12-bis, software created by an employeenormattiva.it, in Italian, accessed 23 October 2026
- Italian Law no. 633 of 22 April 1941 on copyright, article 64-bis, exclusive rights in computer programsnormattiva.it, in Italian, accessed 23 October 2026
- Italian Law no. 633 of 22 April 1941 on copyright, article 64-ter, acts allowed to the lawful acquirernormattiva.it, in Italian, accessed 23 October 2026
- Italian Law no. 633 of 22 April 1941 on copyright, article 110, written proof of the transfer of rightsnormattiva.it, in Italian, accessed 23 October 2026
- Italian Legislative Decree no. 82 of 7 March 2005, Digital Administration Code, article 69normattiva.it, in Italian, accessed 23 October 2026
- Annalisa Spedicato, “Lavori di grafica su commissione, di chi è il file sorgente? Ecco cosa stabilisce la Cassazione” (Commissioned graphic work, who owns the source file? What the Court of Cassation rules), Agenda Digitale, 17 October 2022agendadigitale.eu, in Italian, accessed 23 October 2026
- Brocardi.it, “Di chi è il codice sorgente di un software?” (Who owns the source code of software?), 26 April 2018brocardi.it, in Italian, accessed 23 October 2026
- Regulation (EU) 2016/679 on data protection (GDPR), articles 9 and 28eur-lex.europa.eu, accessed 23 October 2026
- WIPO, “How to Secure IP Ownership with a Software Development Agreement”wipo.int, accessed 23 October 2026
- Open Source Initiative, “The MIT License”opensource.org, accessed 23 October 2026
- European Commission, “Data Act explained”, chapter VI on switching between data processing servicesdigital-strategy.ec.europa.eu, accessed 23 October 2026
If the contract says nothing about the code, who owns it?
You cannot know in advance. For software written by an outside supplier Italian law has no express rule. Some courts have given the rights to the client by applying the employee rule, while the Court of Cassation, in 2022 and in a case about graphic files, limited them to what the contract named. If the contract is already signed, ask for a written assignment now.
Can a software house reuse for other clients the code written for me?
If it assigned the code to you, no, unless the contract allows it. The libraries and modules it had before your project stay its own, and the contract must name them and give you a perpetual license with the right to modify them. The components we reuse are public, under the MIT license.
What is source code escrow?
It is the deposit of the code with a third party, who hands it to the client if the supplier closes down or breaches the contract. It is useful when the supplier keeps essential components; if the code is already yours and sits in a repository of yours, it covers a residual risk.
How many quotes should you ask for?
As many as you can compare on the same questions, in writing. AI assistant answers say three to five, without a source; more than the number, what counts is that every supplier answers the same lines, from the price with its ceiling to the assignment of the code.
Who is accountable for personal data in software built by a supplier?
You, as the controller; the supplier that processes it on your behalf is the processor. Article 28 of the GDPR requires a written contract stating which data it processes, for how long, for what purpose and with which measures. It must also state that at the end of the service the data is deleted or returned, at your choice.
What happens if the software house closes down?
If the code is yours and the repository sits on an account of yours, another team picks up from there, with the documentation and the credentials. If you only have a license, it depends on the contract, and that is the case escrow exists for. With a cloud product the code stays with the vendor, and the European Data Act requires it to let you export your data and to remove the obstacles to switching to another provider.
Do you pay for the analysis before the quote?
With us, no, for a project of medium complexity. For a complex project or a tight timeline we run a feasibility study, which takes 1 to 2 weeks, costs up to 2,500 € and is deducted from the project if you sign. The study stays yours even if you do not sign.
Want to read our contract before you choose?
Tell us about the project in an introductory call: right after it we show you the sample contract, with the assignment of the code in writing.
- You won't talk to a salesperson
- NDA before we get into the details
- The code stays yours
Articles on the same topics.
Green software: ethics with profit
Every watt your servers waste is budget burned. Where the waste hides in your cloud bill, and how scale-to-zero and caching turn it into margin.
Read
This website for people and agents
Static pages with Astro, content in Git, publication on Cloudflare Pages: the choices behind the site we have published since October 2026, and the checks that hold them up.
Read
Web Bot Auth: visitors with no eyes
AI agents read your site and convert better than organic, yet they never show up in analytics. How to measure them and verify them with Web Bot Auth.
Read