Outsourcing Intellectual Property: How to Fully Protect it
If you’re outsourcing a full software development project (or parts of it) to an outside vendor, you might have to analyse and understand certain security risks that could make your product, code and sensitive information immune to theft or misuse. This could include not just the source code, the very product idea but also vital customer information prone to vulnerabilities. If your outsourced vendor is not reliable or reputed, they may leak your code and other data to the competition or even build a product like yours and take credit as well as profits off your hands. Let’s explore how to solve this potential threat.
What is intellectual property in software development and why should it be protected?
Four types of intellectual property rights are included in software development: patents, copyrights, trade secrets and trademarks. Different kinds of legal protection are used to shield these. The technology itself is protected via patents, copyright and trade secrets. Trademarks protect the names or symbols so that your product stands out in the market among the competition.
IPR should be guarded so that anything you create, as well as your innovations don’t get misused by others and so that no one claims false ownership over your products, generating profits from your hard work. The code developed by you/your outsourcing vendor should not be copied or reused (without your permission). Also, your code/concept should not be tweaked or reworked and used by others for developing a similar product. That would count as stealing of sorts.
A patent is an exclusive monopoly on the right to make, use and sell a product, while the law should protect the source and object code. A trade secret is anything that is not generally known or discoverable by anyone other than the business owners.
If you’re outsourcing any parts of the software development cycle to an outside vendor, you must shield your IPR. Let’s have an overview.
- Legal contract and other agreements
Get your lawyers and the attorneys of the outsourcing vendor to form a contract that should include all important clauses for the Client’s and the Developer’s rights and duties so that there are clear boundaries defined concerning in which instances Developer is to protect the IP, who will have access to it and under what circumstances.
A Non-Compete Agreement bars the outsourcing company from revealing your concept/innovation to competitors.
You could also consider ownership of the code written by the outsourcing vendor by including a clause that everything created under the contract is “work made for hire.”
Get a solid Service Level Agreement which will determine the metrics by which that service is measured, and the remedies or penalties, if the terms are not met by either party. Additionally, they should use SSL Certificates.
However, make sure that the contract should be skillfully crafted and should be fair and useful to both sides so that the outsourced developers are amenable to your strict and specific terms and demands. In other words, it should not be enforced in a way that generates dissidence.
- NDA
A Non Disclosure Agreement ensures that your app idea does not get shared with anybody and it’s signed by the developers working on your product. This is needed so that your ideas don’t get stolen or leaked by mistake. NDA must be signed before entering into any software outsourcing agreement to avoid theft of intellectual property.
Other additional measures you can take are:
- Restricted mission-critical information that doesn’t have to be shared with the outsourcing vendors.
- Secure phone lines and private messenger platforms among the top brass and outsourcing team when important discussions are held.
- Make sure you and the outsourcing vendor has necessary anti-hacking measures like firewalls and reliable VPN services.
- Vet your vendor
It stands to reason that before you select the outsourcing company, you must do thorough credentials check so that you can find out their work repertoire and any breaches or NDA violations they may have made in the past. You can reference check with their current and past clients to assess their work ethic. At the same time, you can ask them to share their security management policy and protocols document before you get into any negotiation.
Other than that, you can physically inspect the premises where the vendor is located to ensure it’s all kosher and even interviews their project leaders to get a sense of their professionalism. If you’re outsourcing to another country, study their IPR protection laws and statutes as well.
- Distribute outsourcing
You don’t have to mandatorily outsource every aspect/process of software development to a vendor. You can retain the core development in-house and outsource other low-level design/development/troubleshooting jobs to an outside vendor.
You could consider outsourcing different parts of the project to multiple different vendors such as QA/Testing to one vendor, support code development to one vendor and customer service to another. This way you don’t hand over all the knowledge to one vendor and the multiple vendors handling the subprojects are only privy to need to know information.
This could increase the financial expenses and you will have to go through several rounds of contracts and agreements, but it’s worth the effort as it protects your work from theft or misuse.
- Permissions and access
You don’t have to grant permission to access your IP and can deny access if you aren’t completely sure about whether the vendor needs it for the non-critical aspects outsourced. Keeping vital data and source code on your private server is the way to go if you need to be doubly sure. Server, API, and data access should be granted to the external developers only if the assigned task requires such access.
In case of a conflict or dispute arises, the contract should specify the governing body (about specific countries of client and outsourcing vendor) that should settle it honestly and equitably.
