Bry

Posted on Oct 27 Originally published at Medium

What to Vet Before Signing an IT Outsourcing Contract

#webdev #beginners #devops #cloud

Key Points

"Work-for-hire" language doesn't automatically transfer IP ownership everywhere. Under Philippine law, independent-contractor and BPO arrangements require express assignment language — the same clause that works in the US may not hold there.
SLA language matters more than SLA existence. "Best efforts" and "industry standard" create no enforceable obligation — you need numeric targets and a stated remedy for breach.
100% payment upfront is a hard dealbreaker, not a soft concern — it removes the vendor's only incentive to finish.
If your vendor is Philippines-based or otherwise subject to the Data Privacy Act, your contract needs the specific cross-border data clauses the National Privacy Commission formalized in 2024 — confidentiality duty, sub-processor approval, audit rights, and data deletion on termination.
Before signing anything, answer one operational question: can the codebase move to a different team on day 90 without the original vendor's cooperation?

This is general guidance from operational experience, not legal advice — have contract-specific terms reviewed by counsel licensed in the relevant jurisdiction before signing.

Introduction

I've read outsourcing contract checklists that would have protected me in a US court and done nothing in the jurisdiction the vendor actually operated in. The gap isn't malice, it's assumption — most templates circulating online are written by US-based lawyers for US-based engagements, and "work-for-hire" language gets treated as a universal legal fact instead of a US doctrine with specific requirements elsewhere.

The Philippines, one of the largest outsourcing destinations in the world, is a clean example of where this assumption breaks. Under Philippine intellectual property law, ownership of custom work built by an independent contractor or BPO provider doesn't automatically transfer to the client the way it does under US work-for-hire doctrine. You need express assignment language in the contract, specifically, or the vendor may retain rights to what you paid them to build. I've seen the generic template get used anyway, because it's the one everyone has seen before.

This article covers what actually needs to be in the contract before you sign — prioritized, not exhaustive, and with the regional gap most checklists miss.

The Three Non-Negotiables

Diagram: three questions that filter out the contracts most likely to cause real problems, before you even get to the detailed clause-by-clause review.

1. IP ownership — with express assignment, not just "work-for-hire."

Distinguish background IP (frameworks, libraries, tools the vendor brings and reuses across clients) from foreground IP (what's actually built for you). You want unambiguous ownership of the foreground IP, assigned on a per-deliverable basis rather than gated behind full contract payment — gating it behind final payment gives the vendor leverage to withhold your own code over an unrelated invoice dispute. If the vendor operates under a legal system where work-for-hire doesn't auto-assign, the contract needs explicit present-tense assignment language, not implied transfer.

2. SLAs with numbers, not adjectives.

"Best efforts," "reasonable response time," and "industry standard" are not enforceable commitments — they're phrases that sound like commitments. A real SLA states a response time by severity level, a resolution target, and a contractual remedy (credit against future invoices, a rate reduction, or exit rights) for missing it consistently.

3. Exit rights and repository access, defined before you need them.

Ask, before signing: who has admin access to every repository and credential involved, and can the codebase be handed to a different team without the original vendor's involvement? If the honest answer is "we'd have to ask them nicely," you don't have exit rights — you have a hope.

Red Flags Worth Walking Away From

Red flag	Why it matters
100% payment upfront	Removes all incentive to complete the work — the single clearest dealbreaker on this list
No IP assignment clause, or "work-for-hire" with no jurisdiction check	You could pay in full and not legally own the software
Vague scope with no defined deliverables	Sets up expensive disputes over what counts as "done"
No termination rights	Locked into a bad relationship with no exit
Unlimited liability exposure with no cap discussion	One serious bug could expose you disproportionately
Auto-renewal with long notice windows (90+ days)	Easy to miss the window and get locked in another term

The Philippines-Specific Data Clauses

If any part of the engagement touches personal data — user records, customer information, anything the Philippine Data Privacy Act (RA 10173) would classify as personal information — the contract needs more than a generic confidentiality clause. The National Privacy Commission's 2024 guidance on cross-border transfer clauses formalized what a compliant agreement should include:

An explicit duty of confidentiality binding the vendor and its staff
Sub-processor approval — you should know and approve if the vendor subcontracts any part of the work involving your data
Audit rights — the ability to verify security practices, not just take them on faith
A defined obligation to delete or return personal data on termination

None of this is exotic. It's the kind of clause a Philippines-based vendor's own legal team will usually recognize immediately if you ask for it — the gap is that foreign clients using a generic US template often don't know to ask.

Implementation Approach: The Pre-Signature Checklist

Phase 1: Before You Draft Anything

Identify which jurisdiction's law governs the contract, and confirm whether work-for-hire auto-assigns IP there or requires express language.
Decide your position on per-deliverable vs. full-payment IP assignment before negotiating — know what you're asking for.

Phase 2: Drafting

Write SLA terms with numbers: response time by severity, resolution targets, and a named remedy for breach.
Add the specific data-protection clauses required if personal data is in scope.
Include a named-resource clause for any engagement over roughly $150,000 — key personnel changes should require notice and a documented knowledge-transfer period.

Phase 3: Before Signing

Confirm repository and credential access arrangements in writing, not verbally.
Have the final draft reviewed by counsel familiar with the vendor's jurisdiction, not just your own.

Questions to Ask Your Team

"Do we actually own the IP we're paying for, under the law that governs this contract — not just under the law we assume applies?"
"If this vendor disappeared tomorrow, could we hand the codebase to someone else without their cooperation?"
"Does our SLA have numbers and remedies, or adjectives?"
"If personal data is involved, does the contract meet the specific cross-border requirements of the vendor's jurisdiction?"
"Have we actually had this reviewed by counsel, or are we reusing a template because it's the one we've seen before?"

Conclusion

Most outsourcing contract disasters trace back to one of three gaps: IP ownership that was assumed rather than assigned, an SLA with no enforceable teeth, or no real exit plan. Add a fourth if you're outsourcing to the Philippines or a similar jurisdiction: don't assume the US work-for-hire template protects you the way it would at home. Get express IP assignment in writing, get SLA numbers instead of adjectives, and confirm you can leave cleanly before you need to — everything else on the checklist matters less than these.

DEV Community