Source Code Ownership: Do You Own Your Custom Web App?

Ask a business owner who paid RM 90,000 for a booking system whether they own it, and the answer is usually a confident yes. Ask where the code is kept, and the answer is usually the developer's name.

Those two answers cannot both be right in any way that helps you. Source code ownership only becomes real at the moment you hand the system to somebody else — a new developer, an acquirer, an auditor. That is when you find out whether you can actually produce the thing you paid for.

This page is about custom systems: portals, ordering flows, membership platforms, internal tools. If your question is about a standard marketing website, its domain and its files, our guide on who owns your website, domain and files answers that layer instead. The ZenWeb web development team writes ownership terms into the quotation rather than the final invoice, and this guide explains what those terms need to say.

The video below runs through the contract mistakes that cause most software ownership disputes, and frames the assignment-versus-licence distinction this guide builds on.

1. What Does Source Code Ownership Actually Cover?

Quick Answer: Seven separate things, not one. The application code is only the first. Database, deployment scripts, environment keys, commercial licences and design source files each sit in a different account, and each one is handed over separately or not at all. A custom build you cannot deploy is not a system you own — it is a folder.

A running web application is an assembly, not a file. Take away any one piece and the rest stops being useful, which is why source code ownership has to be checked layer by layer rather than settled with a single sentence in the contract.

The table below is what we find when a client asks us to take over an existing build. The last column is the important one.

Notice how the numbers fall as you move down the list. Clients usually remember to ask about the code and the database. Almost nobody asks about deployment scripts, and that is the layer that decides whether a new developer can put your system back online this week or next month.

Scoping the layers before the build starts is far easier than reconstructing them afterwards, which is why the SME requirements document lists deliverables and not just features. The full list of technical questions to put to a supplier is in twelve technical checks for a development team.

Key takeaway: Ownership is checked layer by layer. Ask about deployment scripts and environment keys specifically — they are the two layers almost nobody negotiates and the two that stop a handover dead.

2. Does Malaysian Law Hand You the Code by Default?

Quick Answer: Often, yes — and this surprises most buyers. Section 26(2) of Malaysia's Copyright Act 1987 deems copyright in a commissioned work transferred to the person who commissioned it, unless the parties agree otherwise. The catch is that last clause. A single line in the developer's standard terms reverses it, which is why the contract wording still decides source code ownership.

Most advice on this subject assumes American or British law, where the developer keeps copyright unless it is signed across. Malaysia works the other way round.

Under the Copyright Act 1987, computer programs are protected as literary works, and section 26(2) deems copyright in a commissioned work transferred to the commissioner — subject to any agreement excluding or limiting that transfer. So the SME who paid for the build often starts from a stronger position than they realise, and then signs it away in a proposal footer.

Intellectual property wording found in Malaysian SME custom development agreements reviewed at takeover, showing the share of agreements carrying each clause type and what the client is able to do if the original developer stops responding.

IP wording in the agreement	Share of agreements	Share	If the developer stops responding
No IP clause at all		34%	Arguable position, no copy of the code
Ownership passes on final payment		27%	Fine, if the project ever reaches final payment
Perpetual licence to use, developer keeps the code		21%	You may run it, not change it or move it
Full assignment on signing		11%	Strong legally, still needs the repository
Assignment plus repository or escrow handover		7%	You hold both the right and the code

Highlighted row shows the only arrangement that survives a supplier disappearing. Bars are proportional to the share column. Source: ZenWeb client sample, 500+ Malaysian SME accounts, 2024–2026, agreements supplied by clients during takeover reviews. Licence.

Two rows deserve a second look. The "ownership on final payment" clause sounds fair and reads well, but a build abandoned at 80% then leaves you with nothing. That is precisely the position described in rescuing a stalled web development project. The perpetual-licence row is worse than it sounds: you may run the system forever and still be unable to hire anyone else to change it.

If you want a dated record of the assignment, MyIPO accepts voluntary notification of copyright and of an assignment, at RM 200 for the notification itself and RM 50 to record an assignment or licence. It is not compulsory and it does not create ownership, but it is a cheap piece of evidence if a dispute ever arrives.

Key takeaway: Malaysian law leans your way on commissioned work, but only until a contract says otherwise. Read the IP clause looking for what it takes away, not for what it grants.

3. Which Parts of Your App Can Nobody Actually Sell You?

Quick Answer: About three-quarters of it. Most of a modern web application is open-source and commercial code written by other people, and no developer can transfer ownership of that to you. What you own outright is the bespoke layer on top. That is normal and not a problem — provided the licence conditions attached to the rest are written down before you build on them.

This is the part of source code ownership that catches buyers off guard. You commissioned a system, you hold the assignment, and roughly a quarter of the codebase is genuinely yours. The rest arrived under somebody else's terms.

Those terms mostly cost nothing and ask nothing. A few of them ask a great deal.

Three practical rules come out of that table:

• Ask for a dependency list at handover. Every library, its version and its licence, in one file. The Open Source Initiative's approved licence list tells you what each one permits in a couple of minutes.
• Buy commercial licences in your own company name. A paid plugin registered to the developer's account stops updating the day the relationship ends, and the running cost of that rented layer is set out in the hidden costs of custom software.
• Flag copyleft components before they go in. They are perfectly usable for an internal system. They need a conversation first if you ever plan to license the software to somebody else.

A WordPress-based build works the same way. The platform itself is licensed rather than owned, which is worth remembering when comparing WordPress, Shopify and a custom build or reading up on what a CMS actually is.

Key takeaway: You own the quarter that was written for you and hold licences on the rest. A dependency list with licences named is the document that proves which is which.

4. Is Code Ownership Improving for Malaysian SMEs?

Quick Answer: Slowly, and the paperwork is improving faster than the access. Written assignment clauses have become far more common since 2021, but the share of clients who could actually open the repository on the day we asked has risen much less. The result is a widening gap between owning the code on paper and being able to move it to another developer.

We record the same two facts at the start of every takeover: what the contract says, and what the client can log into. Tracking both over six years shows something useful about where the market is going.

Year by year from 2021 to 2026, the share of Malaysian SME clients arriving at takeover with a written IP assignment clause, the share who could open the code repository on the day of the first review, the share holding an escrow or independent copy, and the median number of days from takeover to the first successful deployment.

Year	Written assignment clause	Could open the repository	Escrow or independent copy	Days to first deploy
2021	21%	26%	3%	34
2022	27%	29%	4%	31
2023	34%	31%	5%	29
2024	41%	34%	6%	26
2025	48%	36%	8%	24
2026	53%	38%	9%	22

Highlighted row is the current position; 2026 covers January to August. Source: ZenWeb client sample, 500+ Malaysian SME accounts, 2021–2026, first-day audits on takeover of an existing custom system. Licence.

In 2021 the two columns moved together. By 2026 the assignment column has gained 32 points and the access column only 12. More than a third of clients now hold a contract right they cannot exercise without asking the departing developer nicely.

A clause is a claim. A repository login is a fact. The gap between the two is measured in weeks of downtime.

The falling deployment figure is the encouraging part. Better documentation habits mean a takeover that once took five weeks now takes about three, and the practices behind that are described in the discovery-to-UAT development process. Ongoing cover after the handover is priced in web app maintenance and SLA plans.

Key takeaway: Contracts are catching up faster than access is. Test the access once a quarter — a login you have never used is not access, it is an assumption.

5. Is Source-Code Escrow Worth It for a Malaysian SME?

Quick Answer: Rarely, for a bespoke build you already own. Escrow was designed for licensed software where the vendor keeps the code, so it solves a problem you should not have. For most SMEs, holding your own repository from the first commit delivers the same protection for nothing — as our freelancer against software house comparison shows.

Escrow means an independent third party holds a copy of the code and releases it to you if agreed conditions are met, usually the supplier going out of business. It exists to solve one problem: the supplier owns the product and will not assign it, so you need a fallback copy of something that is not yours.

That is why the offer is more useful as a diagnosis than as a service. When a supplier proposes escrow on a system you commissioned, they have quietly told you they intend to keep ownership. The right response is to ask about the assignment clause, not to price the escrow agent.

Three arrangements for guaranteeing access to source code compared on typical annual cost, how current the held copy stays, how quickly the code can be retrieved, and the situation each one suits.

Arrangement	Typical annual cost	How current the copy is	Best suited to
Your own repository account	Free to about RM 100	Live, every commit	Any bespoke build you commissioned
Scheduled copy to your own storage	Under RM 500	As current as the schedule	Builds where the supplier hosts the repository
Third-party source-code escrow	Low four figures upward	Only as current as the last deposit	Licensed products where the vendor keeps ownership

Highlighted row is the option we recommend to most SME clients. Costs are indicative ranges observed in Malaysian SME engagements, not quotations. Source: ZenWeb client sample, 500+ Malaysian SME accounts, 2024–2026. Licence.

The middle row is the practical compromise when a supplier insists on hosting the repository themselves. Pair it with a database export on the same schedule and you have covered both halves, which is the same discipline described in setting up a backup and restore plan. Where the system stores customer records, the retention and access rules in PDPA security for web systems apply to those copies too.

Key takeaway: Escrow belongs to licensed software, not to work you commissioned. If a supplier offers escrow instead of the repository, ask why the repository is not on the table.

6. What Should the Agreement Actually Say?

Quick Answer: Six clauses, all short, all agreed before the deposit is paid. Assignment on creation rather than on final payment, your repository named in the contract, deployment scripts as a deliverable, a dependency and licence list, commercial licences in your name, and a defined exit. None of these cost the supplier money, which is why resistance to them is informative.

How to write source code ownership into a development agreement

Six clauses, in the order they matter.

1. Assign copyright on creation, not on final payment. Code becomes yours as it is written, so an abandoned project still leaves you with what has been built. Confirm the entity signing it exists through SSM's e-Search lookup before signing.
2. Name your repository in the contract. The account is opened in your company's name and the developer is added as a collaborator. One line, and it removes most of what goes wrong later.
3. List deployment scripts and configuration as deliverables. Not "documentation" in general — the specific files needed to put the system on a fresh server.
4. Require a dependency and licence inventory. Every library, version and licence in one file, updated at each milestone.
5. Buy every commercial licence in your own name. Plugins, themes, API subscriptions and certificates, billed to your company card from the first purchase.
6. Define the exit before the start. What is handed over, in what format, within how many days of either side ending the engagement — and make the final payment depend on it.

Clauses one and six do most of the work. A supplier who happily accepts both has told you something useful for free. A supplier who resists them has told you rather more. The same logic applies to every asset a vendor holds on your behalf, so we treat agency account ownership, SEO asset ownership and ad account, page and pixel ownership as one conversation held in different departments.

For the commercial terms around these clauses — deposits, milestones, warranty and lock-ins — see agency contract lock-ins and exit terms. If the supplier is still being chosen, the selection side is covered in how to choose a web development company in Malaysia and developer rates and how to vet one. Where the code never leaves your building, the trade-offs are in in-house developers against outsourcing.

Key takeaway: Six clauses, none of them expensive. Put them in the quotation stage, where they are a normal request, rather than at handover, where they become a negotiation.

7. Own the Code, and Be Able to Prove It Tomorrow

Quick Answer: Test it rather than assume it. Log into the repository, download the code, and ask a second developer whether they could deploy it from what you hold. If that exercise takes an afternoon, your source code ownership is real. If it needs a phone call to your supplier, it is a claim you have not tested yet.

The question is settled in two places that have nothing to do with each other. One is a clause. The other is a login. Buyers who only check the first are the ones who discover the problem during a handover, when their negotiating position is at its weakest.

None of the fixes in this guide are expensive. A repository in your name costs nothing. A dependency list costs an hour. Assignment on creation instead of on final payment costs a supplier nothing at all, which is exactly why a refusal is worth taking seriously.

We open the repository in the client's name on day one, commit the deployment scripts alongside the code, and hand over the dependency list with the final invoice. If you are commissioning something new, start with custom web application development for Malaysian SMEs and the budget ranges in the 2026 custom web application price guide. If an existing system has gone quiet, rescuing a stalled project is the place to begin. More about how we scope and hand over work sits on ZenWeb web development and at ZenWeb.

8. Frequently Asked Questions

1. Do I own the source code if I paid for the development?

Paying is a strong start but not the whole answer. Section 26(2) of Malaysia's Copyright Act 1987 deems copyright in a commissioned work transferred to the person who commissioned it, unless the parties agreed otherwise — and developer terms frequently do agree otherwise. Read the IP clause, and remember that owning the copyright still does not give you a copy of the code.

2. What is the difference between an IP assignment and a perpetual licence?

An assignment makes the code yours: you may change it, move it, sell it or hand it to another developer. A perpetual licence only lets you keep using it. About 21% of the SME agreements we reviewed used licence wording, which usually means the client cannot legally hire anyone else to modify the system they paid for.

3. Can a developer really own a system I paid RM 100,000 to build?

Yes, if the contract says so. Price has no bearing on ownership — a clause reserving IP to the supplier applies at any project value. The protection is procedural rather than financial: assignment on creation, your own repository, and a defined exit, all agreed before the deposit is paid.

4. Do I own the open-source libraries inside my application?

No, and nobody can sell them to you. Around three-quarters of a typical SME web application is open-source or commercial code owned by other parties, used under licence. That is normal. What matters is holding a dependency list naming each library and its licence, so you know which conditions attach to your system.

5. Is source-code escrow necessary for a Malaysian SME?

Usually not for bespoke work. Escrow suits licensed products where the vendor keeps ownership. For a system built to your specification, a repository account in your own company name gives you a live copy at no meaningful cost. Where the supplier insists on hosting the repository, a scheduled export to your own storage covers the same ground.