Who actually owns your code? The answer is usually worse than you think

I watched a healthtech spend 23 days getting admin access to its own repository. On paper the code was theirs. In practice it was not. On the gap between owning something in a contract and owning it for real, and the half-hour test that shows which side you are on.

Por Raquel Reis

Raquel Reis

This past March I sat in on the onboarding of an eleven-person healthtech that had just signed with Revin. My job was to watch and take notes, nothing operational. The first task on the checklist was as mundane as it gets: request admin access to the product's repository. That mundane task took 23 days.

Nobody ever said no, that's the detail worth keeping. The code lived in the previous agency's GitHub organization, mixed in with a dozen other clients' projects. Granting the healthtech admin rights meant admitting, in practice, that the engagement was truly over. So every request became a ticket, every ticket waited on a partner, and the partner was always in a meeting. Twenty-three days of meetings.

The contract, I read it with my own eyes, said all intellectual property belonged to the client. And it did. But ownership without access is a rather theoretical kind of property: the code was theirs the way a towed car is yours. Yours, no question. Behind a gate somebody else opens.

Repository, infrastructure and domain keys: the handover that should happen on day one of the relationship.

The inventory nobody writes

When someone asks "who owns the code", it sounds like a legal question. It is not. It is a logistics question, and it gets answered with a short inventory almost no company has ever written down. Six lines cover it:

• Repository: which organization does it live in, and who owns that organization?
• Infrastructure: whose name is on the AWS or Vercel account, and who receives the invoice?
• Domain: registered to the company, or to the personal account of someone you've never met?
• Secrets: the payment gateway keys and third-party API credentials sit in a vault you control. Or they should.
• Pipeline: does the deploy run in a CI account that survives a vendor change?
• Data: could you export the production database today, without asking permission?

At the healthtech from the opening, five of those six lines pointed at the agency. The domain, we found out in week three, was registered under a former partner who no longer even worked there. None of it had been done out of malice, and nobody had ever gone back to undo it either.

Why the vendor keeps the keys

The less comfortable explanation: exit friction is a retention model. An agency billing by the project renews contracts in one of two ways, by delivering well or by making the switch too expensive. The second way never shows up in a sales proposal, but it shows up in how the accounts are arranged: everything centralized in the vendor's organization, access granted one drop at a time, infrastructure resold at a markup instead of contracted directly. Victhor has described that pattern in 5 signs your dev agency is a bodyshop in disguise, and centralized ownership is a close cousin of all five.

That said, treating every case as strategy would be unfair. A good share of it is ordinary sloppiness: on day one of the project, creating the infrastructure in whatever account was already logged in was the shortest path, and nobody ever went back to fix it. The difference between sloppiness and strategy only shows at exit time. Sloppiness gets solved with an afternoon of transfers; strategy tends to require lawyers, and a lot more patience.

The ownership inventory fits on a single page. Most companies have never written that page.

A half-hour test

If you are a founder and got this far with a small knot in your stomach, the test is simple and you can run it today: try to ship a deploy, export a database backup, and renew your domain without talking to anyone at your vendor. Half an hour, three attempts.

Pass all three and you can file this piece away for the day you switch vendors. Get stuck on any of them and you have just learned something important about the relationship: you do not have a vendor, you have a landlord. With the aggravating detail that the building was paid for with your money.

How we operate, and what it costs us

At Revin, the default from day one is to operate inside the client's accounts: repository in their organization, cloud on their card, no reselling and no hidden markup, secrets in a vault they administer, and the offboarding document written while onboarding is still underway, back when nobody has a reason to fight. The whole process is in the 14-day onboarding playbook. And in the Diagnostic Sprint, the six-line inventory above is one of the first pages of the report, before any conversation about architecture.

This has a cost on our side, and I would rather spell it out: zero exit friction. A Revin client can end the contract today and be running without us tomorrow morning, with everything in-house. The bet is that retention has to come from delivery, and so far the bet keeps paying. I will admit my sample is biased: companies that reach Revin have usually been burned by the previous model, so they arrive valuing exactly this. Maybe those who were never burned think it is paranoia. The case studies are there for anyone who wants to see how this behaves in a real contract.

And one grievance from someone who reads tech contracts every week: the standard advice of "get the IP clause right" is not enough on its own. A clause decides who wins the dispute, not who gets to ship on Friday. Operational ownership comes before the legal paperwork. Good legal paperwork is the kind that never gets used.

Back to the 23 days

The healthtech completed the full transfer in a little over a month, counting the initial 23 days. The curious ending: once the access came through, the relationship with the old agency actually improved, because all that was left was what genuinely belonged to them, the history and the credit for what they built. Unresolved ownership sours even a good relationship.

If you cannot say off the top of your head whose name your domain is registered under, this is your cue: it is worth half an hour this week. And if the test result makes you uncomfortable, book a call with us. Untangling this with company is a lot faster than doing it alone.