Software development outsourcing companies send a pitch first, and the contract that follows tells you far more about the work than the pitch did. The contract fixes who owns the code, what counts as done, and how either side leaves. Those questions rarely appear in a sales deck. The guide reads eight clauses in order and gives a question to put to the vendor for each. Two of the clauses are checked against the Indian statutes that a buyer here relies on. The full list comes first.
What should a contract with software development outsourcing companies include?
Include a statement of work, acceptance testing terms, an IP assignment, an NDA, a sprint demo schedule, a defect SLA, and an exit clause. Add a data processing clause when the vendor touches personal data. Each clause answers a question you will otherwise ask later, when something has gone wrong.
Swipe or use the arrow keys to compare all 3 columns.
Clause | What it should say | Question to ask the vendor |
|---|---|---|
Clause: Statement of work | What it should say: Deliverables; assumptions; exclusions | Question to ask the vendor: What is outside scope? |
Clause: Acceptance testing | What it should say: Test method; tester; pass condition | Question to ask the vendor: Who tests and who signs off? |
Clause: IP assignment | What it should say: Signed assignment naming rights; term; territory | Question to ask the vendor: When does ownership transfer? |
Clause: NDA | What it should say: What is confidential and for how long | Question to ask the vendor: Who sees our data on your side? |
Clause: Sprint demo | What it should say: Demo cadence and who attends | Question to ask the vendor: How often do we see working software? |
Clause: Defect SLA | What it should say: Defect severity levels and response times | Question to ask the vendor: What is the fix time for each level? |
Clause: Data processing | What it should say: Purpose; security safeguards; erasure | Question to ask the vendor: Where is personal data stored? |
Clause: Exit clause | What it should say: Notice; handover; data return or erasure | Question to ask the vendor: What do we receive on exit? |
A lawyer should review the final text of any outsourcing agreement. The guide helps you read the draft and prepare questions, and it does not replace legal advice.
Buyers who search for software development outsourcing services often compare price first. Price matters, of course. A low quote with no defect SLA or exit clause only moves the cost to a later date, so read the contract before you read the rate card. Keep it in writing.
Vendors of outsourcing software development services also differ in which clauses they volunteer. Some send a full draft with the proposal, while others send a two-page quote and expect the conversation to follow. The vendor that sends the full draft is easier to compare, and the draft shows how the firm behaves when a clause is awkward. Ask each of the software outsourcing companies on your list for a full draft with the proposal.
The NDA is the clause most buyers expect, and few read. A good one says what counts as confidential, how long the duty lasts, and who on the vendor's side is bound by it, including any subcontractor. Check that it covers your data and your code, and that it survives the end of the engagement, because confidentiality that expires at handover protects nothing.
How do you read a statement of work and acceptance testing terms?
Read the statement of work for what it leaves out. Silence is the risk. Then check the acceptance testing clause for a named tester and a pass condition. A statement of work that lists deliverables without assumptions invites disputes. Acceptance that depends on satisfaction has no test, so the work has no end point.
A usable statement of work has three parts. Deliverables say what you will receive, and assumptions say what the vendor expects from you, such as data and access, plus decisions by certain dates. Exclusions say what the price does not cover. With no exclusions list, every unlisted item becomes an argument.
Acceptance testing needs a method, a tester, and a pass condition. Here is an illustrative criterion: the monthly report opens in under 5 seconds with 12 months of data, and the totals match the ledger. A tester can run both checks on a Tuesday and write pass or fail. That is a test.
Compare it with "the report works well". Nobody can fail that sentence, so nobody can finish the work. Push back on any clause phrased that way, and have the vendor rewrite it as a test.
Our post on shortlisting a custom software development company lists the checks to run before you sign, and it explains why discovery should be priced as its own phase.
Who owns the code under an outsourcing agreement in India?
Section 19 of the Copyright Act 1957 makes an assignment valid only if it is in writing and signed. The assignment must identify the work and specify the rights, the duration, and the territory. A missing term defaults to 5 years and a missing territory to India. An unused assignment can lapse after 1 year unless the clause says otherwise.
The Act, as published on Indian Kanoon, sets the form in sub-section (1), which asks for a signed writing. Sub-section (2) asks the assignment to identify the work and specify the rights, the duration, and the territorial extent. Sub-section (4) adds that an assignment lapses after 1 year if the assignee does not exercise the rights, unless the assignment says otherwise.
The Act deems 5 years from the date of assignment where no period is stated, and it presumes India where no territory is specified. Take a buyer who plans to use the software for 8 years, or in another country. Silence in the clause leaves a gap, and the statute fills it with narrower defaults. Both defaults can surprise a buyer who never read section 19, and a clause of two sentences removes the surprise.
State the term and the territory in the clause itself, and name the rights assigned, such as the right to modify the software and use it commercially. Then settle one more point with the vendor: does ownership transfer on signing, or on final payment? Dates matter too.
The paragraph above is general information and gives no legal advice. A qualified lawyer should review the assignment clause before you sign.
What does the DPDP Act require when a vendor handles personal data?
Section 8(2) of the Digital Personal Data Protection Act 2023 lets a business engage a data processor only under a valid contract. The business stays responsible for the processing under section 8(1). Sub-sections (5) and (7) require reasonable security safeguards and erasure once the purpose ends, unless the law requires retention.
In the text published by MeitY, the DPDP Act 2023 makes the business, called the Data Fiduciary, responsible for processing done on its behalf by a Data Processor. A processor may be engaged for activity related to offering goods or services only under a valid contract. The business must also cause its processor to erase personal data made available for processing, once the purpose is served. Mark that last duty.
The practical reading is short. When an outsourced team touches customer or employee data, the contract should state the purpose of use and the security safeguards that apply. It should also say what is erased at the end and where the data is stored.
Commencement and the rules under the Act are developing matters, so check the current status with your lawyer before you rely on any date. The summary here follows the text of the Act as published, and nothing more.
The paragraph above is general information and gives no legal advice. A qualified lawyer should review the data terms before you sign.
How do sprint demos, defect SLAs and exit clauses protect you?
A sprint demo shows working software at least once per sprint, and the Scrum Guide sets sprints at 1 month or less. A defect SLA gives each severity level a response and a fix time. An exit clause lists the notice period, the handover, and the data return. Together they keep the vendor accountable between signature and delivery.
Take the sprint demo first. Check each one. A demo that runs on slides proves nothing, while one that runs on working software proves progress. Find out who attends and whether you can click through the build yourself. A defect SLA defines severity levels and attaches a response and a fix time to each. The numbers come from the vendor's proposal, and this guide quotes none. What matters is that each level has a written answer, and the written answer should name a person. An agreement that says defects will be fixed "promptly" gives you no standard to enforce.
The exit clause matters most when the relationship has soured. Nobody plans for that day. The clause should list the notice period and the handover items: repository access with documentation, the credentials, and the return or erasure of your data. Request the list now.
A short test works for each of the three. Can you see the software? Is the fix time written down? Do you know what you will receive if the engagement ends next month? Test them before you sign.
Where does Burhani Technologies fit among software development outsourcing companies?
Burhani Technologies works on a fixed-price basis after discovery, as a dedicated team, or on a support retainer. The engagement agreement sets ownership of code and data, plus documentation. We give no legal advice, and we suggest your lawyer review any outsourcing contract, ours included. Our software development services start with discovery and a scope you can read.
→ Send us the draft agreement you hold, and book a free consultation.
FAQs on software development outsourcing companies
What should a software outsourcing contract include?
A statement of work, acceptance testing terms, an IP assignment, an NDA, a sprint demo schedule, a defect SLA, and an exit clause make up the core. A data processing clause joins them when personal data is involved. Start with the IP assignment and the exit clause, because both are hard to fix once work has started.
Who owns the code when you outsource software development?
Ownership needs a signed written assignment. The Copyright Act 1957 requires one in section 19, and it must name the work and the rights, plus the term and the territory. A missing term defaults to 5 years, and a missing territory defaults to India. Have a lawyer read the clause.
What is a statement of work?
The document lists the deliverables, the assumptions, and the exclusions. Deliverables say what you will receive, and the assumptions say what the vendor needs from you. Exclusions state what the price leaves out. Ask software development outsourcing companies to attach one to every quote, and compare the exclusions first.
What is a defect SLA?
A defect SLA is a written promise about how fast a vendor responds to defects and how fast it fixes them. The SLA sorts defects into severity levels, from a system outage to a cosmetic fault, and gives each level a response time and a fix time. Look for numbers in the proposal, because an adjective is not a standard.
Does a vendor need a data processing contract?
When the vendor handles personal data, yes. The Digital Personal Data Protection Act 2023 allows a business to engage a data processor only under a valid contract, in section 8(2). The contract should cover the purpose of processing, security safeguards, and erasure at the end. Confirm the current status of the Act with your lawyer.
What should an exit clause say?
An exit clause states the notice period, the handover items, and what happens to your data. Handover items include repository access with documentation, plus the credentials, and data is returned or erased according to your choice. Agree to the clause before work starts, since nobody negotiates well once the relationship has soured.
What will the contract tell you that the pitch did not?
Read the clauses first, and let the pitch answer the questions the contract raises. Software development outsourcing companies that welcome that order have probably done this before.
→ Share the clauses you want a second reading on and get in touch.
