Custom applications / Lumin Marketing Group

Who Owns the Code When You Pay Someone to Build a Custom App?

In Canada, paying the invoice alone does not transfer copyright in custom software. What the Copyright Act says, and the accounts you need handed over.

By Kristina Wyllie, Forward Development EngineerPublished October 8, 20266 min read

The short answer: Paying for custom software does not, on its own, make you the copyright owner. Under Canada's Copyright Act, the author of a work is the first owner of copyright in it. If your employee wrote it in the course of their employment, your business owns it absent an agreement to the contrary. If a contractor or an agency built it, payment alone does not transfer the copyright to you; you need a signed written assignment from whoever owns it or their authorized agent. Ownership is only half the problem. The other half is whether you hold the accounts the application actually runs in.

What the Copyright Act says

Computer programs are included in the definition of a literary work under section 2 of the Act, so the ownership rules that apply to a photograph or a manual apply to the booking portal somebody built for you.

Employees and contractors sit on opposite sides of the line

Section 13(3) covers work made by an employee under a contract of service, in the course of that employment. There, "the person by whom the author was employed shall, in the absence of any agreement to the contrary," be the first owner.

A contractor is not an employee, and that subsection does not reach them. The author, their employer or a previous assignee may hold the copyright. Check that the developer has the rights they are promising to transfer. This catches people out because the commercial logic feels obvious: you described the tool, you paid for it, you use it every day. None of that, on its own, transfers copyright.

The assignment has to be written down and signed

Section 13(4) lets the owner assign copyright in whole or in part, and with limits on territory, medium or market sector. The same subsection requires the assignment to be in writing and signed by the owner or their authorized agent.

So a verbal promise or payment alone does not transfer copyright. Do not rely on a casual “it’s all yours” email. Put a clear assignment in the statement of work and have the copyright owner or their authorized agent sign it. Worth deciding deliberately: an assignment of the rights the developer holds in the work built for you, or a licence that lets you use and modify the code while the developer keeps the right to reuse their own general-purpose components. Both are legitimate. Make sure the agreement matches what you intend to buy.

Moral rights are separate again

Under section 14.1, moral rights cannot be assigned, though they can be waived in whole or in part, and assigning copyright does not waive them. A separate waiver from the authors can address those rights alongside the assignment clause.

This is general information rather than legal advice. Have a lawyer review the clause, especially if the tool is central to how you deliver work.

Owning the code is not the same as being able to run it

A signed assignment and a zip file of source code will not keep your portal online. Applications live inside accounts, and accounts have owners.

The handover test

Pick the application you would be most hurt by losing and answer these out loud:

Whose name is on the source code repository, and who holds the admin role on it?
Who is the registrant on the domain, and which registrar account is it in?
Whose account does the hosting or cloud project sit in, and whose card pays for it?
Where is the database, who has credentials, and who can restore a backup?
Whose API keys and billing accounts are behind the AI model, email delivery, payments and SMS?
Who receives the security and expiry notices?

If the answer to several of those is a person rather than your organization, your business may depend on that person to keep the application running.

A hypothetical handover, and where it sticks

Take a property manager in Sherwood Park who commissioned a tenant portal from an independent developer two years ago. The relationship ends amicably and they ask for everything to be moved across.

The code repository moves, but GitHub requires administrator access and, for a transfer into an organization, permission to create a repository there. Issues, pull requests and watchers move with it (GitHub Docs).

The domain can be slower. For domains such as .com, ICANN’s Transfer Policy requires access to the authorization code and approval from the Registered Name Holder. Changing the registrant triggers a 60-day lock on transfers between registrars unless the registrar offers an opt-out and the holder uses it before the change. For .ca domains, check CIRA’s rules and your registrar’s process.

Vercel requires you to be an owner of the source team and a member of the destination team. Deployments, the Git link and most environment variables move across, while integrations need reconnecting and Blob storage needs a separate transfer. Log history does not transfer.

None of that is exotic. It can become unbudgeted work at the moment the person who knows the system is leaving.

A checklist for this week

List every custom application your business depends on, including the spreadsheet somebody turned into a tool.
For each one, write down who holds copyright and what rights your business has. If that is not documented, that is your first gap.
Check the registrant on your domains and the owner on your hosting, repository and cloud accounts. Put the business on them, not an individual.
Create an organization account rather than using a personal one, and add the developer as a member.
Collect the dependency list: libraries, paid APIs, model providers, and which licence or contract each one sits under.
Ask for a plain written description of how the application works and how to deploy it, and confirm you can follow it.
Put ownership, licensing, handover and offboarding into the next statement of work before any code is written.

Where Lumin fits

We build custom applications for the work existing tools do not handle well, and connect enquiries, email, calendars and internal tools so your team stops copying information by hand.
Our Grok Bot implementation work includes testing and team handover inside a defined project, so the system does not depend on one person's memory.
The discovery call covers scope and access requirements, which is where account ownership gets settled rather than assumed.

To talk through what you already depend on, book a discovery call.

Frequently asked questions

We paid the invoice. Does that not mean we own it?

Not on its own. The Copyright Act generally makes the author the first owner, subject to exceptions such as work made in the course of employment. An assignment must be in writing and signed by the owner or their authorized agent. Payment proves you bought something, and the written clause defines what. Ask for it in the agreement before work starts, before ownership becomes a dispute.

Can the developer keep reusing parts of our application?

That depends on what you sign. Many developers carry a library of their own components between projects, and a sensible agreement assigns the work built for you while licensing those general components. The problem is silence, not reuse.

What about the open-source libraries inside it?

Your developer cannot assign you copyright that belongs to third parties. Your application includes third-party code under its own licence terms, which is normal. Ask for a list of dependencies and their licences so you know what obligations came with them.

An AI coding tool wrote most of it. Does that change anything?

It can. AI-assisted code may contain copyright-protected human work, but protection for largely AI-generated code remains uncertain in Canada. A contract cannot create copyright where none exists. Have the agreement identify the rights the developer actually holds and is assigning, and keep a list of the tools used and their applicable terms.