Delivery, security and ownership on SME software builds
By Nimitt Bhatt · 23 July 2026 · 8 min
Every SME software horror story ends the same way: the client cannot get their own code, their own database, or their own hosting account back. The fix is upstream, a delivery agreement that spells out ownership on day one, not day 400.
Ownership is not a legal formality bolted on at the end. It is the operating floor that lets a business change vendors, hire in-house, or sell the company without a hostage negotiation. Founders discover this the day they need to move, and by then, the leverage sits with the vendor, not the buyer.
What we write down before the build
- →Source-code repository ownership and access
- →Data ownership and export rights
- →Hosting account ownership and billing
- →Third-party account ownership and secrets custody
- →Warranty period and post-launch support terms
- →Handover process if the client chooses to move to another builder
The three failure modes we design out
- →Vendor holds the code, repository sits under the vendor's account and access is revoked when the relationship ends
- →Vendor holds the data, production database lives in an account the client cannot log into, and exports are a professional service
- →Vendor holds the identities, domain, DNS, cloud billing, payment-gateway and email-sender accounts are all under vendor names
The correct posture is the opposite of all three: the client owns the repository, the hosting account, the domain, and the billing relationships from day one. We contribute as a collaborator with time-bound access, not as the account holder.
Security posture for SME builds
- →Least-privilege access, every team member has only the access they need, revoked when they leave
- →Secrets in a managed store, never in code or shared documents
- →Row-level security or equivalent access controls at the database layer, not just the application layer
- →Audit trail for privileged actions, retained long enough to be useful
- →Documented incident response, who is called, in what order, with what authority
"You do not own the product until you own the accounts it runs on."
Handover is the acceptance test
The real test of a delivery agreement is not launch day, it is the day the client decides to move. If handover is a one-week, documented process the client can execute against another builder without our cooperation, the ownership model is honest. If handover requires us to be reasonable, it never was.
The full standing terms live on the Delivery, security & ownership page. See also paid discovery vs free scoping for the earliest place these decisions get made.
Nimitt Bhatt
Founder, SEO Rise. MBA, PGDM in Digital Marketing & Communications, and 20 years across sales and marketing leadership at Reliance Jio, Vodafone and ICICI, now running founder-led SEO advisory across India.
I started SEO Rise in 2024 to work directly with founders and marketing leads, no account managers in between. Every audit, every plan and every reply comes from me.
Book a strategy call
