Code ownership: what "you get the repository" means
Suppliers say you own the code. What that must mean: which repository, whose account, what history, and what a successor needs to run it.
The short answer
Nearly every supplier says you own the code. What that has to mean, in practice, is specific: the repository is in an account your company controls, with its complete history; your partner is a collaborator you can remove; and a competent stranger can clone it, build the site and deploy it to a new account from the documentation alone. Anything short of that is a promise rather than ownership. The three common substitutes, a zip file at hand-over, a repository in the agency’s account, and a repository without the build tooling and documentation, all fall short in ways that only show up on the day you need them.
What complete ownership contains
| Element | What it is | Without it |
|---|---|---|
| Repository in your account | An organisation account in your company’s name, two administrators, two-factor | You request access to your own code |
| Full history | Every change since the start, with authors and reasons | A snapshot with no context |
| Lock file and pinned dependencies | The exact packages the site is built from | The build may not reproduce |
| Build configuration | Everything needed to turn the repository into the site | A successor reverse-engineers the build |
| Configuration and secrets layout | Which environment variables exist and where they live (never the values) | The site builds but nothing works |
| Deploy description | Which platform, which settings, how previews and production work | Weeks to recreate hosting |
| Setup document | One page: what runs where, how to change and deploy, who to call | Archaeology |
| Licences | What third-party code and assets are used under what terms | Legal surprises |
The stranger test
- Clone the repository into a fresh environment with nothing pre-installed beyond the documented tools.
- Install and build following only the setup document. Note every step that needed a question.
- Run the site locally and confirm it matches production.
- Deploy to a new account on the documented platform, with test configuration values.
- Count the questions. Zero is ownership. A few is fixable documentation. Many is dependence dressed as ownership.
Getting there from where you are
If the repository is in the supplier’s account, ask for a transfer to yours; history comes with it. If you have only a zip file, put it in a repository in your account today, then ask for the build configuration and documentation to complete it. If the stack is proprietary, plan for a rebuild on a mainstream one when the next major change comes, and make ownership a condition of it. In all cases, write the setup document and run the stranger test once.
What this means for you
“You get the repository” should mean a complete, documented, reproducible codebase in an account you control, with your partner as a removable guest and no hidden dependency on them. Insist on it at the start of every project and verify it with the stranger test at hand-over. It costs a good supplier nothing and is the difference between owning your website and renting it under another name.
Frequently asked questions
The agency says the code is ours but keeps it in their account. Is that ownership?
Legally perhaps, practically no. Ownership you have to request access to is a promise. Ask for the repository to be transferred to an organisation account in your name, with them added as a collaborator. Transfers keep the full history and take minutes; a supplier who resists has told you something.
We received a zip file with the code at hand-over. Is that enough?
It is a snapshot without history, usually without the build configuration, secrets layout or deploy setup. A successor can often work from it, slowly, rediscovering what the previous team knew. A repository with history and a documented build is the difference between a day and a month of onboarding.
Does owning the code mean we can move to any developer?
If the stack is mainstream and the repository is complete and documented, yes, and that is the point of insisting on it. If the code depends on the agency's proprietary framework or hosting, ownership of the files does not buy independence. Ask what the code depends on that only they provide.