Custom software development shop due diligence

A buyer under letter of intent for a custom software shop is verifying a short list of things that can end the deal. The signatures that say who owns the code are among the first things to check. This guide follows one sensible order of review, from chain of title to the people who did the work. It describes verification, not a recommendation to proceed.

Trace title from each author to each client

Request, project by project, three things: the agreement under which each person worked on it (employment agreement, contractor agreement, or a subcontracting firm’s agreement), the shop’s agreement with the client, and any amendment to either. Then trace. A developer employed under a contract of service who made the work in the course of that employment makes the employer the first owner of the copyright unless an agreement says otherwise (Copyright Act, section 13(3)). Everyone else is the first owner of what they write (section 13(1)), and passing it on requires an assignment in writing signed by the owner or the owner’s duly authorized agent (section 13(4)). Moral rights may be waived but not assigned, and assigning copyright does not by that act alone waive them. A clean file therefore shows a signed assignment from each author who was not an employee, and a waiver of moral rights from each author.

Employees need checking too. Ask when each employment agreement was signed and whether anyone started before signing, because the employer rule reaches only work made in the course of employment.

What a gap in the chain actually means

When a contractor never signed an assignment, the contractor remains the author and first owner. Without a written assignment the business may also be left with only an implied licence to use the work for the purpose it hired the contractor for, which becomes a problem when it later wants to modify, license out or sell the work. For a shop that has delivered the code to a client, the consequence runs through the client contract: the shop may have promised ownership it cannot give. How serious a finding is depends on where it sits. A gap in a discarded prototype is a footnote. A gap in the core platform of the largest client can move price, add a closing condition that a confirmatory assignment be signed, or send the buyer to the client to ask what it believes it owns.

Searches against the shop and its code

Three searches are worth running. First, the Copyright Office register at the Canadian Intellectual Property Office, for recorded assignments and licences. The Registrar registers an assignment on being given the instrument, or other satisfactory evidence of it, and the fee (section 57(1)), and under section 57(3) an assignment or licence is void against a later assignee or licensee for valuable consideration without actual notice unless the earlier one is registered before the later instrument is. Second, a personal property security search against the shop. In Ontario, registration under the Personal Property Security Act perfects a security interest in any type of collateral (section 23); other provinces have their own statutes and registries, so ask counsel which applies. Third, litigation and corporate searches for claims by clients, contractors or former employees. Beyond registers, check who controls the source repositories, cloud accounts, domain names and app-store developer accounts. If any sit in a founder’s personal name, they will not move with the company unless someone moves them.

Privacy and security records

PIPEDA requires an organization to keep a record of every breach of security safeguards involving personal information under its control, and to report to the Privacy Commissioner and notify individuals where there is a real risk of significant harm. Ask for the record. Then ask, for each incident, whether the shop controlled the information or was processing it for a client, since the Commissioner’s guidance treats that as a case-by-case question. An empty record at a shop that has worked inside client systems for years deserves a question about how incidents were identified, not a conclusion that none occurred. Read the data terms in client contracts too. Where the shop or a client is subject to Quebec’s private-sector privacy law, note that the Commission d’accès à l’information says an organization must carry out a privacy impact assessment before communicating personal information outside Quebec, that the communication may be made if the assessment shows the information would be adequately protected, and that it must be covered by a written agreement; it also lists an assessment for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information.

Open projects, the numbers and the people

Commercial checks come next. For every open fixed-price project, ask for the estimate to complete, the hours spent and the client’s acceptance status, and reconcile timesheets to invoices so that revenue and the hours behind it agree. Age the unbilled work in progress and the receivables by client. If the shop claims SR&ED credits, request the filed claims and any correspondence about CRA reviews. Then look at the contractor relationships themselves. The CRA distinguishes an employee, who generally works under the direction and control of the payer under a contract of service, from a self-employed worker under a contract for services, who is not under the payer’s direction or control. Developers described as contractors who in practice work like employees raise a payroll question to put to an advisor; see what happens if the seller misclassified an employee.

Findings that end deals, and what each one means

• Missing assignments across a pattern of projects rather than one file. That suggests the shop never had a system, so the next file cannot be assumed to be clean.
• Subcontractors who signed nothing with the shop. No assignment can reach the client through that gap, which can turn an ownership question into a warranty exposure.
• One client making up most of the open backlog with no forward commitment. The backlog is then a relationship, not a contract, and may need to be valued as one.
• A security incident the shop treated as minor but a client treated as a breach. The question becomes who was in control of the information and who owed the notice.
• Repositories or cloud accounts held in a founder’s name with no agreement to transfer them. Control of the working assets is then negotiable, which belongs in the purchase agreement, not the integration plan.