Why This Business Lost Control of Its App

---

Many businesses have established a digital presence. For this, they rely on custom software solutions, and the technical teams that are responsible for them. Among non-technical founders, the reliance leaves them at the mercy of the technical teams that handle every aspect of the platforms. From development to deployment, non-technical founders often completely outsource this task without taking any responsibility or ownership for themselves.  

It is irrefutable that outsourcing is helpful. The challenge comes when this relationship halts, without the founders taking any responsibility. 

Despite having paid for the software, businesses find themselves realizing– often too late, that they do not really own the software. Ownership here means ability to control completely. Lacking understanding of software elements, usage, and best practices, businesses lose control. 

This case study aims to explore how one company found itself in such a situation, and how we stepped up to help our client gain ownership of the software, and by extension, complete control of critical systems. 

Our client here was a growing company, a mid-sized organization. The founder of the company is a non-technical individual who hired a developer to build a custom software solution. Completely trusting the developer, the founder left all the technical work on him, whether it be building the system, or its management. 

The custom software solution was designed to completely handle all internal operations, while also functioning as a SaaS platform for external clients. The founder completely trusted the developer for the entire project, did not take ownership of the software, which did not pose a challenge, until the company lost its ability to control the system. 

Over a period, the developer had established total ownership of the technical framework of the system. The framework encompassed:

• Source Code: The developer has registered the complete code base of the application under their personal accounts. 
• Infrastructure: The developer has also established and maintained the entire infrastructure comprising cloud servers, assets, and databases under their own Azure account.
• Administrative Access: The developer had full access to all technical components, while the company had zero visibility.

This continued for years without notice until the company decided to take their product in a different direction and dismiss the developer.

Upon termination, the developer locked the company out of its own software product. Now, the company had no access to code, databases, and servers. With that, they were suddenly without control of their core digital asset that powered the internal operations and customer platform. The company, lacking any software accessibility, was brought to a standstill. 

When the company first reached out to us, they were frustrated and anxious about their condition. Their software was out of commission, and their reputation was on the line. 

Upon learning the owner’s situation and the events that had occurred, we reached out to the developer. We explained the rightful ownership of the founder, asking for a complete handover, irrespective of where the software was hosted. 

The developer also argued that the software was hosted on their personal Azure account, and in the hands of someone lacking enough experience, it would damage their own services in the process of migration. However, we explained our expertise in Azure, ensuring the migration will carry forward smoothly. 

We developed a plan to achieve what we wanted. It comprised the following steps: 

• Negotiation using the information as leverage to get the developer to cooperate and grant access temporarily.
• Migration once access was granted. The complete migration process included:

1. Transferring the complete source code repository to the client’s Git repo and Azure DevOps.
2. Transferring their Azure resources comprising servers, databases, environments to the clients Azure subscription 
3. Establishing role-based administration to ensure no one single person could gain access without being reviewed. 
4. Validating all systems, credentials and resources to ensure they were now secured with the client. 

This process was executed very seamlessly with little interruption to the client's business operation, upon completion of which, the client got complete access and ownership. 

Now, their software is fully hosted in their own organizational accounts. The executives have master credentials, and developers are given access when necessary. With this, the company can scale its business and enhance its product with confidence, without the fear of being locked out again. We still provide technical support, maintenance, and improvement to the engineering team, in a fully visible manner while the client retains full ownership.

This occurrence is a reminder for every company that builds or owns custom software. Trust is very important, and so is control. The following are implications every founder should think about:

No matter if it's Azure, AWS, or GitHub, all platforms should be registered under the company's accounts, not the developer's. Developers should have access, but you should claim ownership.

Your contract should state you own all software source code and associated IP developed for you. Anything short of this agreement could lead to you losing rights to your IP.

Although it is efficient to host your application on a developer's personal account, this creates risk in the long run. If you don't continue the relationship, you will lose access.

Everything would need to be in the organization's possession in terms of master credentials including domain, hosting, repository access, etc. You can provide role-based permissions to technical staff but retain the keys for ownership.

Periodically review who has access to your systems ensuring that ownership of critical assets is present in your organization. This will prevent surprises at a later date.