Intellectual property and offshore: who really owns the code when your team is abroad

Most executives confuse payment with ownership. Yet copyright law, in France as in the Berne Convention signed by 181 countries, protects the creator, not the client. Without an explicit clause, you are financing an asset that doesn't belong to you.

Under French law (Article L113-9 of the Intellectual Property Code), rights over software created by an employee are automatically transferred to the employer. But this exception only applies to direct employees. When you work with an offshore service provider, this presumption disappears. Your developer in Madagascar is not your employee. They are employed by the local structure. Without a written and explicit assignment, the economic rights remain with the entity that employs them. And moral rights always remain attached to the author, regardless of what your contract says. In practice: if your service contract does not contain an assignment clause for economic rights, detailed by mode of exploitation, duration, and territory, you legally have only an implied right of use. Reselling your software, modifying it, licensing it to a third party? You don't have the right to do so. And the day you raise funds or sell your company, due diligence will blow the problem wide open. This is exactly the type of risk that les clauses oubliées dans les contrats d'externalisation make invisible until the critical moment.

Code is only part of the problem. Your client data, prospect files, and CRM histories circulate every day between France and your offshore team. The GDPR applies as soon as a non-EU subcontractor accesses personal data of European residents. Madagascar does not have an adequacy decision from the European Commission. Neither does Maurice. This means that the transfer of personal data to these countries requires additional safeguards: standard contractual clauses (SCCs), impact assessment, up-to-date processing register. In practice, the majority of SMEs that outsource put nothing in place. No SCCs annexed to the contract. No DPA (Data Processing Agreement). The risk is not theoretical: the GDPR fine can reach 4% of annual global turnover. For an SME with €2M in revenue, that's €80,000. Not counting the reputational damage. The question also arises for commercial deliverables: databases, market analyses, reports. If nothing specifies that these elements are your exclusive property, the service provider can technically retain, cross-reference, and reuse them.

Here's what I've seen happen. An e-commerce SME executive has a business application developed by an offshore team via a freelancer. Minimal contract, three pages, no IP clause. The project progresses well for a year. Then the freelancer leaves, takes the team, and launches a competing product based on the same code. The executive contacts a lawyer. Response: without a written assignment, the code belongs to the developer. The only option is a long, costly lawsuit with an uncertain outcome since the competent jurisdiction is that of the service provider's country. Result: 18 months of development lost. Rebuilding budget: €120,000. Market delay: 9 additional months. A competitor with your own code, facing you. This scenario doesn't only happen to naive startups. It happens to structured SMEs that simply delegated drafting the contract to the accountant or the service provider itself. The offshore contract is not an administrative document. It is the only thing separating your intellectual asset from the public domain. To understand the complete legal framework, le guide juridique et fiscal de l'outsourcing à Madagascar et Maurice details every point to lock down.

The contract is your only safeguard. Not trust, not the relationship, not goodwill. Here are the five elements that must appear in black and white before the first file is created.

A valid IP assignment clause under French law must be explicit and detailed. Article L131-3 of the Intellectual Property Code requires that each right assigned be mentioned distinctly: reproduction, adaptation, modification, distribution, commercial exploitation. The clause must also specify the duration (the full legal protection period), the territory (worldwide), and the media (all known and future media). A phrase such as "all deliverables are the property of the client" is not sufficient. It is legally fragile and contestable. Your clause must also cover intermediate works: mockups, prototypes, technical documentation, databases, source files. Critical point: the assignment must be signed by the entity that employs the developers, not by a commercial intermediary. If your contract is with a broker who subcontracts to a team they don't control, you have an incomplete assignment chain. And an incomplete chain, legally, is the same as no chain at all. The clause must also include a warranty against eviction: the service provider guarantees that they have not assigned the same rights to a third party and that they have the legal capacity to assign them.

The Data Processing Agreement is mandatory as soon as a subcontractor accesses personal data on your behalf. This is not optional — it is Article 28 of the GDPR. The DPA must specify: the nature of the data processed, the purposes of processing, the duration, the technical and organizational security measures, the notification obligations in case of a breach, and the right to audit. For transfers outside the EU to countries without an adequacy decision (which includes Madagascar), you must annex the European Commission's Standard Contractual Clauses (SCCs), June 2021 version. These standardized clauses govern the transfer and impose protection obligations on the data recipient. In parallel, a Transfer Impact Assessment is recommended to document that the level of protection in the destination country is sufficient. In practice, in your offshore contract, the DPA and SCCs must be formal, signed annexes. Not a well-intentioned email. Not a mention in the general terms. Separate documents, dated, with technical measures listed: encryption, access control, pseudonymization, password policy, logging.

The real problem with offshore IP is not the law. It's the model. When you go through a service provider that shares its teams across ten clients, you have no real control. The Taram model eliminates this risk by design.

At Taram, each collaborator is assigned to one client only. They do not work on two projects. They do not share their workstation with another client. They are integrated into your tools: your CRM, your Slack, your Teams, your GitLab. This dedicated collaborator model eliminates the main vector of IP leakage in classic offshore: porosity between clients. When a developer works for five clients at a shared service provider, practices, code, and methods naturally migrate from one project to another. This is not malicious — it is mechanical. With a dedicated collaborator, your code stays in your environment. Your data stays in your systems. The infrastructure is premium: Ryzen 7 workstation, fiber plus 5G backup, all operated from Madagascar with structured management piloted from Maurice. The IP assignment is contractualized from the outset, with clauses compliant with French law. The NDA covers the collaborator individually. And the contract is between your company and Taram, an entity directed from Maurice, with clear jurisdiction. For the price of one French employee, Taram deploys 3 dedicated collaborators. And these 3 collaborators work exclusively for you.

The Taram model is built on a complete assignment chain. The collaborator in Madagascar signs an employment contract with an IP assignment clause in favor of Taram. Taram then assigns all rights to the client via the service contract. The chain is complete, documented, and enforceable. This is the weak point of most offshore arrangements: the assignment stops at one link. The client has a contract with the broker, but the broker has no assignment clause with its developers. Result: a gap in the chain, and your rights exist only on paper. At Taram, management in Maurice oversees the legal compliance of each contract. DPAs and SCCs are integrated from onboarding. The processing register is maintained. Each collaborator signs an individual NDA covering confidentiality, non-competition, and data return. This framework also makes it possible to secure content produced at volume. If you use Autopilot for your SEO production, each article, each piece of content is your exclusive property. No license, no reuse, no ambiguity.

Whether you work with Taram or another provider, here is your non-negotiable checklist before signing an offshore outsourcing contract. First: is the IP assignment clause detailed by mode of exploitation, duration, and territory? If it fits in one sentence, it is worthless. Second: is the assignment chain complete? Does the service provider itself have an assignment clause with every developer who touches your code? Third: does the NDA cover technical, commercial, and personal data information? Is it signed individually by each collaborator? Fourth: is a DPA compliant with Article 28 of the GDPR annexed? Are the European Commission's SCCs signed? Fifth: is the clause for return/destruction of data at the end of the contract present, with mandatory written certification? Sixth: is the competent jurisdiction French, or at minimum that of a country with which France has judgment enforcement agreements? If any single one of these points is missing, you are gambling your IP on a coin toss. And your IP is often the only asset that justifies your company's valuation.