Key takeaways
- Lock down IP assignment, confidentiality and code ownership before work starts.
- Define milestones, acceptance criteria and handover assets in plain language.
- Use PDPA, access-control and breach-notification clauses whenever customer data is involved.
- Avoid vague retainers that hide who owns source code, repos and credentials.
- This is a buyer checklist, not legal advice - have counsel review anything material.
A software outsourcing contract in Singapore should make five things unambiguous: what will be built, who owns the IP, how personal data is protected, when milestones are accepted, and what gets handed over at the end. If those clauses are vague, the cheapest vendor can become the most expensive mistake. Use this checklist before you hire a freelancer, agency or dedicated developer team.
The 12 clauses to check before signing
| Clause | What to confirm | Why it matters |
|---|---|---|
| Scope of work | Features, exclusions, platforms, integrations and assumptions are written down. | Prevents scope disputes and surprise change requests. |
| Milestones | Each milestone has deliverables, review window and acceptance criteria. | Turns progress into testable output. |
| IP assignment | All code, design, docs and deliverables are assigned to your company. | Avoids the vendor owning what you paid to build. |
| Repository access | Your company owns or controls GitHub/GitLab, cloud and deployment credentials. | Prevents lock-in after launch. |
| Confidentiality/NDA | Business data, pricing, strategy and customer data are protected. | Keeps sensitive information out of vendor portfolios. |
| PDPA/data protection | Data roles, access control, retention and breach handling are stated. | Required whenever personal data touches the project. |
| Payment terms | Monthly rate, milestone billing, deposits and late-payment rules are clear. | Protects cash flow on both sides. |
| Change requests | How new scope is estimated, approved and priced. | Keeps roadmap changes controlled. |
| Warranty/bug fixes | Defect window and response expectations after launch. | Avoids arguments over launch bugs. |
| Termination | Notice period and what you receive if either side exits. | Protects your code and data if the fit is wrong. |
| Handover | Source code, docs, credentials, deployment notes and runbook are delivered. | Lets another developer continue cleanly. |
| Non-solicit | Whether you can hire developers directly and on what terms. | Avoids accidental contract breaches. |
Red flags I would not ignore
- The vendor will not assign IP until the final invoice is paid, but wants full repo control throughout.
- The contract says you receive a licence to use the software, not ownership of the source code.
- Acceptance criteria are described as satisfaction or completion without testable deliverables.
- No one can explain where credentials, deployment keys or production access will live.
- There is no named process for PDPA, breach notification, data retention or account access.
A safer contract structure for Singapore SMEs
- For most SMEs, I prefer a simple monthly development agreement with a signed NDA, full IP assignment from day one, a milestone plan, clear acceptance criteria and no lock-in. The client owns the repos and credentials. The developer team works in your tools. Handover is not an extra service; it is part of the engagement.
How to use this checklist during vendor selection
Do not wait until the legal contract arrives. Use the checklist during the sales conversation. Ask the vendor to walk through ownership, repo access, milestone acceptance and handover before you compare price. A confident partner should be able to answer in plain English without hiding behind legal language.
For Singapore SMEs, the most common problem is not that the contract is missing every clause. It is that the clause exists but is commercially weak. For example, a vendor may say you own the deliverables, while keeping the source repository, deployment keys and reusable modules vague. That still leaves you dependent on them after launch.
Questions to ask before you pay a deposit
- Will my company own the Git repository from day one?
- Will the contract assign all custom code, designs, documentation and database schema to my company?
- What happens if we stop after milestone two?
- Who owns domain, hosting, payment gateway and API credentials?
- What personal data will your developers see, and how will access be removed after handover?
- What is included in bug fixing, and what counts as new scope?
If the answer to any of these is vague, pause. You do not need a 40-page enterprise contract for every SME build, but you do need commercial clarity before a developer touches production systems.
How to turn the checklist into acceptance criteria
A contract becomes much stronger when each milestone has acceptance criteria. Instead of saying "admin dashboard completed", define what the admin can do, what data appears, which permissions apply, what browsers are supported and what counts as a defect. This gives both sides a fair way to decide whether a milestone is done.
What to prepare before scoping
- Milestone names and expected outcomes.
- Screens or workflows included in each milestone.
- What is excluded from the milestone.
- How long you have to review and report defects.
- Who signs off on acceptance.
Bring these notes into the first conversation and the scope becomes sharper immediately. It also helps me tell you honestly whether you need a one-off build, a dedicated developer, an AI automation, or a smaller fix than you expected.
Frequently asked questions
Do I need a lawyer for a software outsourcing contract?
For a material project, yes. This checklist helps you spot commercial issues before counsel reviews the document, but it is not legal advice.
Should the vendor own the GitHub repository?
Ideally no. Your company should own or control the repository, cloud account and production credentials from the start.
What is the most important clause?
IP assignment. If the contract does not clearly assign code, designs and documentation to your company, you may not fully own what you paid to build.
Can Outsourced SG work with my own contract?
Yes. I can review the commercial flow, then you should have legal counsel review legal wording before signing.
Need it built? Explore my services
Want to build with an accountable founder?
Need a build scoped before you sign anything? I can turn your requirements into a clean milestone plan and developer team from S$400/month. You own 100% of the IP, with NDA, handover and no lock-in.
WhatsApp me →