Who Owns Design Files, Source Code, and Copyright?

After the final invoice is paid, clients often ask a simple question: "Do we own the source files and all the rights?" In practice, that question covers at least six separate issues: possession of files, usage licenses, copyright, third-party licenses, account control, and the vendor's portfolio rights. A contract stating only that "all final deliverables belong to the client" leaves many critical assets undefined.

For example, a client may receive the website's front-end code while the repository remains in a vendor's personal account. They may receive an editable logo file but lack a commercial license for its typeface. They may receive a Figma file without the component library, source icons, or proof of image licensing. Delivery may appear complete while the business still cannot safely edit, migrate, or operate the work over time.

01 Separate four concepts that are often confused

02 Which source files should a design project deliver?

Source-file requirements should be listed according to the service scope, not assumed to include every working file created during the project. The final approved direction generally requires editable files and specifications. Whether rejected concepts, internal drafts, research notes, and a vendor's proprietary templates are included should be addressed separately.

03 Source-code delivery does not guarantee an independent handover

A website or mobile app handover should cover source code, build instructions, environment-variable templates, database structure, deployment procedures, third-party services, account access, and backups. A single archive does not tell the client whether the code is current, whether it includes the admin system, or whether it can run on a different server.

• □ Transfer the repository to a company-owned account, or at minimum grant the company administrator access;
• □ Identify the final delivered release and its corresponding production version with version tags;
• □ Provide a README with installation, build, deployment, and rollback instructions;
• □ Supply the database schema, notes on seed data, and required backups;
• □ List accounts for domains, hosting, object storage, email, SMS, payments, and analytics;
• □ Define a secure handover process for keys, certificates, environment variables, and other secrets;
• □ Document licenses for open-source dependencies, commercial components, and third-party SDKs;
• □ Confirm whether automated deployment, monitoring, logging, and backup systems are included.

04 Copyright clauses should identify both the work and the rights

A design engagement may produce graphic artwork, written content, interface compositions, video, and software code, each of which can carry different legal rights. Contracts should assign or license rights by deliverable instead of referring broadly to "everything created during the project." For approved original work that has been paid in full, the parties may agree to transfer applicable economic rights or grant an exclusive or nonexclusive license. Attribution and integrity rights can have different legal treatment, so complex agreements should be reviewed by qualified counsel.

The contract should also define permitted uses: modification, copying, publication, online distribution, advertising, packaging, physical locations, mobile apps, international markets, multilingual versions, subsidiaries, and distribution to partners. Brand assets in particular should anticipate future applications instead of permitting use only on the current website.

05 Fonts, images, and plugins require separate licensing

06 Separate reusable capabilities from client-specific work

Development teams may reuse foundational frameworks, utility functions, admin foundations, and general-purpose components across projects. Clients, however, need durable rights to their business logic, interface implementation, database structure, and modules created specifically for the engagement. A contract can distinguish between the vendor's pre-existing reusable assets and project-specific deliverables: the vendor retains the former and licenses them for project use, while the latter are transferred or licensed under the agreed terms.

Requiring exclusive ownership of every underlying line of code usually increases cost substantially and may prevent the use of proven frameworks. Most businesses primarily need a maintainable handover, freedom from hidden lock-in, and uninterrupted operations—not exclusive ownership of every generic function.

07 Account ownership often matters more than a code archive

Domains, hosting, cloud services, code repositories, CMS platforms, Google Search Console, analytics, business email, payment systems, SMS services, and app-store accounts should ideally be registered to the company from the start. The vendor can join as a member or collaborator. If the relationship ends, the company still controls its business channels and data.

08 How should a vendor's portfolio rights be handled?

Design teams generally want to feature launched work on their websites, in portfolios, and in industry awards without disclosing confidential information. If a company is under embargo, has not launched, or operates in a sensitive field, the agreement can specify when work may be shown, which screens may appear, whether the client name must be hidden, and whether written approval is required. A complete ban is not the only option; controlled disclosure is usually more practical.

09 What should be delivered before and after final payment?

10 Final handover checklist

• □ Final approved source and export files are complete and open correctly;
• □ Repository branches and version tags match the production release;
• □ Domain, hosting, CMS, database, and third-party platform accounts have been transferred;
• □ Fonts, images, music, plugins, SDKs, and open-source dependencies have an inventory and licensing notes;
• □ Copyright, usage licenses, modification rights, and approved channels are defined for each deliverable;
• □ Vendor portfolio rights, confidentiality periods, and anonymous presentation requirements are documented;
• □ Database backups, deployment documentation, environment-variable templates, and maintenance notes are complete;
• □ The company has updated passwords, removed unnecessary access, and reviewed administrator accounts.

Frequently Asked Questions

Must the Figma file be delivered after final payment?

That depends on the contract. If editable UI files are included in the quoted deliverables, the agreement should specify their scope, version, and delivery date instead of referring only to "designs."

Can a client resell website source code after receiving it?

Not automatically. Delivery of source code, copyright ownership, usage rights, and sublicensing rights must be addressed separately, and third-party code remains subject to its own licenses.

Can a designer showcase a logo after its copyright is transferred?

The contract may reserve reasonable portfolio rights, subject to confidentiality, launch timing, and restrictions on sensitive client information. Both parties should agree in advance instead of disputing the issue at project close.

Who should purchase commercial font licenses?

Either the client can purchase them directly or the vendor can purchase them on the client's behalf. What matters is clarity about the license holder, approved channels, and renewal responsibility. Logos, websites, mobile apps, and office documents may require different licenses.

Who owns rejected design concepts?

They should not be assumed to transfer with the final approved direction. The contract should state whether rejected concepts, drafts, research materials, and reusable methodology assets will be delivered or may be reused.