24 March 20268 min read
The contract conversation happens at the point of maximum goodwill and minimum attention. Everyone has decided, the candidate is keen to start, and the terms feel like paperwork standing between you and the work. That is precisely why the clauses that decide how this ends get skimmed.
You will never have more leverage than you do before signing, and the five things below are cheap to agree now and expensive to negotiate later. None of this is legal advice, and anything material should be read by a lawyer in your own jurisdiction; the point here is knowing what to make sure your lawyer is looking at.
IP assignment, all the way down the chain
The clause you need says that everything created for you belongs to you, effective on creation, and that the provider has secured the same assignment from every individual and subcontractor who touches the work. That second half is the part that is routinely missing.
A provider whose engineers are contractors rather than employees needs a chain of assignment from each of them, and if that chain has a gap, your ownership has a gap. Ask directly how their people are engaged and whether their contracts assign work product to the provider. It is a normal question and the answer arrives quickly from anyone who has been asked before.
While you are there, settle the boring adjacent items: repository ownership sits in your organisation from day one rather than being transferred later, and accounts, infrastructure and domains are registered to you rather than to a helpful individual who then leaves.
Data processing, if any personal data is involved
If the provider's people will see personal data belonging to your users or staff, and in practice anyone touching a production database or a support inbox will, then as a controller under the GDPR you need a data processing agreement with them as processor. It should name the categories of data, the purposes, the security measures, the rules on sub-processors, and what happens to the data when the engagement ends.
Where the work happens outside the EEA or the UK, transfers need a lawful basis, commonly the standard contractual clauses plus an assessment of the destination country, and your provider should be able to hand you their version of this without a delay for improvisation. Ask separately where data will actually sit: which cloud region hosts the environments people work in, and whether anything is copied to local machines.
There is a practical alternative worth raising early: much of this gets simpler when the outside team works only in your systems, on your accounts, with access you grant and revoke. It is more setup work at the start and considerably less to unwind at the end.
Notice, and what it is really for
Notice periods are usually discussed as a way to protect the provider's revenue, which they are, but the length you want depends on what you are buying. For a single augmented engineer, thirty days is normally reasonable on both sides. For a team running delivery, longer notice is not a trap: it is the time you need to hire or rebuild, and a provider offering to leave in a week is not doing you a favour.
What matters more than the length is symmetry and clarity. Notice should run both ways, on the same terms, and the contract should say plainly what happens during it: that work continues, that handover is included rather than chargeable, and that access is maintained until the agreed end date.
Replacement and continuity
People leave. The question is whether that is your problem or the provider's. Get four things in writing.
- That the named individuals are named, and cannot be swapped without your agreement
- How quickly a replacement is proposed, and that you interview them on the same terms as the original
- That the ramp-up period for a replacement is not billed at full rate, or is credited in some agreed way
- That knowledge transfer between the departing and arriving person is included, with overlap where the notice allows
The third point is where providers push back, and the negotiation is informative. A provider confident in continuity will find a form of words. A provider who insists that every ramp is fully billable is telling you who carries the risk of their own attrition.
A trial period that is fair on both sides
Trials are reasonable and both sides benefit, but a trial that only protects you is a bad-faith term and good providers decline it. A fair one has four properties: it is paid at the normal rate, it is time-boxed and stated, it has a written outcome, and either side can end it.
Make it a real piece of work with a definition of done rather than a general observation period, and hold a written review at the end covering what shipped, what got in the way and what changes next. A trial with no review is just an early-termination right, and it produces a decision made on feeling in a meeting that is scheduled too late to fix anything.
Two weeks is usually too short to judge anyone who had to learn your codebase. Four to six weeks is more honest, and the ramp expectation should be stated in advance so nobody is surprised that week one produced questions rather than commits.
Rates, overtime and the things that change
Settle how rates change over time: whether there is an annual adjustment, what triggers it, and how much notice you get. Settle what counts as billable, particularly meetings, on-call and travel. And if you expect any out-of-hours work, agree how it is treated before the first incident rather than during it, because that conversation is much worse when someone is tired and something is broken.
None of these are traps. They are simply the questions that get answered by whoever is more prepared, and the meeting where you ask all of them at once is shorter than the six meetings where they surface one at a time.
What to actually get a lawyer to read
You do not need counsel on the whole agreement for a modest engagement. You do need them on the IP assignment and the chain behind it, the data processing agreement and transfer mechanism, the liability and indemnity limits, and the governing law and where disputes are heard.
That is a small, cheap review. The reason it is worth doing is that these are exactly the clauses nobody looks at until the moment they matter, which is a moment in which everyone has stopped being friendly and the document is the only thing left.