Software chain of title: IP checks before licensing an acquired codebase

What is chain of title for an acquired codebase?#

Chain of title for an acquired codebase is the unbroken, documented line of ownership from each person or company that wrote the code to the entity that now wants to license it. A gap anywhere in that line means the licensor may be granting rights it does not hold.

Acquisition diligence usually checks title at a level suited to buying a business: representations, a disclosure schedule and a sample of employment agreements. Licensing the codebase, or the engineering history around it, to an AI developer asks a narrower question. The licensor typically warrants that it owns or controls what it delivers, so the review moves from representative to complete for the files in scope.

The code rarely travels alone. Licensable engineering records include commits, pull-request reviews, issue threads and design documents, and each has authors whose contributions need the same analysis.

The six links to check, and the paper that proves each#

The six links in a software chain of title are founders, employees, contractors, prior acquisitions, open-source components and customer-funded code. Each has a document that proves it and a typical way it breaks, so the review is mostly a hunt for specific paper.

Employees and founders: when ownership is automatic and when it is not#

Employee-written code is generally owned by the employer when it is a work made for hire. Under 17 U.S.C. 201(b), the employer is considered the author of a work made for hire and owns all rights in the copyright unless the parties agreed otherwise in a signed written instrument.

Scope of employment is fact-specific. The Ninth Circuit model jury instruction, drawing on Community for Creative Non-Violence v. Reid, asks whether the work is the kind the employee was hired to do, whether it happened substantially within authorized time and space, and whether it was meant at least partly to serve the employer. A developer's weekend tool that later became a product module can fall outside that test, which is why invention assignment agreements still matter for employees.

Founders are the most common gap in smaller acquired companies. Code written before incorporation, or before founders signed anything, belongs to its individual authors until assigned. A confirmatory assignment from each founder covering the earlier work is the usual fix when founders are reachable and cooperative.

Contractors: why work-for-hire wording may not be enough#

Contractor-written software is the link most likely to be broken, because a work-for-hire label does not by itself transfer ownership of most software. The Copyright Office's Circular 30 explains that a specially commissioned work is a work made for hire only if it falls in one of the statutory categories and the parties expressly agree in a signed written instrument.

The statutory list covers items such as contributions to collective works, compilations, translations, instructional texts and tests, and standalone software is not plainly among them. Counsel therefore generally looks for a present assignment of IP from each contractor or contracting firm, in addition to any work-for-hire wording.

Development agencies add a layer. The agency must own what its own staff and subcontractors wrote before it can assign it, so ask for the agency's developer agreements, or a warranty and assignment covering them, and record which repositories and date ranges each contractor touched.

Prior acquisitions, open source and customer-funded code#

Prior acquisitions, open-source components and customer-funded code are usually carved out rather than cured, because each involves rights held by someone else. Fixing them takes another party's signature; excluding them takes only a narrower package.

• 1Prior acquisitions: read the earlier purchase agreement's assigned-asset schedule and IP assignment. Modules taken under a license rather than an assignment belong to someone else.
• 2Open-source components: run software composition analysis to separate vendored libraries and copied snippets from first-party code. Many licensors exclude third-party code from the package instead of analyzing each license's terms.
• 3Customer-funded code: search statements of work and development agreements for clauses giving the customer ownership of deliverables or exclusive rights, then exclude those modules or seek consent.
• 4Copied code: ask long-tenured engineers whether code came from prior employers, forums or other projects, and record known areas of doubt.

What else rides along in the repository#

Repository history carries more than code: commit metadata with developer names and email addresses, test fixtures that may hold customer records, configuration files with credentials, and comments naming customers. A review that clears ownership still needs a privacy and confidentiality pass before anything is delivered.

Credentials are the most common surprise in older histories. Gitleaks, an MIT-licensed tool that detects passwords, API keys and tokens in git repositories, is a common pre-delivery check, though its maintainer stated in 2026 that it is feature complete and future releases will be security patches only. TruffleHog says it can log in to confirm whether a found secret is live, which calls for care when scanning systems you do not control.

Licensing also bears on trade secret status. Under 18 U.S.C. 1839(3), information is a trade secret only if its owner takes reasonable measures to keep it secret, so a code license should carry confidentiality, access and use limits rather than releasing code broadly.

Illustrative: a holdco checks title on an acquired scheduling platform#

Illustrative: a fictional software holding company acquired a field service scheduling platform. The two founders wrote the first version before incorporating, an outside agency built the mobile apps, a large customer paid for a custom routing integration, and the platform had earlier bought a small reporting tool from another vendor.

The holdco's general counsel maps the repositories by provenance. Server code and its pull-request reviews, written by employees, pass once the founders sign confirmatory assignments. The mobile apps are held back until the agency signs an assignment covering its developers. The routing integration is excluded because the statement of work gives the customer ownership. The reporting tool is excluded because the earlier deal licensed its code rather than assigning it.

The resulting package is narrower than the whole codebase, but every file in it has a documented owner, which is what the license warranties require.

How SourceX handles chain of title#

SourceX treats chain of title as part of the Rights step in the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The supplier's counsel confirms ownership; SourceX organizes the questions and records the answers. Nothing is shared during the initial assessment.

For each package, the SourceX Evidence Packet records provenance, licensing rights, permitted use, the privacy record and release authorization, including which repositories and date ranges were excluded and why. The supplier approves every step and keeps ownership, because the records are licensed, not sold.