Who Owns the Data, the Access and the Backups When a Consultant Builds Your System
Most owners ask who owns the software. The harder questions are who holds the passwords, who keeps the backups, and who is responsible when someone else changes something. Here is how I wrote those answers into a real commercial real estate proposal.
On this page
CMore Flo
Your data, your keys
Real Estate
Who owns the data and the system when a consultant builds it for my company?
Whatever the agreement says, so write it down before the build. Your data, rules, decisions and results should be yours. The consultant usually keeps their general methods. Name who holds the accounts, credentials and backups, what happens to the consultant's access after handover, and who answers for changes other people make.
This month I wrote the terms for a commercial real estate build, part of the deal screening and due diligence work I have been doing with Dallas Whitaker of Carter Funds. It took eight drafts. The ownership clause was one of the easier parts.
The harder questions were practical. Who holds the passwords after I hand the system over? Who keeps the backups? If someone else on their side changes a setting and something breaks, whose problem is that? Those are the questions that decide whether a company can run its system without the consultant, so they belong in writing before the build. What follows is how I answered them; it is a proposal, not legal advice, and your own agreement should be read by your lawyer.
What the client owns and what the consultant keeps
The client owns its data, criteria, calls and outcomes, its strategy and its positioning. The consultant keeps methods: design patterns, grading approaches, reusable components. The client's confidential business methods stay confidential.
The clause names both sides. The client owns its data, its criteria, its calls and its outcomes, plus its strategy and positioning. I keep my methods as a consultant: how I design and test systems, prompting patterns, grading approaches, learning-loop designs and reusable components. The example written into the clause makes it concrete: the fund's screening criteria are the fund's; the method of grading a screener against them is mine.
The client's own deal methods stay confidential. I can use my general methods in other work, and I cannot carry their business into it. Writing this down matters because U.S. copyright rules do not automatically hand a contractor's work to the client; the written agreement decides.
Question
Where the proposal put it
Data, criteria, decisions, outcomes
The client's
Methods, patterns, reusable components
The consultant's, usable in other work
The client's deal methods
Confidential, never reused
Accounts, credentials, backups
The client's, in the client's name
Who can query the database
Anyone the client admits
Changes made by other people
The client's responsibility; fixing them is separate work
Consultant access after acceptance
Only while further work is agreed
Investment decisions
The client's; the system gives no investment advice
The split in a September 2026 proposal for a commercial real estate build. Proposed terms, shown without fees.
Access, credentials and backups
Accounts in the client's name, credentials and backups held by the client, and anyone the client admits able to query its own database directly, without going through the consultant.
The system's database can be queried directly by anyone the client admits, without going through me. The access, the credentials, the backups and the accounts are the client's, in the client's name. Accounts that existed before the system moved to the client's own environment are named in the agreement as not mine, so nobody later assumes I hold them.
Documents get a second home in storage the company owns, so a deal file never lives only inside a tool. And if an outage outside my control delays the work, the timeline extends, and any temporary hosting is paid at cost only with the client's written approval before any data moves.
Other people's changes, and access after handover
When someone else changes the system, that is the client's responsibility, and fixing it is separate work. The consultant's access stays only while more work is agreed.
Once a system is handed over, other people will change it. That is normal and it is theirs to do. The clause says so: changes made by others, and account breaches, are the client's responsibility, and correcting them is separate scope. Without that line, a consultant is either blamed for work they never touched or quietly on call forever.
My access after acceptance lasts only while further work is agreed. When the work ends, the access ends, and the client can see and remove it from accounts in their own name.
When this is more than you need
If the build is one automation inside a tool you already pay for, most of this is already settled by that tool's terms, and a short email confirming who owns the account may be enough. The full clause earns its place when the system holds your data in its own database, which is exactly when losing access would hurt.
Common questions
Answers to what people ask.
Does my company automatically own software a consultant builds?
Not necessarily. Under U.S. copyright rules, work by an independent contractor is not automatically the client's; it depends on a written agreement. Ask a lawyer about your contract, and make sure ownership is written down before the build starts.
What should the consultant keep after the project?
Usually their general methods: how they design, test and grade systems, reusable patterns and components. Your data, criteria, decisions and outcomes stay yours, and they should not be able to use your confidential business methods elsewhere.
Should the consultant keep access after handover?
Only while further work is agreed. When the work ends, their access should end too, and you should be able to see and remove it yourself from accounts in your own name.
Who is responsible for backups of an AI system?
Decide it in writing. In the proposal described here, access, credentials and backups are the client's, on accounts in the client's name, so the system keeps running and recoverable without the consultant.
Sources
Where this comes from.
U.S. Copyright Office, Circular 30: Works Made for HireExplains that a commissioned work by an independent contractor is a work made for hire only with a signed written agreement and only in certain categories. Without that, the creator can own what they made. It is background, not legal advice for any contract.
Next step
About to hand a consultant your data?
Bring the agreement you have, or the build you are planning. We will walk through who holds what, clause by clause, before anything is built.
Chris Moreno builds custom AI systems for business operations. His writing draws on the work behind these systems: intake, follow-up, document workflows, and the checks that keep people in control.
The approach behind this work follows the four phases of Flo OS, our operating methodology for turning messy business workflows into systems that run cleanly and compound over time.