Who owns the source code if I pay someone in Mexico to build my software?
By the Stonework team · Updated · 6 min read · Versión en español
Short answer
If you commission and pay for a program, Mexico's Federal Copyright Law (Ley Federal del Derecho de Autor, LFDA) presumes the economic rights are yours, unless agreed otherwise (article 83). But any transfer of rights must be in writing (article 30), and for a commissioned work the terms must be clear and precise (article 83 bis), so the contract has to say it. And owning the code does little for you if the repository, the domain and the accounts are in the provider's name.
What Mexico's Federal Copyright Law says
In Mexico, computer programs are protected on the same terms as a literary work. That is article 102 of the Federal Copyright Law (Ley Federal del Derecho de Autor, LFDA).
These are the articles that decide who owns the code. The full wording, in Spanish, is in the current text published by Mexico's Chamber of Deputies. The summaries below are our own translation.
| Article | What it says, in short |
|---|---|
| 83 | Unless agreed otherwise, whoever commissions and pays for a work holds the economic rights. The people who made it keep the right to be credited as its authors |
| 83 bis | For a work to count as commissioned, the contract must have clear and precise terms. When in doubt, it is read in the author's favor |
| 30 | Every transfer of economic rights is made in writing; otherwise it is void |
| 32 | For a transfer to be valid against third parties, it is recorded in the Public Copyright Registry (Registro Público del Derecho de Autor) |
| 33 | If no term is agreed, a transfer lasts five years |
| 103 | For computer programs, the transfer has no time limit, and what your employees build as part of their job is yours, unless agreed otherwise |
The practical reading: the law leans your way if you paid, but it demands paper.
Article 83 gives you ownership. Articles 30 and 83 bis ask for a clear, written contract. Between them there is room for an argument nobody wants to have in court. One clause avoids it.
What the contract should say
In plain words, without trying to be legal drafting:
- That the provider assigns to you the economic rights to the source code, the object code and the documentation made for you.
- That the assignment has no time limit, under article 103.
- When it takes effect: for example, as you pay for each stage.
- Which components are not assigned because they belong to the provider or are open source, and that you have a license to use them with no expiration date.
- That the provider will sign whatever is needed if you decide to record the assignment with INDAUTOR (Mexico's national copyright office).
- When and how they hand over the complete repository, with its history.
Ask a lawyer to review it before you sign. What this guide can do is tell you what to ask.
What the law does not solve: the accounts
Owning the code does you no good if you cannot get into it. In practice, whoever controls the accounts controls the system.
The guide from 18F, the US government's technology office that closed in 2025, states it as a rule: the client owns everything the provider produces, delivered at the end of each iteration.
Check that each of these accounts is in your business's name, with a business email address:
| Account | Why it matters |
|---|---|
| Domain | Without it, your system and your email can stop responding |
| Code repository (for example, GitHub) | It is where the code and its history live |
| Server or cloud (Vercel, AWS, Supabase or another) | It is where the system runs and where the data lives |
| Database and backups | Your customers, your sales, your inventory |
| Apple Developer and Google Play | Without them you cannot update your app |
| Payments (Stripe, Mercado Pago or another) | Your customers' money comes in there |
| WhatsApp Business and transactional email | The notifications your system sends |
| Electronic invoicing (your PAC, the certified provider that stamps your invoices) | Your CFDI, the Mexican electronic invoice |
| Password manager | The keys to everything above, in a place you control |
The provider works as a guest in your accounts. When the work ends, you remove their access and lose nothing.
If someone on your payroll writes the code
What your employees program as part of their job, or following your instructions, belongs to your company unless agreed otherwise (article 103). Even so, it is wise for the employment contract to say it.
If the programmer bills you fees as an independent professional (honorarios) or works as an outside provider, the prudent course is to treat it as commissioned work and get the assignment in writing.
And your data
The data is not the provider's "work." It is yours.
If it includes personal data about customers or employees, you are the data controller (responsable) under the 2025 Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP).
The provider that runs your database processes that data on your behalf. What the law asks of you as the controller is in Mexico's data protection law and your software.
That is why the contract should also say that the data is used only for your system, what measures protect it, and that when the work ends it is handed to you complete and deleted from the provider's systems.
How to check today whether your system is yours
- Can you log in with your own account to the cloud service where it runs?
- Is the domain registered in your business's name?
- Do you have access to the repository with its full history?
- Can you download a full backup of the database?
- Do you have a signed document that assigns the rights to you?
If you answered no to any of them, ask for it now, while the relationship with your provider is good, and not after they stop answering.
If you have not hired anyone yet, what custom software costs in Mexico explains how to ask for a quote that says who owns the code and the accounts.
Frequently asked questions
- Do I have to register my software with INDAUTOR, Mexico's copyright office?
- For the assignment of rights to be valid against third parties, the law asks you to record it in the Public Copyright Registry (article 32). Between you and your provider, what counts is the written contract.
- What happens if my contract says nothing about the code?
- The law presumes it is yours if you commissioned it and paid for it (article 83), but it also requires the assignment to be in writing (article 30). The prudent step is to sign a written assignment with your provider now.
- Can the provider reuse parts of the code in other projects?
- Only what the contract allows. It is normal for them to keep their preexisting components and give you a license to use them; what they built for you should be assigned to you.
- Who owns the data in my system?
- You do. If it is personal data, you are the controller under the data protection law, and the provider processes it on your behalf. The contract should say they hand it all over to you when the work ends.
Sources
Most sources are Mexican laws and providers, published in Spanish.
- Ley Federal del Derecho de Autor, texto vigente (última reforma DOF 14 de mayo de 2026). Cámara de Diputados.
- Ley Federal de Protección de Datos Personales en Posesión de los Particulares (DOF 20 de marzo de 2025, última reforma 14 de noviembre de 2025). Cámara de Diputados.
- Manual de 18F para reducir el riesgo de proyectos de tecnología a la medida (Carnahan, Hart y Jaquith). 18F, entregado a la legislatura de Vermont, entregado el 17 de abril de 2025.
- Guía para reducir el riesgo de los proyectos de tecnología del gobierno. 18F, gobierno de Estados Unidos, archivada el 20 de enero de 2025.
Notice. This guide explains the law in general terms, based on the current texts it cites. It is not legal or tax advice and does not replace a lawyer or an accountant who knows your case.
How we make these guides. Every figure has its source and its date; what has no source does not go in, and illustrative examples are labeled as such. We review them before publishing, every three months and whenever something they cite changes. These English versions are translations of our Spanish guides.
When this guide is reviewed. When the Federal Copyright Law or the data protection law is amended, or when a lawyer reviews the text.
Who writes it. The Stonework team, a software studio in Mexico City that builds and runs EventQR, CuentaFácil and Conto, and builds custom software for companies.