What to Ask a Dev Partner Before Your First Funding Round

Published by CodeNicely, the product studio founded by Meghal Agrawal and Ujjwal Agrawal in 2017

For: A seed-stage Indian startup founder who has signed a dev partner to build their product and is now 60–90 days from a Series A investor conversation — and has just realised their investor will conduct technical due diligence on the codebase, the contracts, and the IP chain

If you have 60 to 90 days before a Series A conversation and a dev partner wrote most of your product, you are not being graded on code quality. You are being graded on three artifacts: a standalone IP assignment deed signed under Section 19 of India's Copyright Act, a git commit history that proves your vendor — not an unnamed subcontractor in another city — actually wrote the code, and milestone acceptance records that establish a clean chain of delivery. Miss any of these and the deal gets delayed, repriced, or killed. For roughly 30% of early-stage Indian startups, technical due diligence is where the deal breaks, and 29% of Series A processes uncover IP assignment gaps that nobody saw coming.

This is the interview prep. Fourteen questions to put to your dev partner now, before the data room opens, while contracts can still be amended and signatures can still be collected without panic. For each question: why it matters, what a good answer sounds like, what a red-flag answer sounds like.

Why this conversation is different from the one you had before you signed

When you first hired a dev partner, you were optimising for speed and fit. Now you are optimising for a stranger's lawyer reading your contracts at 11pm and deciding whether to recommend a 20% haircut. The Pine Labs v. Gemalto judgment is the single most important precedent to understand here: the Delhi High Court held that an IP assignment clause buried inside a Master Services Agreement caused copyright to revert to the developer after five years under Section 19(5) of the Copyright Act. Translation: your MSA's "all IP shall vest in the client" paragraph is legally fragile on its own. You need a separate, standalone assignment deed.

Second thing to internalise: India has no general work-for-hire doctrine for software. Section 17(b) of the Copyright Act grants commissioner-ownership only for photographs, paintings, portraits, engravings, and films — not code. If a freelancer or contractor wrote any part of your product, they own that copyright by default until a written Section 19 assignment transfers it. Paying the invoice is not enough. This is the single most common gap investor counsel finds in Indian startup codebases.

Now, the questions.

The 14 questions, grouped by what they surface

IP chain of title (questions 1–5)

1. "Do you have a standalone IP Assignment Deed for our project, separate from the MSA, executed under Section 19 of the Copyright Act?"

Why it matters: As Pine Labs v. Gemalto established, IP clauses inside an MSA can revert under Section 19(5). A standalone deed, properly stamped and signed, is what investor counsel wants to see in the data room.

Good answer: "Yes. We execute a separate deed of assignment for every client engagement at kickoff and again at each major milestone. We can send you the signed PDFs today."

Red flag: "The MSA covers all IP, that's standard." Or: "We'll do it before you close." The second is survivable if you move fast. The first means they do not know the law.

2. "Is the assignment a present-tense grant (hereby assigns) or a future promise (shall assign)?"

Why it matters: "Shall assign" is a promise, not a transfer. Investor counsel will flag it. Only "hereby assigns" effects a present conveyance of rights.

Good answer: They know the difference and the deed uses present-tense language.

Red flag: Blank stare, or "it's the same thing in practice." It is not.

3. "Has every individual developer who touched our codebase — including subcontractors, interns, and moonlighters — signed an employee or contractor IP assignment flowing their rights to your company?"

Why it matters: Your vendor can only assign to you what they themselves own. If a subcontractor wrote the payments module and never signed an assignment to the vendor, the vendor cannot pass that copyright to you. This is where the chain breaks for most Indian startups.

Good answer: "Every engineer signs an IP assignment on day one as part of onboarding. We can provide a list of every contributor with their signed assignment on file."

Red flag: "We use some freelancers from Upwork for frontend work" — followed by vagueness on paperwork.

4. "Will you give us a written list of every third-party contributor to our codebase, with their country of residence and the date their assignment was signed?"

Why it matters: This is exactly what an investor's lawyer will ask you to produce. Rehearse getting it now. Cross-border contributors add complexity around FEMA reporting and withholding.

Good answer: A spreadsheet arrives within a week.

Red flag: "That's confidential" or "we don't track that at the individual level."

5. "Are there any open-source libraries in our code under copyleft licences — GPL, AGPL, LGPL — and can you give me the full SBOM?"

Why it matters: AGPL contamination in a SaaS product can force disclosure of your proprietary code. Investor technical due diligence runs licence scans. You want to find this before they do.

Good answer: They send you a Software Bill of Materials generated by a tool like Syft, FOSSA, or Snyk, and flag any copyleft dependencies with their justification.

Red flag: "We only use MIT and Apache stuff" said from memory, with no scan to back it.

The git history and the "who actually wrote this" problem (questions 6–8)

6. "Will you transfer the full git repository with complete commit history — not a squashed snapshot — into an organisation account we own?"

Why it matters: Commit history is the single best evidence of authorship. Investors' technical reviewers will look at commit authors, timestamps, and patterns to verify the vendor actually built what they claim.

Good answer: "Your GitHub or GitLab org owns the repo from day one. We are added as collaborators. You can revoke access any time."

Red flag: "We'll hand over a zip file at project end." A zip file with no history is a diligence problem on its own.

7. "Do commit author names match the signed-assignment list from question 3?"

Why it matters: If commits are from dev-anon-04@gmail.com and that person is not on the assignment list, you have a chain-of-title gap visible to any auditor with 10 minutes and git log.

Good answer: Every commit author is a named employee with an assignment on file.

Red flag: Generic Gmail committers, or a suspicious clustering of commits from an account that was "the PM pushing on behalf of the team."

8. "Is the source code mirrored to a third-party escrow, and can we release it on specific trigger events?"

Why it matters: Source code escrow — through NIXI, NCode, or an international provider like Iron Mountain — is cheap and increasingly expected by sophisticated Indian VCs. It protects you if the vendor goes under mid-engagement.

Good answer: "Not currently, but we can set one up in two weeks. Here are the providers we have worked with."

Red flag: "You already have the repo, you don't need escrow." This misses the point — escrow is also about continuity of documentation, build scripts, and deployment credentials.

Milestone acceptance and the IT Act, 2000 (questions 9–11)

9. "Do we have signed milestone acceptance records — not just paid invoices — for every deliverable to date?"

Why it matters: Under the Information Technology Act, 2000, electronic records with proper attribution carry evidentiary weight. A signed acceptance email or deed per milestone establishes what was delivered, when, and that you accepted it. This is the chain investors want to see.

Good answer: A folder of signed acceptance notes, one per sprint or milestone, each referencing the specific scope.

Red flag: "The invoice being paid means acceptance." It does not, legally.

10. "Can you reconstruct the scope-change history — who requested which change, when, and what the cost and timeline impact was?"

Why it matters: Investors ask about scope creep and whether delays were vendor-caused or founder-caused. A clean change log protects both sides.

Good answer: A change register in Notion, Jira, or a shared sheet, updated per change.

Red flag: Verbal history only, or a defensive "why are you asking this now?"

11. "Does our contract comply with Section 65B of the Indian Evidence Act for admissibility of electronic records, and are design documents, API specs, and architecture diagrams versioned and dated?"

Why it matters: If a dispute ever arises, you want your electronic records to be admissible without a fight. Versioned, timestamped docs in a system of record do that work.

Good answer: Yes, docs live in a versioned system (Notion with history, Confluence, Git) and the contract references the IT Act.

Red flag: Design docs in someone's personal Google Drive.

Security, data, and compliance (questions 12–14)

12. "What is our data-processing arrangement under the DPDP Act, 2023, and are you acting as a data processor or a data fiduciary?"

Why it matters: India's Digital Personal Data Protection Act makes the roles consequential. Your DPDP posture is a diligence line item now, not an afterthought. A qualified lawyer should review the specifics of your arrangement — this is one of those areas where a generic template will not hold up.

Good answer: They can articulate the roles, point to a Data Processing Agreement, and describe their security controls.

Red flag: "DPDP doesn't really apply to us yet."

13. "Can you produce the production access list — who on your team has prod credentials, what rotation policy applies, and when was the last rotation?"

Why it matters: Technical due diligence reviewers ask this verbatim. Over-broad vendor access to production is a common finding.

Good answer: A short named list, documented rotation cadence, secrets in a vault like AWS Secrets Manager or HashiCorp Vault.

Red flag: "The whole team has the .env file."

14. "If we parted ways tomorrow, what is the exit and transition plan — specifically, how long until a new team can build and deploy without you?"

Why it matters: Investors ask about key-person and vendor-concentration risk. 43% of outsourcing disputes trace to missing or incomplete contract clauses, and exit provisions are the most commonly missing. You want a documented runbook, not a hostage situation.

Good answer: "We have a transition playbook. Typically 2–4 weeks of parallel running with your new team, full documentation handover, no additional fees beyond time and materials."

Red flag: Hesitation, or a contract clause requiring 90-day notice and a transition fee you did not know about.

What to do with the answers

Score each answer green, yellow, red. Any red on questions 1, 3, 6, or 9 is a stop-everything-and-fix-this-week problem. Yellows on the rest you can usually remediate inside the 60–90 day window — most commonly by executing a confirmatory IP assignment deed covering all prior work, collecting backdated contributor assignments where possible, and reconstructing acceptance records from email trails.

A well-organised data room can cut the typical 4–8 week Indian Series A diligence timeline by several weeks. That time compression is your single biggest leverage point with an investor who has three other deals on their desk.

On the cost and effort of fixing this before the term sheet

The remediation cost is driven by four things: how many individual contributors need to sign confirmatory assignments, whether any of them are ex-employees or ex-contractors who have since left and are hard to reach, whether a lawyer needs to draft a bespoke deed or can adapt a template, and how much acceptance-record reconstruction is required from email and Slack history. Founders who kept clean records pay a legal review fee and little else. Founders who did not can face several weeks of chasing signatures across three time zones.

The two or three specifics that would turn this into a real quote from any law firm or diligence advisor: the total number of code contributors in the project's lifetime, the number still reachable, and whether your existing MSA has a present-tense assignment clause to build on. Get those three numbers before you brief anyone.

How CodeNicely can help

When we built GimBooks — a YC-backed fintech SaaS for Indian SMBs — IP chain-of-title and audit-ready documentation were non-negotiable from day one, because the founders knew institutional investors and eventual acquirers would scrutinise both. Every contributor had a signed assignment on file, the repo lived in the client's GitHub org from the first commit, and milestone acceptance was documented per sprint. That discipline is the same discipline that survives Series A technical due diligence.

If you are a seed-stage founder who inherited a different situation from a prior vendor, we also do remediation engagements: codebase audit, SBOM generation, confirmatory assignment drafting support (we work with your counsel, we do not replace them), git history review, and a data-room-ready documentation pack. See our full offerings or the startups segment page for how we structure engagements around fundraising milestones.

The bottom line

You will not lose your Series A on code quality. You will lose it — or lose 15–25% of your valuation to a repricing — on a missing signature, an unassigned contractor, or a zip-file handover from a vendor who did not understand Section 19 of the Copyright Act. The 14 questions above take an afternoon to ask. The remediation takes two to six weeks. The alternative takes a quarter of your company.

Frequently Asked Questions

Is my MSA's IP ownership clause enough on its own?

Likely not, if you are preparing for Series A in India. The Delhi High Court's Pine Labs v. Gemalto decision held that IP clauses inside an MSA can revert to the developer after five years under Section 19(5) of the Copyright Act. Investor counsel knows this precedent. A separate, standalone IP assignment deed executed at project kickoff and at major milestones is the standard remediation. Your corporate lawyer should draft or review the actual document.

What if some of our code was written by freelancers my vendor subcontracted to?

Then your vendor can only pass to you what the freelancer passed to them. Under Section 17 of the Copyright Act, a freelancer retains copyright by default — the vendor paying the freelancer does not transfer ownership without a written Section 19 assignment. Ask your vendor for the signed assignments from every subcontractor. If any are missing, confirmatory deeds can usually be collected, but the sooner you start the better.

How long does Series A technical due diligence typically take in India?

Four to eight weeks from data room opening is the commonly cited range, though a well-organised data room can compress this meaningfully. The variables are the completeness of your IP chain, the quality of your technical documentation, how quickly your dev partner responds to the diligence team's queries, and how many findings require remediation mid-process. Starting the clean-up 60–90 days before the data room opens is the single highest-leverage thing a founder can do.

What does it cost to remediate IP and documentation gaps before diligence?

The main drivers are the number of contributors needing confirmatory assignments, how many are reachable, whether the existing contract has usable foundations to build on, and how much acceptance-record reconstruction is required. Founders with clean records pay mostly for legal review. Founders with scattered contractor histories across years pay for coordination time on top. To get a real quote from counsel or a diligence advisor, you need three numbers first: total lifetime contributors, how many are still reachable, and the state of your existing assignment language.

Do I need source code escrow if I already own the GitHub repo?

Escrow is not primarily about the code — it is about continuity of the build environment, deployment scripts, infrastructure credentials, and documentation if the vendor disappears. Sophisticated Indian VCs increasingly expect to see an escrow arrangement for material vendor relationships. It is cheap to set up with providers like NIXI or Iron Mountain and signals operational maturity in the data room.