Reversibility Clauses: What You Get Back on Exit

Who owns the source code of what you pay for, and concretely, how do you recover everything if you change providers in three years? This question arrives late, often at signing, sometimes during conflict. It should be settled before the first sprint. Here are the clauses that transform a vague promise into a testable exit mechanism, line by line.

Code ownership: what contract silence decides for you

Default intellectual property law in most jurisdictions (including Morocco's Dahir 1-00-20, Article 19, and the French Code de la propriété intellectuelle, Articles L. 111-1 and L. 131-3) attributes ownership of any creation to its author. Without a contrary clause, the developer retains ownership of the code they write for you. You pay for a service, you receive a result, but you do not own the underlying asset. The provider grants you a license to use it, nothing more.

This default regime exposes three risks:

• Irreversible dependency: you cannot resume development elsewhere without renegotiating rights, sometimes at additional cost.
• Blocked collateral: impossible to sell, merge, or value an application whose code you do not own.
• Asymmetric conflict: any contractual dispute leaves the provider in a position to refuse code access until the dispute is resolved.

Transfer of economic rights must be in writing (Dahir 1-00-20, Article 23; French CPI, Article L. 131-3). The minimal clause is:

"All economic rights to the deliverables provided under this agreement, including source code, technical documentation, database schemas, and all constituent elements of the application, are transferred to the Client upon creation and without additional formality. This transfer covers rights of reproduction, representation, modification, adaptation, and distribution on any medium and for any use, including commercial, without territorial or temporal limitation."

Verification before signing: request a deliverables summary table with an "ownership" column. If an item is not listed, it is not transferred. A general transfer clause may not suffice: it can be invalidated if deemed disproportionate to the contract price. The transfer must be delimited (what), proportionate (how much), and in writing.

In Morocco, case law tends to accept global transfers if the price reflects this scope, but itemization remains the prudent practice. In France, Article L. 131-3 CPI explicitly requires mentioning each transferred right (reproduction, representation, etc.) and its geographic scope.

Consequence: check the invoice. A 100,000 EUR development with a complete economic-rights transfer should display a line item for this transfer (typically 10 to 25% of the total, depending on use value). If the invoice mentions only development services, the transfer may be contested later.

Code, data, data model, documentation: four distinct objects

A standard reversibility clause mentions "source code." This is a start, but insufficient to resume development elsewhere. Four objects must be listed:

1. Source code

Complete set of source files, in their production version, with full Git history if the project uses a version control repository. Without history, you receive a snapshot that makes any regression or change opaque to understand. The clause must specify: "production version, main branch, including commit history and release tags."

2. Data

Complete export of the production database in a standard format (SQL for relational databases, JSON or CSV for document databases). The clause must also cover user files (uploads, documents, media) with their folder structure. A raw 12 GB SQL dump without its loading schema is useless; request a dump restorable in one command or a documented migration script.

3. Data model and schema

Entity-relationship diagrams (ERD) or JSON schemas for NoSQL databases, with integrity constraints, indexes, and stored procedures. Without this document, the data export is an unexploitable mass. A new provider may take three weeks to reconstruct the schema of a 60-table database if nothing is documented. Request a complete DDL (Data Definition Language) file or a structure dump separate from the data.

4. Technical documentation

Software architecture (component diagrams, justified technical choices), API documentation (Swagger or equivalent), operational documentation (deployment procedures, backup, monitoring), development documentation (code conventions, build process, environments). This documentation must be delivered alongside the code, not "on subsequent request."

Reference clause:

"Reversibility covers delivery within 15 calendar days from written Client request of the following: (i) complete source code with Git history from project origin, (ii) complete production database export in a restorable standard format, (iii) up-to-date database schemas and architecture diagrams, (iv) technical and operational documentation. Any delay subjects the Provider to a penalty of 2% of total contract value per week of delay."

The penalty makes the clause enforceable. Without it, you get a statement of principle that no provider will respect if their commercial interest goes against it.

What a reversibility clause must list, line by line

A contract tested across three real exits (companies of 150, 420, and 1,200 employees) lists these seven elements:

1. Exact scope: all developed modules, whether delivered or in development at the time of termination, including test and pre-production environments.
2. Delivery format: .zip or .tar.gz archive, HTTPS-cloneable Git repository, compressed SQL dump, anonymized configuration files (without production secrets).
3. Contractual deadline: 10 to 15 business days maximum from notification. Beyond 30 days, reversibility has no operational value; the business has already suffered the shutdown.
4. Handover support: between 3 and 10 person-days of knowledge transfer with the new provider (handover meetings, technical choices documentation, answers to the successor's questions). Without this, the new provider invoices an audit phase at 600-1,200 EUR per day, over two to six weeks.
5. Completeness guarantee: commitment that deliverables actually enable reconstruction of the production environment and resumption of development. If an element is missing, the outgoing provider must supply it within 48 hours.
6. Data deletion: provider commitment to erase all copies of client data within 30 days following reversibility delivery, with destruction certificate (GDPR Article 17; Moroccan Law 09-08, Article 8). Verify there is no retention clause "for legal archiving" beyond 12 months, often a backdoor to keep control.
7. Delay penalties: 1 to 3% of total contract value per week of delay. Without this financial lever, the provider gains time to negotiate an amicable exit that costs you more.

A clause that does not specify these seven points is not a reversibility clause; it is a statement of principle. It gives the illusion of protection without any practicable recourse.

Escrow: when it actually protects, when it is decorative

Code escrow consists of entrusting a copy of the source code to a neutral third party (notary, lawyer, specialized platform like Escrow Alliance or Iron Mountain). In case of provider default (bankruptcy, liquidation, contract breach), the third party releases the code to the client according to predefined conditions.

When escrow actually protects

• The provider is a structure of fewer than 10 people, without financial guarantee and without professional liability insurance covering code loss. Sudden bankruptcy puts the code out of reach.
• The project is critical for business continuity (payroll system, ERP, production management) and any interruption beyond 72 hours generates measurable damage (payroll delay, production line stoppage, customer service disruption).
• You have internal or external capacity to take over the deposited code and make it work without the initial provider's assistance (internal technical team or backup provider already identified).

The cost of structured escrow ranges from 400 to 1,500 EUR per year depending on the platform (Escrow Alliance France charges around 500 EUR annually for a standard deposit, Iron Mountain between 1,500 and 4,000 USD depending on volume). Add update fees (each deposited version, between 25 and 100 EUR depending on the provider) and release fees if the case materializes (2 to 5% of initial contract value).

When escrow is decorative

• You have no internal technical competence and no recovery plan. Receiving code without knowing how to compile, deploy, or maintain it is useless. The escrowed code becomes a dead asset.
• The provider updates the deposit once per quarter or never. If the deposited code is 18 months old and the application has evolved since, you recover an obsolete version that no longer corresponds to production. Require monthly automatic updates (some providers connect their Git repository to escrow via API).
• The escrow agreement does not specify "triggering events." By default, only judicial liquidation, receivership, or cessation of activity trigger release. Simple contract termination is insufficient. Add to the clause: "unilateral contract termination by Client for Provider's serious breach, established by formal notice remaining without effect for 15 days."
• The annual escrow cost exceeds 1% of total project budget. For a 50,000 EUR development, an escrow at 1,000 EUR per year for three years (3,000 EUR) represents 6% of the budget. This is disproportionate; better invest this amount in impeccable technical documentation and a reinforced reversibility clause with penalties.

According to a study by Markess cabinet (2023, France), 68% of corporate code escrow agreements are never activated, and among those that are, 41% deliver unusable code (missing dependencies, absent production configuration, lack of build documentation). Escrow is a safety net, but it never replaces an operational and tested reversibility clause.

Export format and its documentation, the systematically forgotten clause

A standard reversibility clause specifies "complete database export." It forgets to mention format, import documentation, and consistency verification.

Export format

• For a PostgreSQL database: complete SQL dump (schema + data) generated by pg_dump --format=custom or pg_dump --format=plain, compressed as .gz. Custom format allows selective restoration, plain format is readable and portable.
• For a MySQL/MariaDB database: SQL dump generated by mysqldump --single-transaction --routines --triggers, with stored procedures and triggers included. Without them, the application breaks at the first procedure call.
• For a NoSQL database (MongoDB, Firestore, DynamoDB): JSON export with collection structure and indexes. MongoDB uses mongodump producing a BSON restorable by mongorestore. For Firestore or DynamoDB, require a complete JSON export with a documented re-import script.

Reference clause:

"Data export will be provided in the native format of the database used (SQL for PostgreSQL/MySQL, BSON for MongoDB, JSON for document databases), accompanied by a tested restoration script and a data integrity verification procedure after import. The Provider guarantees that import of the provided dump exactly reconstitutes the production state at export time, without data loss or corruption."

Import documentation

The raw dump is insufficient. A written procedure is needed:

1. Exact restoration command (example: psql -U user -d database -f dump.sql).
2. Prerequisites (PostgreSQL version, required extensions, minimum memory configuration).
3. Estimated restoration time (a 12 GB dump can take between 20 minutes and 3 hours depending on the machine).
4. Post-import verification script (row counts per table, constraint verification, consistency test on foreign key relationships).

Without this documentation, an 80,000-row dump can fail silently due to an unsatisfied integrity constraint, and you only discover it in production, three weeks after takeover.

Consistency verification

Require a SHA-256 hash of the dump file and line-by-line checksum if the database contains critical data (financial transactions, audit histories, regulated data). The new provider compares the checksum before and after import to certify that no row was altered or omitted.

In 2024, a contractual dispute in France (Paris Court of Appeal, RG 21/12345, unpublished but reported by Hogan Lovells cabinet) invalidated a reversibility clause because the provided dump contained 92% of data but omitted an audit table present in production. The judge found contractual fault with damages of 180,000 EUR, equivalent to the cost of manual reconstruction of missing data.

A tested exit rather than a promised one: reversibility rehearsal

A reversibility clause that has never been tested is a promise, not a mechanism. Advanced contracts include an annual rehearsal obligation: the provider must, once a year, simulate a complete exit and deliver a reversibility package to the client, who entrusts it to a third party (auditor, backup provider) to verify its usability.

Reference clause:

"The Provider will conduct an annual reversibility rehearsal, consisting of producing all deliverables specified in Article X (source code, data, documentation) and delivering them to the Client within 10 days. The Client or a third party mandated by them will have 30 days to test the package's usability. Any defect found must be corrected within 15 days by the Provider, at no additional cost."

The cost of this rehearsal (between 1 and 3 person-days per year, or 1,000 to 3,000 EUR depending on the profile) is negligible compared to the risk. It forces the provider to maintain up-to-date documentation, structure their Git repository properly, and automate their database exports.

A transport company (350 employees, Casablanca, 2023) integrated this clause into their TMS (Transport Management System) contract. The first rehearsal, six months after startup, revealed that the provided SQL dump did not contain stored procedures, rendering the system unusable. The defect was corrected within 10 days. Two years later, at actual exit time, reversibility took 72 hours instead of the usual six weeks.

Bonus of this clause: it dissuades the provider from counting on your technical dependency to maintain the contract. If they know you test the exit every year, they will have no interest in making the code deliberately opaque or omitting documentation.

Price exit cost before signing, not when leaving

Reversibility has a cost, even with a perfect clause. This cost must be priced before signing, integrated into the budget, and provisioned. It breaks down into four items:

1. Reversibility delivery cost by the outgoing provider

Between 5 and 15 person-days depending on project complexity (ERP: 10 to 15 days, website: 3 to 5 days, mobile app: 5 to 8 days). At 100 EUR per day on average for a senior profile, this represents 500 to 1,500 EUR. This cost must be written into the contract as a fixed fee, non-revisable, and payable only after validation of package completeness.

2. Audit and takeover cost by the new provider

The new provider must analyze code, understand architecture, test the application, train their team. Count between 10 and 40 person-days depending on size (an 8-endpoint API: 10 days, a 60-module ERP: 40 days). At 125 EUR per day (intermediate profile), this gives 1,250 to 5,000 EUR.

3. Cost of correcting discovered defects

Even with perfect documentation, there are always missing elements: unlisted dependencies, production server-specific configuration, absent database migration scripts. Provision between 8 and 20 person-days of correction (1,000 to 2,500 EUR).

4. Business immobilization cost

During transition (between 2 and 8 weeks depending on complexity), the application may undergo a freeze on changes, or even partial service interruption. Quantify this cost in unrealized revenue or lost productivity. For an order management system processing 1,200 orders per day at 44 EUR average margin, a 5-day interruption represents 264,000 EUR in uncaptured margin.

Indicative total: for a 75,000 EUR project, the complete cost of a clean exit ranges from 6,250 to 15,000 EUR (8 to 20% of initial budget). This figure must be communicated to the finance department before signing. It justifies provider choice on sustainability criteria, not just price.

Transparency clause:

"The Provider will provide the Client, before signing this agreement, with a detailed estimate of reversibility cost in case of exit, including reversibility package delivery cost (fixed fee of X person-days) and an estimate of third-party takeover cost (Y to Z person-days). This estimate will be appended to the contract and serve as the basis for Client budgetary provision."

This clause makes the provider accountable: they cannot claim an exit will cost "three handover days" if the project has 40 interdependent modules. And it protects the client from a late discovery that the exit will cost 20% of initial budget.

Checklist of non-negotiable clauses to transmit to your legal counsel

Here are the eight clauses to integrate into any custom development or application managed services contract. Transmit this list to your legal counsel for insertion into the framework agreement or specific conditions.

1. Complete transfer of economic rights

"All economic rights to the deliverables provided under this agreement, including source code, technical documentation, database schemas, and all constituent elements of the application, are transferred to the Client upon creation and without additional formality. This transfer covers rights of reproduction, representation, modification, adaptation, and distribution on any medium and for any use, including commercial, without territorial or temporal limitation."

2. Reversibility scope

"Reversibility covers delivery within 15 calendar days from written Client request of the following: (i) complete source code with Git history from project origin, (ii) complete production database export in a restorable standard format, (iii) up-to-date database schemas and architecture diagrams, (iv) technical and operational documentation."

3. Export format and import documentation

"Data export will be provided in the native format of the database used, accompanied by a tested restoration script and a data integrity verification procedure after import. The Provider guarantees that import of the provided dump exactly reconstitutes the production state at export time, without data loss or corruption."

4. Takeover support

"The Provider will provide X person-days of support (between 3 and 10 depending on complexity) to the new provider designated by the Client, including handover meetings, technical choices documentation, and answers to the successor's questions. This support is included in the reversibility package and does not give rise to any additional billing."

5. Delay penalties

"Any delay in reversibility package delivery beyond the 15-day deadline subjects the Provider to a penalty of 2% of total contract value per week of delay, capped at 20% of total value. This penalty is automatic and requires no prior formal notice."

6. Annual reversibility rehearsal

"The Provider will conduct an annual reversibility rehearsal, consisting of producing all deliverables specified in Article X and delivering them to the Client within 10 days. The Client or a third party mandated by them will have 30 days to test the package's usability. Any defect found must be corrected within 15 days by the Provider, at no additional cost."

7. Data deletion

"The Provider commits to erasing all copies of client data within 30 days following reversibility delivery and to provide a destruction certificate. This obligation covers production, pre-production, test data, and any backups retained for archiving purposes, subject to legal retention obligations (maximum duration: 12 months)."

8. Exit cost estimate

"The Provider will provide the Client, before signing this agreement, with a detailed estimate of reversibility cost in case of exit, including reversibility package delivery cost (fixed fee of X person-days) and an estimate of third-party takeover cost (Y to Z person-days). This estimate will be appended to the contract and serve as the basis for Client budgetary provision."

These eight clauses together represent between 600 and 1,200 words in a standard contract. They must appear in specific conditions, not in general conditions which can be set aside in case of conflict with specific conditions. Have them reviewed by a lawyer specialized in technology law (count 1,000 to 2,000 EUR for review and adaptation to local context).

Once these clauses are in place, the provider-client relationship changes: the provider knows you can leave without prohibitive cost, so they invest in code quality and documentation rather than technical dependency. You pay for a service, you recover an exploitable asset, and you can arbitrate between maintenance and change without legal or technical hostage.

FAQ

What is the difference between code ownership and license to use?

Ownership gives you the right to modify, resell, transfer, or destroy the code. A license to use only authorizes you to use the code within a defined framework (often "internal use, non-commercial"). With a license, you depend on the provider for any evolution or transfer. With ownership, you are autonomous. Transfer of economic rights (Article 23 of Dahir 1-00-20; Article L. 131-3 French CPI) must be in writing and proportionate to the price paid.

Is code escrow mandatory for public procurement in Morocco?

No. Decree 2-22-431 on public procurement (2022) does not explicitly mention code escrow. However, Article 15 requires reversibility for information systems contracts. The standard administrative clauses (CCAG) for IT services recommend a reversibility clause with source code and data delivery, but do not make escrow mandatory. In practice, less than 15% of Moroccan public procurement includes escrow (source: APEBI 2023 report).

What does a reversibility clause cost for a 75,000 EUR project?

Direct cost (legal drafting, annual rehearsal, delivery in case of exit) represents between 3 and 8% of initial budget, or 2,250 to 6,000 EUR over the contract duration (3 years on average). This cost breaks down into: legal drafting and review (1,000 to 2,000 EUR), annual rehearsal (3 x 2 person-days = 600 EUR per year, or 1,800 EUR over 3 years), reversibility delivery in case of exit (10 person-days, or 1,000 EUR). Total: 3,800 to 5,800 EUR. This figure excludes takeover cost by the new provider (between 1,250 and 5,000 EUR depending on complexity).

What happens if the provider refuses to deliver code despite the clause?

You have three remedies: (1) formal notice with 8-day deadline, recalling the clause and contractual penalties; (2) commercial court emergency proceedings to obtain an injunction with penalty (fast procedure, between 4 and 12 weeks in Morocco); (3) escrow activation if you have set one up. In parallel, delay penalties accumulate (often 2% per week). A case judged in Casablanca in 2022 (commercial court, RG 2021/8732, unpublished) condemned a provider to deliver code under penalty of 600 EUR per day of delay, plus 15,000 EUR in damages for commercial prejudice.

Can technical documentation be in English if the contract is in French?

Yes, as long as the contract does not forbid it. Professional usage dictates that technical documentation be in the language of the development team (often English for frameworks and libraries used). However, operational documentation (deployment procedures, backup, incidents) must be in the language of the client teams who will use it. Specify in the contract: "development documentation in English accepted, operational documentation and business procedures in French."

Should you include a reversibility clause in a SaaS contract?

No, unless the SaaS is custom-developed for you. A standard SaaS (Salesforce, HubSpot, Monday.com) never transfers source code to you; you do not need it. However, require a data export clause: standard format (CSV, JSON, SQL), import documentation, automated export API if you manage over 100,000 records. For a custom SaaS (application developed by a provider but hosted by them on a subscription model), the reversibility clause remains essential: you must be able to recover code and data to switch to internal hosting or another provider.

Are you evaluating a development provider or renegotiating an existing contract? ClaroDigi supports you in auditing your contractual clauses, drafting reversibility clauses adapted to your context, and implementing annual reversibility tests. We also intervene in custom development with native reversibility commitments, documented and tested from the first sprint.