As companies continue to rely more on cloud computing, issues like security and privacy still generate concern–although those concerns are easing, as both companies and commercial cloud vendors have made a great deal of progress in these areas over the past two years.

However, there is another area of governance and safekeeping on the horizon that many companies still haven’t adequately addressed: the ownership of applications that they originate or sponsor in the cloud.

SEE: IT leader’s guide to making DevOps work

The intellectual property rights to software that companies develop or sponsor in the cloud are becoming a larger issue, as technologies like DevOps drive a migration of onsite software development and testing activities to the cloud. The question companies must ultimately ask is this: Who owns the software?

Scenario #1

A large enterprise rents IaaS (infrastructure-as-a-service) from a commercial cloud provider and outsources all its application development and testing to this IaaS provider.

Does the company own the proprietary software it creates for its business? If the hosting environment is IaaS and the company is not interacting with the vendor in any way in the software development and testing process–and the agreement with the vendor clearly states that the IaaS resources of the client company are kept separate from that of other vendor customers–the answer is yes. In a sense, this mode of DevOps is no different from the company doing all DevOps in-house, within the confines of its own data center. There is strict separation of duties between the client and the vendor, with the vendor being walled off from all application work.

Scenario #2

A small to midsize company wants to improve its analytics capabilities for tracking logistics but lacks the internal expertise to develop appropriate analytics reports for management.

The company chooses a SaaS (software-as-a-service) vendor that offers not only technical IT and business expertise in logistics, but also a library of customizable best practice analytics reports and templates that the company can immediately adapt and start using for its own purposes. Does the company own he software it develops from the templates? In most cases, if you read the fine print of the SaaS vendor agreement, the answer is No. By using the templates (which likely have been contributed by other vendor clients) the company can leverage this existing expertise. Conversely, if the company develops its own custom reports, these products also become fair game for others to use and modify.

SEE: Quick glossary: Project management

Scenario #3

You want to use a certain cloud vendor’s platform but your aim is to develop a proprietary module of software that is unique to your business, that you own the rights to, and that will give you some kind of competitive advantage

Do you own the software, since you are using the client’s product architecture to construct it? This can be a negotiable issue–but what usually happens is that the vendor agrees to let you do or sponsor the work the vendor’s in-house staff does. You initially fund the development effort. When the product is ready, you deploy it for yourself and you have a commercial agreement with the vendor where you typically receive a percent of each sale to an outside party as part of a licensing agreement. The bottom line is that you own the software rights and can license and make money from it–but you do not own the software to the degree that you can prevent others from using it.

Taking a proactive approach

There are many reasons to keep software proprietary, and an equal number of valid reasons that encourage sharing. You can help this evaluation process by defining in advance of signing up with a cloud vendor just what kind of intellectual property protection it wants for the software it develops. This will determine whether you continue to develop software in-house or whether you look for a purely IaaS vendor that rents infrastructure and lays no claim to your application work–or whether you decide to build upon someone else’s platform and waive ultimate ownership of software you create.

In all cases, it makes sense to include a legal vetting process for the software you desire to build before you seek a cloud vendor. In this way, you already know going into the vendor evaluation process whether the application IP must stay within your company or whether you want to avail it to a larger audience.

More CXO resources