Transfer the repository
Otherwise the client is renting.
Who holds the repository
If the answer is your developer, you do not own your system — you rent it.
How we work
Transfer the code, phase the work
A surprising number of businesses discover, at the worst possible moment, that the firm which built their system holds the only copy of the source. Changing supplier then means rebuilding from nothing, which is exactly the leverage that arrangement was designed to create. Transferring the repository on payment removes it entirely.
Phasing does the same thing for risk. A project scoped as one twelve-month build fails as one twelve-month failure, whereas phases that each deliver something usable mean a client can stop after any of them and still be better off. It also forces honest conversations earlier.
The last thing worth refusing is the compliance claim. Software can be built to specified controls, and no developer can certify a client as HIPAA or PCI compliant — that requires an assessor and it remains the client's obligation. Selling it as a feature sounds reassuring and leaves the client exposed.
Our principles
Three beliefs behind the method
Phase it
Each phase useful on its own.
No compliance certification
We build controls, not certificates.
Got a process that is breaking?
A free scoping call, and an honest buy-versus-build answer.