ERP contract checklist: code ownership, licence, AMC and your data
Before a custom ERP is built, settle in writing who owns the code, what the licence covers and for how long, what the annual maintenance contract includes and costs, how changes are priced, how fast support answers, and how your data comes out at any time. Both ownership models are fair if they are stated.
Pujan Motiwala · Statutory rules checked against the official texts on
Two ownership models, both fair if stated
Custom software in India is sold in one of two ways, and buyers often don't find out which until they try to leave.
| You own the code | The vendor licenses it | |
|---|---|---|
| What you pay for | The build, and the code is handed over | A working system and a licence to use it |
| After the build | You can take it to any developer | The licence runs with the maintenance contract |
| Usually costs | More up front, plus whoever maintains it | Less up front, plus the annual contract |
| Risk to watch | Code nobody else can maintain without documentation | Losing the licence if the contract ends |
Neither is wrong. What is wrong is not knowing which one you signed.
Clauses to settle before the build
- Ownership. Who owns the source code and the software. If it's licensed, what the licence covers and for how long. (requirement)
- Your data. That you can export all your business data, in standard formats, at any time, including at the end. Data you can't take out ties you tighter than any clause. (requirement)
- Pricing. Fixed price per phase, quoted before each phase starts, or time and materials, with a cap. (requirement)
- Changes. How a change is written down, priced and agreed before it is built. (requirement)
- The maintenance contract. What it covers (licence, hosting, fixes, small changes), what it costs per year, and what is quoted separately. (requirement)
- Support. Response time in writing, and documentation that lets another developer take the system over. (requirement)
- Hosting and storage. Who pays for the server and the storage, and whether storage costs are passed on at the provider's price.
- Personal data. If the vendor processes personal data on your behalf (staff, customers, contacts), the Digital Personal Data Protection Act, 2023 requires a valid contract for that: section 8(2). Name the vendor's duties for safeguards and breach intimation in it.
How Ahrom Labs does it
Stated plainly, as on the engagement page:
- Ahrom Labs owns the code. You get a working system and a licence to use it for as long as the annual maintenance contract runs; the source code stays with Ahrom Labs. If the contract stops, the licence ends with it.
- Your data is yours and can be exported at any time.
- Fixed price per phase, after a short fixed-fee modeling phase; a change is priced and agreed before it is built.
- The AMC is 15–21% of the project value per year, covering the licence, the server, fixes and small changes; a new module is its own phase.
- Support requests are answered within 48 hours at most, and every system ships with a system document any developer or agent can pick it up from.
If you need to own the code outright, say so before the build; it changes the price and the hand-over, and it is better settled first than discovered later.
Quoted from the official text (1)
“A Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract”
Digital Personal Data Protection Act, 2023, section 8(2)
Answer five questions about your business and get the requirements that apply to it, ready to send to vendors.
Most lines here can be tried today on a live system: manufacturing · trading · interiors · how Ahrom Labs builds them
Official sources
- Companies (Accounts) Amendment Rules, 2021 (G.S.R. 205(E), 24 March 2021). Ministry of Corporate Affairs, Gazette of India, October 25, 2026.
- Companies (Accounts) Second Amendment Rules, 2022 (G.S.R. 235(E), 31 March 2022). Ministry of Corporate Affairs, Gazette of India, October 25, 2026.
- Notification No. 10/2023–Central Tax (10 May 2023), amending Notification No. 13/2020–Central Tax. Central Board of Indirect Taxes and Customs (copy hosted by the GST Council), October 25, 2026.
- Advisory: Time limit for reporting e-invoice on the IRP portal, lowering of threshold to AATO 10 crores and above (5 Nov 2024). GSTN (Goods and Services Tax Network), October 25, 2026.
- Notification No. 12/2018–Central Tax (7 March 2018), substituting rule 138 of the CGST Rules, 2017. Central Board of Indirect Taxes and Customs (copy hosted by the GST Council), October 25, 2026.
- Micro, Small and Medium Enterprises Development Act, 2006, sections 15 and 16. Gazette of India (copy hosted by the Ministry of MSME), October 25, 2026.
- Income-tax Act, 2025 (30 of 2025), in force from 1 April 2026. Ministry of Law and Justice, Gazette of India, October 25, 2026.
- Digital Personal Data Protection Act, 2023, section 8. Ministry of Law and Justice, Gazette of India, October 25, 2026.
- Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025). Ministry of Electronics and Information Technology, Gazette of India, October 25, 2026.
What this page is not
A guide written by Ahrom Labs from the systems it runs; not legal or tax advice. Statutory lines quote the official text, and the text governs wherever this page differs from it; how a rule applies to your business is a question for your CA. Last updated .
Talk to us about your systems.
Tell us what's held together with workarounds right now. We reply to every message ourselves.