Should I use a lawyer?

For a small project, a clear written quote and agreement may be enough. For anything large, or a system that will hold sensitive customer data, a short review by a Malaysian lawyer usually costs far less than a dispute. This guide is general information, not legal advice.

Is it a bad sign if the vendor keeps the source code?

No. Subscription software works this way, and so do some custom builds. What matters is that you know which arrangement you are in, that it is written down, and that you can take your data with you.

What should the vendor ask me?

How your team works today, what goes wrong, who will use the system, what data you have and how tidy it is, and which date matters to you. A vendor who asks nothing before quoting is guessing.

Questions to ask before you sign with a software developer

Get the answers into the agreement

Anything said in a meeting is easy to forget and hard to prove. Ask the vendor to put the answers into the quote or the agreement, and read it before you pay anything.

These questions suit any vendor: a freelancer, an agency, a software company or a subscription product. They are not legal advice. If the contract is large, or the system will hold sensitive customer data, have a Malaysian lawyer read it.

Scope, price and payment

What exactly will I receive? Ask for a list of things the system does, not a headline. Then ask what is not included.
Is the price fixed, or by the hour? A fixed price for a defined scope is easier to plan. Hourly work is fine for changes, but ask for an estimate and a cap.
What do I pay, and when? Tie each payment to something you can check, such as the system going live.
What counts as a change, and what does it cost? Ask for the day or hourly rate, and how long a quote for a change takes.
What is not in the price? Hosting, WhatsApp and call charges, app store accounts, training and any tax that applies.
What happens to my deposit if I cancel? Get the answer for before and after work has started.

Time and the people doing the work

What date, and what does it depend on from me? Delays often come from the customer's side: data not ready, questions not answered.
Who will actually write and test the software? Staff, freelancers, or another company? If it is one person, ask who else could take over.
Can I speak to a customer with a similar system? A vendor with happy customers can usually arrange it.
Is there a written spec stage before the build? If not, how will we agree what done means?

Who owns the code and the data

This is the question that matters most on the day you want to change vendor, and the one most people skip. There are two separate things to ask about.

The code

Source code is the written instructions the software runs on. Ask who owns it and what you are allowed to do with it. There are three common arrangements, and none is wrong if it is what you agreed.

Arrangement	What it means for you	What to ask
You own the code	You can take it to another developer and change it freely.	Do I receive the full source code, and the instructions to run it, on delivery?
The vendor owns it and you use it	Like a subscription: you use the system while you pay, and the vendor maintains it.	What happens to my access and my data if I stop paying, or you close?
A copy is held by a third party	The code is deposited with a neutral party (escrow) and released to you under conditions in the agreement.	What triggers the release, and who pays the third party?

The law has default rules about who owns software written for a client, and an agreement can change them. An assignment or licence of copyright only counts if it is in writing. What the agreement says is what counts, so ask a Malaysian lawyer to read the ownership clause on anything large.

Your data

Your data is the leads, customer details, notes and history you put in. It is your business's, whatever the answer on code. Ask three things:

Can I export all of it, in a format I can open, whenever I want?
Does an export cost anything, and how long does it take?
When I leave, is my data deleted, how long does that take, and will you confirm it in writing?

Then look at the accounts around the system. The figure below lists the ones to check.

Your customer data
Can I export all of it, in a file I can open?
In your name
Source code
Who owns it, and what am I allowed to do with it?
Agree and write down
Hosting and cloud account
Whose account holds the server, and what is the plan if we part?
Agree and write down
Domain name
Who is the registered owner?
In your name
WhatsApp Business account and number
Is it registered to my company?
In your name
App store accounts
Is the app published under my company's developer account?
In your name

What to check on each part of the system. The vendor may legitimately host some of these, as long as the arrangement is written down.

Security and your customers' personal data

If the system holds your customers' names, phone numbers, IC details or credit reports, the vendor is handling personal data on your behalf. Under the 2024 amendments to the PDPA, which came into force in stages during 2025, a company that processes personal data for you is directly subject to the law's security principle, under a provision that took effect on 1 April 2025. Your own duty as the data controller stays too, so ask what the vendor does about it. Our guide on the 2024 PDPA amendment explains the change.

Where is the data stored? Ask for the country and the hosting provider.
Who at the vendor can see it, and is access logged?
Are there backups, how often, and has a restore ever been tested? A backup nobody has restored is a hope, not a backup.
How are passwords protected, and can I require a second step at login?
Which other companies handle my data on your behalf?
If something goes wrong, how and how fast will you tell me? Ask for it in writing.
When a member of my staff leaves, how do I cut their access straight away?

After you go live

What is free after go-live, and for how long? Ask what counts as a bug and what counts as a new request.
What does support cost, and what response do you commit to? Get the hours and the reply time on paper, not a promise in conversation.
Is the system documented? If your main contact leaves, someone else should be able to pick it up.
How do updates and security fixes reach me, and who pays for them?
How do I end the arrangement? Ask about notice, what you get on the way out and how long you have to collect it.

Warning signs

None of these proves bad faith, but each deserves a straight answer in writing before you pay.

Pressure to sign or pay today.
No willingness to put the scope in writing.
A vague answer on who owns the code or the data.
No way to export your data, or an export that costs extra and takes weeks.
A request for the full price before you have seen any work.
One person who knows the whole system, and no documentation.
A price far below the others, with no explanation of what is left out.

If you are still deciding between buying and building, see how much a custom CRM costs and build or buy. A one-page spec makes every answer above easier to compare.

Questions people ask next

Should I use a lawyer?: For a small project, a clear written quote and agreement may be enough. For anything large, or a system that will hold sensitive customer data, a short review by a Malaysian lawyer usually costs far less than a dispute. This guide is general information, not legal advice.
Is it a bad sign if the vendor keeps the source code?: No. Subscription software works this way, and so do some custom builds. What matters is that you know which arrangement you are in, that it is written down, and that you can take your data with you.
What should the vendor ask me?: How your team works today, what goes wrong, who will use the system, what data you have and how tidy it is, and which date matters to you. A vendor who asks nothing before quoting is guessing.

Sources

This guide is general information, not legal, tax or financial advice. Rules and bank policies change, so check the current position with the bank, the regulator or a professional before you act.