Subcontractors, NDAs, and non-solicits: vetting a dev agency’s team
You have no contract with your agency’s subcontractors. Story.law covers the 2026 flow-down, confidentiality, and classification terms every founder should require before a line of code is written.
When you hire a development agency, you sign a contract with that agency. The people who actually build your product may be employees of the agency, subcontractors the agency brings in project by project, or individual developers you engage directly on the side. In every one of those scenarios, the legal gap between your agreement and the people doing the work creates real exposure. Your confidential information can reach someone who never signed an NDA with you. Your IP assignment clause can stop at the agency's door while the person who wrote the code walks away with rights you never knew were in play. Your key developer can be pulled to another project without notice. And a developer you manage day-to-day can be reclassified as your employee by a state agency regardless of what your contract says.
This guide walks you through the structural problem of subcontractor accountability, the flow-down and confidentiality terms you need in your agency agreement, key person and non-solicit protections, and the classification rules that apply when you engage developers directly. Story.law works with founders and growth-stage companies across the United States to get these agreements right before the risk surfaces.
The Structural Problem: You Have No Contract with the People Doing the Work
The most important thing to understand before you sign with a development agency is that the agency's subcontractors are strangers to your agreement. Your NDA binds the agency. Your IP assignment clause binds the agency. Your confidentiality obligations bind the agency. None of those provisions automatically reach the individual developer three steps down the chain who has access to your codebase, your product roadmap, and your customer data.
In commercial contracting, the primary service provider is ultimately responsible for deliverables under the client service agreement, but subcontractors may be used for specific portions of the work. If the agency has not required its subcontractors to operate under the same terms it owes you, that gap becomes your problem the moment something goes wrong. A subcontractor who discloses your architecture to a competitor has not breached any agreement with you directly. A subcontractor whose work product assignment was never obtained leaves you without clean title to code you paid for. The only way to close this gap is to make the agency contractually responsible for it.
The solution is not to negotiate directly with every subcontractor. It is to require the agency to be completely responsible for the acts of anyone it engages on your project, and to flow down the specific protections that matter to you. Story.law helps founders identify where those gaps exist in agency paper before signature and what language is needed to close them.
Why Subcontractor Flow-Down Terms Matter in 2026
Flow-down provisions require obligations from your primary contract to be incorporated into every agreement the agency has with lower-tier subcontractors or suppliers. Key requirements such as confidentiality, IP assignment, compliance with law, and performance standards are passed down the contractual chain to ensure consistency and enforceability throughout all levels of the project. The core function of those provisions is to ensure that all parties involved are bound by the same critical obligations, reducing the risk of non-compliance and protecting your interests as the original contracting party.
For tech startups in 2026, this matters more than ever. Your product's IP is its most fundable asset. Investors scrutinize the chain of title before releasing capital. If the company cannot prove a clean assignment of its core technology, the financing can halt or collapse. Former-contractor claims to code are among the most common findings that produce material purchase price adjustments in acquisitions. Gaps that go unexamined early do not disappear. They surface at exactly the wrong moment: during a financing round, a sale process, or a dispute with the agency.
A startup that pulled in contractors in year one without proper IP assignment language can find itself in a position where it does not actually own the code it sells. Requiring flow-down terms in your agency agreement is not bureaucracy. It is the foundation of what you are building.
Common Risks in Agency Engagements and How to Address Them Contractually
Before reviewing specific clause language, it helps to name the risks that agency subcontracting creates. Each one points to a specific contractual requirement.
The Key Risks Founders Face
Confidentiality leakage through subcontractors: The agency shares your codebase, technical specs, or business data with a developer who has signed nothing with you. If that developer misuses the information, your only claim is against the agency, and only if the agency's own agreement with that developer required confidentiality.
IP ownership gaps: Paying for work and owning it are not the same thing. The default rules often favor the creator. Without a written assignment that flows from the subcontractor through the agency to you, the individual who wrote material portions of your product may retain copyright. That gap becomes expensive when an acquirer or investor runs diligence.
Loss of key personnel without notice: You chose the agency partly because of the team members you met during the pitch. Nothing in a standard agency agreement prevents the agency from reassigning those people to other clients the day after your contract is signed.
Unvetted subcontractors introduced mid-project: The agency may add subcontractors during the engagement without your knowledge. If a new subcontractor causes a security incident or data breach, the absence of prior vetting and documentation creates compounding liability questions.
Direct hire of the agency's developers: Agency agreements frequently include non-solicitation clauses that prevent you from hiring the developers who worked on your project. You need to understand exactly what those clauses say and whether you can negotiate around them.
Each of these risks has a contractual response. The agency is the chokepoint. Everything has to reach subcontractors through the agency, which means your leverage is in the agreement you sign with the agency before work begins.
What to Require in Your Agency Agreement
Before you sign any development agency agreement, review it clause by clause against the protections described below. Some of these are standard practice. Others are asks that the agency may resist. This section distinguishes between what the law generally requires and what you should push for in negotiation.
Must-Have Contract Provisions
Complete flow-down of confidentiality and IP assignment
Require the agency to represent that every subcontractor it engages on your project is bound by confidentiality and IP assignment obligations at least as protective as those the agency owes you. This is not optional. Without it, your agreement stops at the agency's door. You should have the right to approve the form of confidentiality and assignment agreements between the agency and its subcontractors, or to provide your own form for execution by those subcontractors. Upon request, the agency should provide copies of all executed agreements.
Full responsibility for subcontractor acts
The agency should be explicitly responsible for the acts and omissions of any party it engages on your project, including protection of your confidential information, compliance with applicable law, and any breach caused by a subcontractor. Do not accept language that limits the agency's liability to its own direct acts. If a subcontractor causes harm, the agency should be on the hook for it.
Prior written approval for subcontractor use (negotiation ask)
As a negotiation ask, require that the agency obtain your prior written approval before engaging any subcontractor on your project. This gives you the ability to vet the people involved and to ensure that appropriate agreements are in place before access is granted. Agencies will push back on this as an operational burden, but it is a reasonable ask for any project involving sensitive data, proprietary code, or critical infrastructure.
Key person clause
If specific individuals are material to why you hired the agency, name them. A key person clause requires the agency to obtain your written consent before reassigning or removing those individuals from your project. The agency selected you as a client based on its team, and you selected the agency for the same reason. A clause that locks in named key persons ensures continuity through the engagement. The agency may resist or ask for a reasonable replacement process, which is negotiable.
Non-solicitation protections in both directions
Agency agreements almost always include a clause preventing you from soliciting or hiring the agency's team members. Read it carefully. Understand the scope, the duration, and whether it covers subcontractors as well as employees. Then negotiate the reciprocal protection you need: the agency should not be permitted to solicit your employees, contractors, or key personnel during the engagement and for a defined period afterward. 12 months is a common and reasonable restriction period. Note that several states, including California, have made non-solicitation clauses substantially more difficult to enforce against individuals, so the clause's value depends heavily on where the relevant parties are located.
Representations about subcontractor classification
Require the agency to represent that all individuals engaged on your project are properly classified under applicable federal and state law. This matters because misclassification exposure can travel up the chain in certain fact patterns, particularly when you have any direct supervisory relationship with the individuals doing the work.
The Clause-by-Clause Reference Table
| Clause | What It Does | Default in Agency Paper | Your Ask |
|---|---|---|---|
| Subcontractor flow-down | Extends your NDA and IP assignment to subcontractors | Often absent | Required; must be explicit |
| Agency full responsibility | Holds agency liable for all subcontractor acts | Often limited to agency's direct acts | Required; broaden explicitly |
| Subcontractor approval rights | Gives you veto over who is engaged | Rarely included | Negotiation ask |
| Key person clause | Locks named individuals to your project | Rarely included | Negotiation ask; accept replacement process |
| Non-solicit (agency to you) | Protects your team from agency poaching | Absent from most agency forms | Negotiation ask |
| Non-solicit (you to agency) | Restricts your ability to hire agency team | Almost always present | Narrow scope; confirm state law limits |
| Classification representations | Agency warrants proper worker classification | Rarely included | Negotiation ask; important if you supervise |
| IP assignment (direct and flowed-down) | Ensures you own all work product | Present in better agency forms; may not flow down | Require explicit flow-down to subcontractors |
Are the Developers You Hire Directly Contractors or Employees?
When you engage a developer directly rather than through an agency, a different set of questions takes over. Both sides often want contractor status. The developer wants the flexibility and the ability to work for multiple clients. You want to avoid payroll taxes, benefits obligations, and the permanence of an employment relationship. The problem is that in many states, especially California, the parties' preference does not control.
For 2026, the IRS continues to apply the common-law control test to determine a worker's status, and that test looks at what actually happens in the relationship, not what the contract says. Courts and government agencies look at the substance of the relationship, not the label. A written independent contractor agreement is relevant but not dispositive. Misclassifying an employee as a contractor is one of the top IRS and DOL enforcement priorities for 2026.
The IRS Common-Law Test
The IRS common-law test examines three categories of control. Behavioral control asks who directs how the work gets done: what tools to use, what order to perform tasks, what training is required. Financial control asks who controls the business aspects of the role, including how the worker is paid, whether expenses are reimbursed, and whether the worker can make a profit or suffer a loss. The type of relationship category looks at written contracts, the permanence of the arrangement, and whether the worker receives benefits. No single factor decides. The IRS weighs all factors together in a totality-of-the-circumstances analysis.
For an independent contractor, you control only the final result, not the methods used to achieve it. Even if you do not actively supervise the worker, having the right to control how the work is performed is a strong indicator of employee status.
The ABC Test in California and Other States
Many states use a stricter framework called the ABC test. Under the ABC test, a worker is presumed to be an employee unless the hiring entity proves all three prongs: (A) the worker is free from the control and direction of the hiring entity in connection with the performance of the work, both under the contract and in fact; (B) the work is performed outside the usual course of the hiring entity's business; and (C) the worker is customarily engaged in an independently established trade, occupation, or business. Failure on any single prong means the worker is an employee.
Prong B is the hardest to satisfy, and it is where the majority of misclassification assessments are built. The logic is straightforward: if the work you are hiring someone to do is the same work your business exists to do, that person is almost certainly an employee. A software developer contracted to a software firm is a textbook example of Prong B failure. A company could satisfy the IRS test while failing the ABC test, meaning workers may be treated as contractors for federal tax purposes but as employees under California law. Passing the IRS test does not guarantee compliance with state labor law.
California has the most aggressive worker-classification enforcement regime in the United States. A finding of misclassification by the EDD can result in back payroll taxes for every quarter in the audit period, plus penalties and interest. Civil penalties under California Labor Code reach $5,000 to $25,000 per willful violation. Back wages, overtime, meal and rest break premiums, and benefits entitlements can go back four years. These proceedings are independent: an EDD audit does not preclude a Labor Commissioner claim, and a settlement with one agency does not bind another.
What You Should Represent and Require
When you engage a developer directly as a contractor, your agreement should include representations from the developer that they are free to perform services for multiple clients, operate through an independently established business, have their own tools and equipment, and set their own schedule and methods. Those representations do not guarantee contractor status under any test, but they are part of building a defensible position.
Engaging through an LLC provides some practical benefit. A developer who operates through a properly formed LLC, invoices your company, and maintains independent business activity is in a stronger position to sustain contractor classification than a developer who simply receives a 1099 with no independent business infrastructure. However, an EIN or LLC paperwork alone does not make someone a contractor. If the work falls under a law's definition of employment, the person is an employee regardless of the entity structure. Do not treat LLC interposition as a substitute for analyzing the actual relationship.
The Supervision Habits That Quietly Undermine Contractor Status
The most common way that contractor relationships slide toward employee territory is not through formal policy changes. It is through day-to-day supervision habits that accumulate over time without anyone noticing. Requiring the developer to attend daily standups, report hours, use company equipment, follow internal processes for code review and approval, or work exclusively on your product without serving other clients are all facts that weigh toward employee status under both the IRS common-law test and the ABC test.
Startups are among the highest-risk businesses for misclassification. Early-stage companies use contractors to reduce payroll costs, which makes short-term sense but creates long-term exposure. The longer core team members stay on contractor status while operating under employee-like conditions, the bigger the liability becomes as the company scales. Remote work does not reduce this risk. Location is irrelevant to the ABC test. A remote developer hired exclusively by one company, following its internal processes, is an employee under California law whether they are in Sacramento or Seoul.
Best Practices and Expert Tips for Vetting a Dev Agency's Team
Structuring your agency engagement and any direct developer relationships correctly requires discipline before the work begins. Story.law has distilled the following practical guidance from its work with founders and growth-stage companies navigating these issues.
Audit the agency agreement before signature, not after. Most founders sign agency agreements under time pressure and review them only when a problem arises. By then, the subcontractor flow-down you needed was never included, the key person clause was never negotiated, and the IP assignment stops at the agency's door. Review every clause against the framework in this guide before you sign.
Require signed flow-down agreements as a condition of project start. Do not allow the agency to begin work until it has provided evidence that every subcontractor engaged on your project has signed the required confidentiality and IP assignment agreements. Treat delivery of those documents as a contract milestone, not a courtesy.
Name your key persons in the statement of work. The statement of work is a document, not a handshake. If specific developers are material to why you hired the agency, list them by name and title in the statement of work and tie the key person clause to that list. Vague references to a team do not give you the protections you need.
Understand the non-solicit clause before you sign. The agency's non-solicit clause is in its agreement for a reason. Read it. Know whether it covers subcontractors as well as employees, how long it runs, and what conduct it restricts. If you have any intention of building an in-house team that overlaps with the agency's work, negotiate the scope before the relationship begins.
Audit your direct developer relationships for classification risk. If you engage developers directly as contractors, do an honest assessment of how those relationships actually operate. If a developer works exclusively for you, attends your internal meetings, uses your equipment, and follows your processes, you have a classification risk regardless of what the contract says. Seek counsel before the issue surfaces in an audit or a claim.
Engage through entity-to-entity structures where classification is a genuine concern. Where you need contractor flexibility but classification risk is elevated, requiring the developer to engage through a properly formed and independently operating LLC adds a factual layer of support for contractor status. It is not a guarantee, but it is a real differentiator in the facts-and-circumstances analysis that regulators and courts apply.
Build your IP chain of title from day one. Before your first fundraise or any exit process, investors and acquirers will ask to see a clean chain of title on your core technology. Collect signed IP assignments from every founder, employee, contractor, advisor, agency, and subcontractor who contributed to the product. Missing assignments are one of the most common diligence problems. The cost of fixing them during a live transaction is multiples of what it costs to do them right at the start.
Advantages and Benefits of Getting Agency and Developer Contracts Right
Structuring your agency engagement and developer relationships correctly from the start produces concrete advantages across the lifecycle of your company.
Clean IP chain of title: When your agency agreement requires full flow-down of IP assignment, every line of code your agency's subcontractors write is covered by an assignment that runs to you. That chain of title is what investors and acquirers examine during diligence. Gaps that look minor at the time they are created can reduce purchase prices or block transactions entirely.
Enforceable confidentiality protection: Flow-down confidentiality requirements mean that a subcontractor who discloses your information without authorization has breached an agreement that the agency is contractually responsible for. You have a claim, and the agency has one against the subcontractor. Without flow-down, you have a gap.
Predictability of team continuity: A key person clause means the people you chose are the people who build your product. Without it, the agency can reassign your key developer to a higher-margin client the week after your contract is signed, and your agreement gives you no recourse.
Reduced classification exposure: Properly structured direct developer engagements, with accurate representations, entity-to-entity contracting where appropriate, and supervision habits that preserve contractor independence, reduce your exposure to the back-wage, tax, and penalty consequences of misclassification. In California alone, those consequences can reach $25,000 per willful violation.
Investor and acquirer confidence: A data room that includes clean agency agreements, subcontractor flow-down documentation, and a complete IP assignment trail signals to investors and acquirers that your legal infrastructure is under control. That confidence has a direct effect on valuation, deal speed, and the terms you are able to negotiate.
Key Takeaways and How to Get Started
The structural problem in agency engagements is simple: you have a contract with the agency, not with the people who build your product. Closing that gap requires deliberate contractual language before the work begins. The agency must be completely responsible for the acts of every subcontractor it engages. Confidentiality and IP assignment must flow down to every individual with access to your project. Key persons should be named and protected. Non-solicitation obligations should run in both directions. And any developers you engage directly should be evaluated honestly against the IRS common-law test and, in states including California, the ABC test, regardless of what your contractor agreement says.
Classification is a facts-and-circumstances question. The parties' preference does not control. The supervision habits you develop over time, the exclusivity of the relationship, and whether the developer's work falls within the usual course of your business are the facts that matter. Getting these decisions right at the outset is substantially less expensive than fixing them during a transaction, an audit, or a claim.
Story.law works with founders and growing companies to structure these agreements correctly. Start with a free question on the Aegis platform, or contact Story LLP directly to generate the agency agreement or contractor engagement your company needs.
How Story.law Simplifies the Agency Vetting and Developer Classification Process
Story.law is built by an AI-enabled law firm that combines cutting-edge legal software with elite human expertise to deliver a full suite of legal services at affordable rates. For founders navigating agency agreements, developer classification, and IP chain-of-title questions, Story.law provides the legal infrastructure and expertise to get these decisions right at the beginning, not during a transaction or an audit.
Story LLP’s Aegis platform applies BigLaw-quality legal analysis to NDAs, vendor agreements, commercial contracts, and other documents, identifying risk, suggesting positions, and accelerating turnaround without sacrificing rigor. For classification and worker engagement questions, Story LLP’s state-licensed employment lawyers build state-specific processes and respond to disputes. For IP and commercial contracting, Story LLP’s attorneys include enterprise commercial contracting specialists and seasoned venture lawyers who have structured hundreds of financings and exits.
Story LLP’s Aegis Raise plan is built specifically for growth-stage companies preparing for diligence, automating the data room preparation process and surfacing the documentation gaps that matter to investors. Whether you are pre-seed and signing your first agency agreement, or Series A and preparing for your first institutional raise, Story.law and its attorneys provide the legal infrastructure to keep your developer relationships structured correctly and your company protected.
FAQs About Dev Agency Subcontractors, NDAs, and Developer Classification
Is my development agency responsible for its subcontractors?
The agency is responsible for subcontractors only to the extent your contract makes it so. In a standard commercial engagement, the primary service provider is ultimately responsible for deliverables under the client service agreement. However, without explicit language in your agency agreement, that responsibility may not extend to subcontractor acts that harm you, such as a confidentiality breach or failure to assign IP. Story.law recommends requiring the agency to take complete responsibility for anyone it engages, including protection of your confidential information and IP assignment obligations.
Do my agency’s subcontractors need to sign an NDA?
Yes. Your NDA with the agency does not automatically bind the agency’s subcontractors. For confidentiality protection to reach every individual with access to your project, the agency must require its subcontractors to sign confidentiality agreements at least as protective as those the agency owes you. Your agency agreement should give you the right to approve those agreements or provide your own form. Without this flow-down requirement, a subcontractor who discloses your information has not breached any agreement with you directly, leaving you without a direct claim.
Who owns the code written by a subcontractor?
Code ownership follows assignment, not payment. Without a written assignment that runs from the subcontractor through the agency to you, the individual who wrote the code may retain copyright. Your agency agreement’s IP assignment clause covers the agency’s direct work product. It does not automatically cover work created by subcontractors unless the agreement explicitly requires the agency to obtain and flow down assignment rights. Story.law builds explicit subcontractor IP flow-down into every agency agreement it drafts for founders.
What is a key person clause in a development agency agreement?
A key person clause identifies specific named individuals whose participation in your project is material to the agreement. It requires the agency to obtain your written consent before reassigning, removing, or substituting those individuals. Neither the agency nor a key person may delegate their responsibilities to another without your written consent. The clause can include a reasonable replacement process, negotiated in advance, to address situations where a key person becomes unavailable. Without a key person clause, the agency may reassign your most important developer at any time without notice or consequence.
Are the developers I hire directly contractors or employees?
The IRS common-law test examines behavioral control, financial control, and the type of relationship to determine worker status. For 2026, the IRS continues to apply that test based on how the relationship actually operates, not what the contract says. In many states, including California, the ABC test applies and presumes employee status unless the hiring entity proves all three prongs: the worker is free from control, the work is outside the usual course of the business, and the worker is independently established. A software developer contracted to a software firm routinely fails Prong B. Story.law advises founders to audit their direct developer relationships against the applicable test before an issue surfaces.
What are the risks of misclassifying a developer as a contractor?
Misclassification exposes you to back payroll taxes, penalties, and interest at the federal level, plus state-specific consequences that vary significantly. In California, civil penalties for willful misclassification reach $5,000 to $25,000 per violation. Back wages and benefits entitlements can go back four years. EDD, Labor Commissioner, and Franchise Tax Board proceedings are independent, meaning a settlement with one agency does not bind another. Classification is one of the top IRS and DOL enforcement priorities for 2026. Story.law helps founders structure developer engagements to reduce this exposure through properly documented contractor agreements, entity-to-entity structures where appropriate, and honest assessment of how the relationship actually operates.
Does engaging a developer through an LLC reduce classification risk?
Engaging through an LLC provides a factual layer of support for contractor status because it demonstrates an independently established business. However, an EIN or LLC paperwork alone does not make someone a contractor. Courts and agencies look at the substance of the relationship. A developer who operates exclusively for one company, follows that company’s internal processes, and has no other clients may still be classified as an employee regardless of LLC status. The Department of Labor has stated explicitly that business entity paperwork does not by itself establish independent contractor status. Story.law treats LLC interposition as one element of a broader classification strategy, not a standalone solution.
What should I look for in an agency agreement before signing?
Before signing any development agency agreement, confirm that it includes explicit flow-down of confidentiality and IP assignment to subcontractors, full agency responsibility for subcontractor acts, your right to approve the form of subcontractor agreements, a key person clause naming the specific individuals material to your project, and non-solicitation protections that run in both directions. Review the agency’s non-solicit clause carefully to understand its scope and duration. Consider whether the applicable state law limits enforceability. Story.law reviews agency agreements for founders and growth-stage companies through its Aegis platform and attorney network.
We're lawyers, remember? Please read this important note:
Story LLP is a law firm, and Story's lawyers built Aegis to deliver better, standard legal services at scale so founders can choose between top-tier specialized lawyers and standardized process automations that replicate those lawyers according to their needs and budget. By definition, a standardized process may not be perfect for you. Please review our Policies page to better understand the difference, as well as how we use AI and how we manage conflicts, privilege, etc.
As a law firm, we must screen clients for conflicts of interest, and we treat all correspondence with clients seeking legal advice as privileged and confidential to the maximum extent possible in consideration of any conflicts. However, Story's law firm or our Attorney Allies do not represent you or your company as your lawyer, do not have an attorney-client relationship with you or your company, and do not provide you with legal advice absent a formal Engagement Letter signed between you and the Story LLP law firm. Please don't confuse the free knowledge we offer on this site with legal advice for you.