Under US copyright law, software is not one of the nine kinds of commissioned work that can be a "work made for hire". The definition in 17 U.S.C. § 101 covers things like contributions to a collective work, translations, tests and atlases, and even those only when both parties sign a written agreement saying so. Code an outside company writes for you therefore belongs to that company until a contract assigns it to you. Founders usually learn this when they raise money or change supplier.
That is one of several risks that sit outside the demo a SaaS MVP development company shows you. This guide covers how a good company cuts scope, which stack to accept, how pricing moves risk, what the contract must say about code and data, and ten questions that separate a careful partner from a fast one. The numbers come from Y Combinator, GOV.UK, Stack Overflow, Google's DORA research, OWASP and the legal texts.
What the company does, and what stays with you
A SaaS MVP development company should take an agreed problem to a deployed application that users can pay for. It should not take the founder's decisions, and it should never hold the assets that let you leave.
| Work or asset | Development company | Founder |
|---|---|---|
| Problem, users, pricing hypothesis | Challenges it, writes it down | Owns it |
| Scope and the cut list | Proposes and defends cuts | Signs off each cut |
| Product design and flows | Owns it, or builds from yours | Reviews weekly |
| Architecture, data model, tenancy | Owns it, documents it | Approves the written record |
| Code, tests, deployment pipeline | Writes it | Owns the repository from day one |
| Hosting, database, payments, email accounts | Configures them | Holds the billing and admin login |
| Security testing and access control | Owns it, shows evidence | Asks for the evidence |
A partner that builds in its own GitHub organisation, Vercel team and Stripe account is not necessarily dishonest. It is convenient for them. It also means that on the day you change supplier, they hold every key.
Scope: how a good company shrinks your MVP before pricing it
The fastest way to judge a SaaS MVP development company is to watch what it does with your feature list. A weak partner prices all of it. A good one argues with it.
The timebox. Michael Seibel's Startup School talk, published by Y Combinator in 2019, says most founders should build a lean MVP "in weeks, not months". His method is to timebox the spec: decide you will launch in three weeks, and anything that cannot be built in three weeks leaves the list. He adds that founders who never write the spec down watch a three-week plan become a three-month one.
The 60% ceiling. The Agile Business Consortium's MoSCoW guidance says Must Haves should typically take no more than 60% of the effort, with around 20% held as Could Haves that can be dropped if the deadline is at risk. A quote where every feature is a Must Have has no contingency, so either the partner has priced the risk in silently or the deadline will move.
Appetite instead of estimate. Basecamp's Shape Up calls the time you are willing to spend an appetite: an estimate starts with a design and ends with a number, an appetite starts with a number and ends with a design. Its standard cycle is six weeks for one designer and one or two programmers.
A paid discovery, kept short. The GOV.UK Service Manual puts a typical discovery at 4 to 8 weeks and says plainly that you should not start building the service in discovery. The rule transfers: a company that writes production code before it has written down the problem, the users and the cut list is guessing at your budget.
If you have not yet written the one page a partner needs, our MVP Spec Template walks through the twelve fields that move a quote. This guide assumes you have it.
Stack: accept boring choices you can hire for later
Most founders cannot evaluate a stack, so use one test: if this company disappeared tomorrow, could you hire someone to carry on within a month?
The Stack Overflow 2025 Developer Survey found PostgreSQL used by 55.6% of all respondents and 58.2% of professional developers, more than any other database. React was used by 44.7% and Next.js by 20.8%. A proposal built on those has a large pool of developers who can read it. An in-house framework, or a no-code backend only the partner knows, ties you to them.
Our bias, stated. We build applications in Next.js, so read the paragraph above as coming from a company that benefits from it. Our recommended layers and their free-tier limits are in The MVP Tech Stack We Recommend in 2026, and the database trade-offs are in Supabase vs Firebase for a B2B SaaS MVP. Neither is repeated here.
Free tiers are not production tiers. Vercel's pricing page says its Hobby plan "is for personal, non-commercial use", and Pro starts at $20 a month per developer seat. Supabase's says free projects are paused after one week of inactivity, and Pro starts at $25 a month. A partner that launches a paying product on either free tier is saving you $45 a month and handing you an outage.
Multi-tenancy is decided early. A tenant column on every table, row-level security in the database or a schema per customer: the choice is made in week one and is expensive to change in month nine.
Pricing models, and what location really changes
There are three ways a SaaS MVP development company can price the work. Each moves risk to a different side of the table.
| Model | How it works | Risk sits with | Watch for |
|---|---|---|---|
| Fixed price | One quote for a written scope | The company, until scope changes | Priced change requests; padding for unknowns |
| Time and materials | Billed on hours or days used | The founder | No ceiling unless you set one |
| Fixed time, variable scope | A set team for a set number of weeks | Shared: time is fixed, scope flexes | Needs a founder who cuts every week |
Source: our summary of common models; the fixed-time model follows Basecamp, Shape Up, 2019.
We quote per project, and we do not publish prices, because a two-role internal tool and a multi-tenant product with billing are different jobs. Published MVP cost ranges from agencies are collected, with their caveats, in MVP Development Statistics 2026.
Location changes the rate. As a proxy only, since salaries are not agency rates: the Stack Overflow 2025 survey puts the median US full-stack developer salary at $138,000 and the Indian one at $13,949, roughly a tenfold gap. Agency rates do not follow salaries in a straight line, and the cheapest quote is often the one with the most unpriced risk. Compare what is included (discovery, QA, security testing, handover) before you compare the number.
The 10 questions that reveal risk
We would ask these of any SaaS MVP development company, ourselves included. Right answers are specific; wrong ones are confident and vague.
| # | Question | A good answer sounds like | Red flag |
|---|---|---|---|
| 1 | What would you cut from this spec? | Three named features, with reasons | "We can build all of it" |
| 2 | Whose GitHub organisation, hosting and Stripe account do we build in? | Yours, from week one | "Ours, we transfer at the end" |
| 3 | Does the contract assign copyright in the code to us on payment? | Yes, covering code, designs and documents | "You own it" with no assignment clause |
| 4 | How do you keep one customer's data from another's? | The tenancy model and how it is tested | Talks about the login page |
| 5 | Which security standard do you test against? | OWASP Top 10:2025 or ASVS, with a report | "We follow best practices" |
| 6 | Who exactly works on this, and who replaces them if they leave? | Named people and a named backup | "Our team" |
| 7 | How do you use AI coding tools, and who reviews the output? | Allowed, with review and tests on every merge | Either "never" or "it writes most of it" |
| 8 | What does a change request cost, and who decides? | A written rate and a one-line approval process | "We are flexible" |
| 9 | What do we receive at handover? | Repository, pipeline, environments, data model, runbook | "The code" |
| 10 | Which shortcuts are you taking on purpose, and when do we pay them back? | A written list of deliberate debt | "There will not be any" |
Question ten comes from Martin Fowler's technical debt quadrant, published in 2009, which separates deliberate, prudent shortcuts taken to ship sooner from reckless or inadvertent ones. An MVP should carry the first kind.
Ownership, data and security: the clauses that matter after launch
Code ownership. As above, US law does not treat commissioned software as a work made for hire, so ownership moves only with a signed assignment. Do not assume your own jurisdiction defaults the other way; ask a lawyer to check the clause, and make the assignment take effect on each payment rather than on final delivery, so a dispute in month three does not leave you owning nothing.
Repository control. GitHub can transfer a repository with its issues, pull requests, wiki and commit history, and keeps redirects from the old address. It needs administrator access on the sending side and permission to create repositories on the receiving side. A reluctant supplier can stall on that, which is why question two asks for your organisation from the first commit.
Personal data. If your MVP stores personal data about people in the EU, the development company is likely a processor under Article 28 of the GDPR. That article requires a written contract that limits processing to your documented instructions, binds staff to confidentiality, requires your authorisation before sub-processors are added, and obliges the company to delete or return the data when the work ends. Ask for a data processing agreement alongside the development contract, not after launch.
Security evidence. OWASP's Top 10:2025 lists broken access control first, followed by security misconfiguration and software supply chain failures. For a multi-tenant product, access control is the one that turns a bug into a breach notice. OWASP's Application Security Verification Standard, version 5.0.0 published on 30 May 2025, is the longer checklist. Ask to see a test report from a past project.
AI-written code. Google's 2024 DORA report found that as AI adoption rose, delivery throughput fell by an estimated 1.5% and delivery stability by an estimated 7.2%, even though the same research linked higher adoption to better documentation and faster code review. The lesson is not to ban the tools but to ask what stops unreviewed generated code reaching production.
What this means for choosing a SaaS MVP development company
Shortlist three companies. Send each the same one-page spec and the ten questions, in writing, and score the answers rather than the portfolio. Weight four above the rest: the cut list, account ownership, the copyright assignment and the tenancy model. A company that dodges any of those will be expensive in month nine whatever its day rate.
Then run a short paid discovery with your first choice before you commit to the build. Two to four weeks should produce a written problem, a cut list, a data model and a fixed-time plan, and shows you how the team works. If the output is thin, you have lost weeks rather than months.
Our web apps service page explains how we scope an MVP and what the discovery covers.
