Protecting your source code and software

In France, software is protected by copyright, in the same way as a literary work (article L112-2 of the French Intellectual Property Code). No registration is required: protection arises from the creation itself, provided the software is original.

You still need to be able to prove what you wrote, and when. In a dispute, that is often where everything is decided.

What is protected, and what is not

Source code, object code (the compiled version, executable by the machine) and preparatory design material are protected: specifications, mock-ups, architecture diagrams, as long as they lead to the program.

Ideas, algorithms, functionalities and programming languages are not protected as such. The Court of Justice of the European Union confirmed this in 2012 (SAS Institute, C-406/10). Two programs can therefore perform the same function without one being an infringement (an unauthorized reproduction) of the other, as long as they do not reproduce its expression, that is, its concrete form such as the written code.

Originality is assessed in light of the author's choices. For software, courts ask the creator to demonstrate the intellectual path followed and the choices made among the possibilities. A record of your development process, version after version, then becomes especially valuable.

Who owns the rights?

Software created by an employee in the course of their duties, or following their employer's instructions, belongs to the employer (article L113-9 of the French Intellectual Property Code).

Software developed by a contractor or freelancer remains, in principle, the property of its author, unless there is a written assignment. That assignment must specify the rights assigned, their scope, purpose, duration and territory (article L131-3). A missing assignment is a frequent source of problems, especially during a fundraising round.

What about patents?

Computer programs "as such" are excluded from patentability (article L611-10). An invention implemented by software may nevertheless be patentable if it makes a technical contribution. In that case, keep your work confidential until filing: dating it is not disclosing it.

GitHub and Ipocamp: two complementary tools

GitHub, like any Git-based service, is first and foremost a working tool: it keeps every version of your code, who changed it, why, and how it was reviewed. It is the record of how your development progressed, which is exactly what courts ask you to demonstrate.

But GitHub was not designed to prove a date to a third party. A commit date is declared by the machine that records it and can be changed. History can be rewritten and pushed again. And what you keep there depends on your account and on the platform's rules.

Ipocamp answers the other half of the question. It sets a date that depends neither on you nor on your code platform, and gives you a certificate that a third party can verify, even if the GitHub repository has since disappeared.

In practice, the two work together: GitHub tells how the code was written, Ipocamp proves when each stage existed. For each released version, or at the end of each sprint, deposit an archive that includes the Git history: the certificate proves that this entire history existed no later than that date.

Dating each version with Ipocamp

Deposit an archive of your code, or of each delivered version: Ipocamp computes its file fingerprint, timestamps it and gives you a certificate. The fingerprint is computed at the time of deposit and the stored file is encrypted: your code stays confidential.

With the API, you can automate a certificate on every delivery, commit or end of sprint. You build a dated history of your development, effortlessly.

Always keep an exact copy of each archive you deposit: it is what will allow the certificate to be verified.

Other solutions exist

Specialized bodies, such as the French Agence pour la protection des programmes (APP), offer software deposits, and the INPI's Soleau envelope can also receive code. These solutions are less suited to frequently dating many versions.

This article is for general information purposes and does not replace the advice of a legal professional.

To go further: a scenario of copied code, with and without dated proof and our offer for startups.