Your website's repository should be in your name from the first commit, not from the date of delivery. It resides in an organization owned by your company, with the studio included as a collaborator. On GitHub, this costs zero euros with the free plan. At Aura, we grant you the owner role before the first line of code is written.
The repository is not a deliverable: it is the place where work happens
A Git repository is the complete history of your website. Every change, who made it, when, and against which bug. It is not a compressed folder that appears on the final day.
When an agency sends you a ZIP file with "the code" on the eve of launch, they are handing you a photograph. The repository is the film. The photograph does not contain the reasoning behind any decisions, the CI/CD pipeline, the list of environment variables, the branch from which production is deployed, or the exact commit that broke the contact form in March.
The difference becomes apparent the day something goes wrong and you no longer work with those who built it. With a repository, the next team reads the history and continues. Without a repository, they start with archaeology.
The industry standard: The code is delivered at the end, when the project is paid for, in a ZIP file or via FTP. The history remains in the agency's account and disappears with them.
Our criteria: The repository is opened in your account before the first commit. The studio joins as a collaborator and leaves when finished. The history stays where it always was: with you.
What Spanish law says: having the code is not the same as owning it
There is a confusion here that costs money. Technical access and legal ownership are two different things, and you need both.
Many people believe that by paying for development, the rights automatically pass to the payer. That is only true for in-house employees, not for an external studio.
A studio or a freelancer invoicing you for a website is not your salaried employee. It is a service contract. Article 97.4 does not apply to you. What applies is the general regime of assignment, and that regime reads the opposite of what people assume: what is not written is not assigned.
And Article 45 concludes: "All assignments must be formalized in writing". An invoice that says "web design and development" is not an assignment. It is an invoice.
There is a third detail that almost no one tells you. Article 100.1 allows the legitimate user to reproduce or transform the program, including error correction, when necessary to use it for its intended purpose. But it starts with "unless otherwise contractually provided." That is to say: a contract can prohibit you from touching your own code. It happens. Read it before signing.
Operational translation: repository access gives you the capacity, and the assignment clause gives you the right. Asking for only one of the two is only doing half the job.
| What you ask for | What it gives you | What it does not give you |
|---|---|---|
| Repository access | History, code, ability to continue with another team | Ownership of the rights |
| Written assignment clause | Exploitation rights for the agreed time and territory | The code in hand if no one delivers it to you |
| Both, from day one | Real continuity without needing anyone's permission | — |
The four excuses of the industry, disarmed
"The repository is our internal methodology." Your project's repository contains your project. The studio's internal templates and libraries live in their own repositories, not yours. Separating the two is a quick task, not an obstacle.
"We will give you everything at the end, don't worry." At the end is when the client has the least leverage and when disagreements become the most expensive. Access that only exists if the relationship ends well is not access: it is a promise.
"You wouldn't know what to do with it." Perhaps not today. The repository is not requested to be used today; it is requested so that someone else can use it tomorrow without asking us for permission.
"Our workflow doesn't allow it." A workflow that requires the client not to see the work is not a workflow. It is a power play.
Our repository policy, published
We are writing it here so you can demand it from anyone, including us.
- The organization is yours. It is created in your company's name, with your corporate email, within the Trazar movement, before the first commit.
- You are the owner. We are collaborators. Not the other way around. The owner role is not transferred at the end: it starts with you.
- Everything lives inside. Website code, infrastructure as code, deployment configuration, documentation content, and the sample environment variable file. Real credentials are never in the repository; they go into a secret manager to which you also have access.
- Commits are readable. Messages in complete sentences, named branches, and a description of why each relevant change was made. The history is documentation, not noise.
- Deployment is described in the repository itself. A file explains how it is built and published. If we disappear tomorrow, your team can get the project running by reading that file.
- In the handover, we leave; you don't. When closing the Lanzar y acompañar movement, we revoke our access if you ask us to. The repository does not move because it was never ours.
- The assignment is in writing. The contract names the code, source files, design, and documentation, with explicit temporal and territorial scope. Without that, Article 43.2 decides for you.
- The repository organization is in your company's name, not the provider's
- Your email appears with an owner role, not a reader role
- The contract specifies in writing what is assigned, for how long, and for what territory
- There is no clause prohibiting you from modifying the code or hiring another team
- There is a deployment file and an example of environment variables within the repository
- Production credentials are in a secret manager you have access to
What it costs to give you this access: nothing
This is the uncomfortable part for the industry. The reason for not giving it to you is not economic.
If your team needs branch rules, multiple reviewers, or code owners, the step up is to GitHub Team, $4 per user/month, according to the GitHub pricing page consulted on 08-27-2026. GitLab maintains a Free plan with 400 minutes of compute per month and Premium at $29 per user/month.
Be mindful of a Spanish detail: these rates are billed in dollars and from outside Spain, so your accounting must consider the reverse charge mechanism and the 349 form. It is not a hidden cost, but it is paperwork that is worth anticipating.
GitHub and GitLab prices verified on 08-27-2026 on their official pages. Platform rates change without notice: check the figure before putting it into a budget.
Reasoned estimate on the other side of the balance: recovering a project without a repository requires downloading production, rebuilding the environment blindly, and verifying that nothing was left out. At €60/hour, the standard rate for a Spanish studio of this size, 20 hours of archaeology is €1,200 plus VAT. It is an estimate, not a measurement: the real cost depends on how messy the server is.
How it fits into the movements
| # | Phase | What we do | Deliverables |
|---|---|---|---|
| 03 | Trazar | We open the repository in your name before the first commit, not after the last. | Organization created · Roles assigned · Signed assignment contract |
| 06 | Lanzar y acompañar | The handover removes our access, not yours. | Documentation in the repository · 30 days of support · Revocation of permissions upon request |
In the handover, we don't deliver the repository: we leave it.
Q | What if I don't have a technical team to understand the repository? A | It doesn't matter: the repository is opened for the person who comes after, not for you today. We leave the deployment file and documentation inside, and if you don't know how to read it, we will explain it to you in the handover call at no additional cost.
Q | Can I ask for access in the middle of a project if I have already signed without it? A | Yes, and no law prevents it, but your negotiating position is worse than before signing. Ask for it in writing, offer to assume the cost of the platform plan, and accept that the studio keeps its internal libraries outside your repository.
Q | If I have the repository, am I now the owner of the code? A | No. Access is technical and ownership is legal: you need a written assignment clause because Article 45 of the LPI requires written form and Article 43.2 limits to five years whatever is not agreed upon. Having the code without the assignment lets you use it, not exploit it with security.
Q | Can the studio forbid me from modifying my own code? A | They can try. Article 100.1 of the LPI allows the legitimate user to correct errors, but it opens with "unless otherwise contractually provided," so a contract can restrict it. If you see that clause, ask for it to be removed before signing.
Q | Does Aura keep a copy after the handover? A | We keep a copy only for the 30 days of support after launch, to be able to help you if something fails. After that period, we delete it if you ask us to in writing.
Repository access is not a favor that a studio does for a generous client. It is the minimum condition for a project to stay alive when we are no longer there.
Take the contract you have on your desk, whether it is ours or another provider's, and look for three lines: who is listed as the owner of the repository organization, what is assigned in writing and for what term, and if there is any clause that prohibits you from touching the code. If any of the three are missing, send us that paragraph by email and we will tell you what to ask for to correct it. We respond in less than 24 working hours.
Internal links
- How to hire a web design and development studio in Spain
- Who owns my website's code? Intellectual property and work-for-hire in Spain
- 18 questions to ask an agency before signing
- Contract and rights assignment template
- SaaS tools billed in dollars: Intracommunity VAT and form 349
Pending metrics
- [] — kept untouched, it is not about price
Verified sources
- https://www.boe.es/buscar/doc.php?id=BOE-A-1996-8930 — Royal Legislative Decree 1/1996, consolidated text of the Intellectual Property Law: legal basis for the entire article (arts. 43, 45, 97, 100)
- https://www.iberley.es/legislacion/articulo-97-ley-propiedad-intelectual — literal text of art. 97.4: rights to a program created by a salaried employee belong to the employer unless otherwise agreed (key to the contrast between employee vs. external studio)
- https://www.iberley.es/legislacion/articulo-43-ley-propiedad-intelectual — art. 43.1 and 43.2: assignment limited to what is agreed; without express term, five years; without express territory, country of assignment
- https://www.iberley.es/legislacion/articulo-45-ley-propiedad-intelectual — art. 45: all assignments must be formalized in writing, with the right of resolution if the assignee fails to comply
- https://www.iberley.es/legislacion/articulo-100-ley-propiedad-intelectual — art. 100.1: the legitimate user may reproduce or transform the program, including error correction, unless otherwise contractually provided
- https://docs.github.com/en/get-started/learning-about-github/githubs-plans — GitHub Free: unlimited private repositories, unlimited collaborators, and 2,000 Action minutes per month
- https://github.com/pricing — GitHub Team at $4/user/month and Enterprise from $21/user/month
- https://about.gitlab.com/pricing/ — GitLab Free (400 compute minutes/month) and Premium at $29/user/month
Keep reading
Related guides
Bespoke web, template, no-code, or AI: what you're actually getting
What you get with each option: code, portability, and exit costs. Including the fine print for Wix, Squarespace, and Webflow, and the Spanish Intellectual Property Law.
11 September 2026 · 24 min
How to audit a web budget: 14 red flags
Fourteen checks for auditing a web budget in Spain: VAT, copyright transfer, performance thresholds, and 36-month real costs.
11 September 2026 · 14 min
Downloadable EAA Checklist 2026: 72 real checks
72 checks to verify if your website complies with the EAA in Spain: scope of Law 11/2023, WCAG 2.2 level A and AA criteria, evidence requirements, and downloadable CSV.
11 September 2026 · 22 min