Vendor Exit

Signs Your Software Agency is Holding Your Code Hostage

July 6, 20265 min read

It starts subtly. You request a feature update, and the agency tells you it will take weeks. You ask for a backup of the database, and they tell you it is complicated. You suggest hiring an internal developer, and they warn you that nobody else can understand the codebase.

Many companies discover too late that their development vendor has built a technical cage. This is 'vendor lock-in'—and in bad relationships, it functions as holding your product hostage.

In this article, we outline the warning signs of technical lock-in and explain how to audit your codebase to plan a clean, secure exit.

---

Warning Sign 1: Withheld Root Access

Do you have direct admin access to your AWS, GCP, or Azure accounts? Do you own the domain registration, DNS accounts, and database credentials?

  • The Hostage Sign: The agency hosts your application on their own agency cloud accounts. If you want to view log files or pull a database dump, you have to request it from them. If you cancel your contract, they can pull the plug, and your product disappears.

    • ---

    Warning Sign 2: Zero Documentation

    A production-ready codebase requires a readme file, API route documentation, configuration guidelines, and deployment instructions.

  • The Hostage Sign: The code is completely undocumented. There are no comments. Variables have cryptic names, and database tables have no relations diagram. The agency claims 'the code is self-documenting.' In reality, they are making it impossible for any other developer to read it, ensuring your ongoing dependency.

    • ---

    Warning Sign 3: Proprietary Frameworks

    A standard Next.js, Node, or Java application can be run on any server.

  • The Hostage Sign: The agency has built your product on top of their custom, closed-source 'internal framework' or 'core libraries.' They tell you it saves time. What they don't tell you is that if you leave, you cannot legal use those libraries, forcing you to rewrite your entire product from scratch.

    • ---

    Warning Sign 4: Extortionate Exit Fees

    When you notify the vendor that you are migrating to another provider, they quote you thousands of dollars to compile the files, package the database, and run a handover call.

  • The Hostage Sign: Demanding payment for access to files you have already paid for.

    • ---

    How to Execute a Secure Technical Exit

    If you suspect you are locked in, do not notify your agency immediately. A rushed exit can result in service disruptions. Instead, execute our Extraction Protocol:

  • Quiet Audit: Secure whatever access keys you have. Let a third-party engineer review the repository. Map dependencies and check for hidden trackers or proprietary code locks. (We offer this confidential audit for free—learn more [here](/vendor-escape)).
  • Environment Replication: Spin up a new, standalone AWS/GCP account owned entirely by your company. Copy the code repository and set up a staging pipeline to make sure it runs independently.
  • Database Migration: Extract a complete SQL dump of your database and restore it on your new server.
  • The Cutover: Redirect DNS records (like Cloudflare or GoDaddy) to point to your new servers. Revoke all access tokens, keys, and repository privileges from the old agency immediately.

    • Once your application is safe on your own server, you can clean up the code, document the APIs, and hand it to a dedicated developer.

    To get a confidential second opinion on your project, read our specialized [Vendor Escape guide](/vendor-escape) or contact us securely [here](/contact?type=rescue).

    Back to all articlesScope a Project Call →