Hiring an App Development Company in the AI Era: What to Get in Writing

Proposals from app development companies increasingly promise faster delivery thanks to AI, often with a “warranty included” line attached. The points that decide the app's future for years are rarely written down: who owns the code, who checks the AI's work, and where your customer data goes.

Before signing with an app development company, get five things into the contract: copyright in the code transferred to your company, disclosure of the AI tools used and who reviews their output, proof of security testing, a data processing agreement under Indonesia's Personal Data Protection (PDP) Law, and payments tied to working builds you can click through yourself. Without a transfer clause, Indonesian law gives copyright in commissioned code to whoever made it, not to the client who paid (Source: Law 28/2014 on Copyright, Article 36).

What changes when an app development company builds with AI?

The 2025 DORA report, surveying almost 5,000 technology professionals, found 90% already use AI at work, yet 30% have little or no trust in AI-generated code (Source: Google Cloud/DORA, 2025). The same report finds AI helps most where teams already have mature automated testing and version control. AI mostly amplifies existing habits, bad ones included.

Code that looks finished is not necessarily secure. In Veracode's tests of over 150 language models, AI-generated code passed security checks only 15% of the time for cross-site scripting, a flaw that lets attackers inject malicious scripts into an app's pages, and 13% for log injection, which lets attackers forge system activity records (Source: Veracode, 2026).

Also ask which AI tools the vendor uses, and on which plan. The plan matters. GitHub's documentation says that, since 24 April 2026, interaction data from individual Copilot plans, code snippets included, may be used to train AI models unless the user opts out, while Copilot Business and Enterprise customer data is not used (Source: GitHub Docs, 2026). Get written confirmation that your code won't train anyone else's model, plus a named reviewer for every change and the security test report.

Who owns the code after the final payment?

Indonesia's Copyright Law protects computer programs (Article 40), and Article 36 names the party that produced a commissioned work as its creator and copyright holder, unless agreed otherwise (Source: Law 28/2014 on Copyright). The right can be transferred by written agreement, and protection for a computer program lasts 50 years from first publication (Source: Law 28/2014, Articles 16 and 59). Miss a clause today, and its effects can far outlast your relationship with the vendor.

AI complicates this further. In May 2026, Indonesia's Directorate General of Intellectual Property (DJKI) said works produced entirely by AI get no copyright protection and, for now, will not be registered, while works using AI as a tool stay protectable if the human intellectual contribution is significant (Source: DJKI, 2026). DJKI also encourages creators to document their creative process as proof of human contribution (Source: DJKI, 2025).

In an app project, that proof is the commit history, a log of every code change, plus review notes naming the reviewer. Without that trail, copyright protection for the code you paid for may be weak. At handover, make sure you receive the following.

• A clause transferring economic rights in the code to your company, effective on final payment.
• Access to the full git repository and its commit history, not a zip file of the final code.
• A list of the third-party and open-source components used.
• Admin credentials, domain, hosting, marketplace API apps and QRIS merchant accounts, all in your company's name.

What must a vendor do when it handles your customer data?

Any vendor touching your customer data, whether building the app, migrating old records or running servers, is a processor under the PDP Law; you remain the responsible controller. Under Article 51, a processor acting outside your instructions is itself liable for that processing, and every sub-processor needs your written approval (Source: Law 27/2022 on Personal Data Protection). Sub-processors can include a third-party AI API your app calls or your hosting provider, so have the proposal name them all.

Government Regulation (PP) 33/2026, which takes effect on 16 January 2027, details what a controller-processor agreement must contain, including an audit mechanism (Source: Veritask, 2026). Your vendor contract can double as that agreement.

Server location belongs in the contract too. PP 71/2019 lets private-scope electronic systems store data abroad, provided supervision and law-enforcement access stay effective (Source: PP 71/2019, Article 21). For an online store, payment app or another online service handling customers' personal data, your company must register as an electronic system operator (PSE) before public launch, or risk being blocked (Source: Kominfo Regulation 5/2020). Ask the vendor to prepare the technical data for registration.

How do you tie payments to an app you can click?

Paying in stages is common in Indonesia. In our experience, an instalment is safest when tied to a build on a test (staging) server you have tried yourself, with test results attached, not to a calendar date or a slide deck. Agentiq's case-study pages generally carry a See Demo button that opens a clickable build running on fictional sample data. Expect the same from any vendor.

Safe milestones can be designed in from day one. In the warehouse system Agentiq built for a seller on Shopee, TikTok Shop, Lazada and Blibli with two warehouses, the first phase was deliberately read-only toward the marketplaces: it never shipped orders, cancelled them or requested labels. The system was then trialled end to end on real parcels before the client fully switched over.

On the same project, one marketplace's API allowed only a single client app to connect, a platform constraint worth raising at proposal stage. Built by Agentiq for an anonymised Indonesian marketplace seller; all screens shown use fictional sample data.

Indonesian app projects usually run through a WhatsApp group, where agreed scope changes are easily buried. Ask for a written change-request log and a staging link updated at every milestone. Before the final payment, agree the bug-fix warranty period and support response times in writing; a “warranty included” line with no duration protects nothing. Hosting, per-message WhatsApp Business Platform fees and other third-party costs should be itemised separately too.

What this means for your business

For an established business, a custom app soon becomes an asset that holds your customer data and your team's way of working. A contract covering only scope, price and schedule leaves that asset less than fully yours, and the gap shows only when you try to switch vendors or face an audit. Check every app development quote against this list before comparing prices.

How a vendor answers these questions is evidence in its own right. For the exact clause wording, involve your legal adviser.

• Request the draft contract early and look for the copyright transfer clause.
• Ask in writing which AI tools and plans are used, who reviews the output and whether your code is excluded from model training.
• Make a security test report a condition of every release.
• Obtain the sub-processor list and server locations before handing over customer data.
• Tie every instalment to a staging build you have tested yourself.

If you'd like to see what project milestones tied to clickable demos could look like for your business, walk us through your process on our contact page. The Agentiq team will reply with concrete recommendations, not a template.