How to Legally Protect Your Source Code in Colombia

Source Code as Your Startup's Most Valuable Asset

For a tech company, source code is the most valuable asset. It's the product, the competitive advantage, and in many cases, the reason investors put in money. However, it's also one of the most vulnerable assets if not adequately protected.

In Colombia, software is protected by copyright, not patents (with very limited exceptions). This means protection exists from the moment of creation, without requiring registration. But "existing" and "being able to demonstrate and enforce" are very different things.

This article explains the legal tools available in Colombia to protect your source code and how to implement a comprehensive protection strategy — particularly relevant for international companies with development teams in Colombia.

Legal Framework: Software Copyright in Colombia

Software protection in Colombia is governed by several regulations:

Law 23 of 1982 (Copyright Law). Establishes the general framework for protection of literary and artistic works, a category that includes software.

Andean Decision 351 of 1993. Supranational regulation of the Andean Community that protects computer programs as literary works. Applies in Colombia, Peru, Ecuador, and Bolivia.

Decree 1360 of 1989. Specifically regulates the registration of software in the National Copyright Registry.

Law 603 of 2000. Requires companies to report in their financial statements compliance with software copyright regulations.

Under this framework, source code receives automatic protection as a literary work. This protects the expression of the code (how it's written), but not the underlying ideas, algorithms, or functionalities. That is, someone can create software that does the same thing as yours, as long as they don't copy your code.

Registration with DNDA: Is It Necessary?

The National Copyright Directorate (DNDA) allows registering software in the National Copyright Registry. Although protection exists without registration, registering your software has important advantages:

Presumption of authorship. Registration creates a legal presumption that you (or your company) are the author and rights holder. In case of dispute, the burden of proof is reversed: the other party must prove you're not the author.

Certain date. Registration establishes an official creation date, useful for demonstrating priority over subsequent copies.

Requirement for legal actions. While not strictly mandatory, having registration enormously facilitates judicial actions for infringement.

Registration process:

1. Complete the software registration application form
2. Attach a functional description of the software
3. Include identifying material (can be code fragments — you don't need to submit all source code)
4. Pay the registration fee (currently free at DNDA)
5. Registration is granted in approximately 15 business days

Important: You don't need to submit your complete source code. You can register a functional description and representative fragments. Your complete source code remains confidential.

Contractual Protection: The First Line of Defense

DNDA registration is important, but contractual protection is your first and most effective line of defense. These are the key contracts:

IP assignment agreement with employees and contractors. In Colombia, economic rights over software created by an employee belong to the employer only if there's an employment contract with an express assignment clause, or if the software was created in fulfillment of a work contract. Without this clause, the developer could claim rights over the code.

Non-disclosure agreements (NDA). Protect source code as a trade secret. Must be signed before sharing any access to the code repository.

Non-compete clauses. Limit former employees' ability to use acquired knowledge to create competing products. In Colombia, they must be reasonable in time (maximum 2 years) and geographic scope.

Client contracts. If you develop custom software, clearly define who owns the resulting code. Does the client receive a use license or full ownership? Can you reuse generic components in other projects?

Trade Secret: Complementary Protection

Trade secret is a form of intellectual property protection that complements copyright. While copyright protects the expression of code, trade secret can protect algorithms, processes, architectures, and know-how that aren't protectable by copyright.

Requirements for something to qualify as a trade secret in Colombia (Andean Decision 486):

1. Must be secret information (not publicly known)
2. Must have commercial value because it's secret
3. The holder must have taken reasonable measures to keep it secret

Reasonable measures you should implement:

• Repository access control (role-based permissions)
• Confidentiality agreements with the entire team
• Internal information security policies
• Marking documents as "confidential"
• Logging who accesses what information
• Offboarding procedure including access revocation

Trade secret advantage: No time limit (unlike copyright which lasts 70 years post-mortem of the author). As long as you maintain the secret, protection persists.

Disadvantage: If someone discovers your secret through legitimate means (reverse engineering, independent discovery), you cannot prevent them from using it.

Software Licenses: Control How Your Code Is Used

If you distribute your software (whether as a product or service), you need a license defining the terms of use:

Proprietary license. Restricts use, copying, modification, and distribution of the software. Standard option for commercial software. You must clearly define: number of permitted users, use restrictions, reverse engineering prohibition, and liability limitations.

Open source licenses. If you decide to release part of your code, carefully choose the license. Permissive licenses (MIT, Apache 2.0) allow commercial use without restrictions. Copyleft licenses (GPL) require that any derived software also be open source, which can be problematic if you mix proprietary code with GPL code.

Dual model. Some startups use a dual licensing model: open source version with copyleft license for the community, and commercial version with proprietary license for companies that don't want copyleft restrictions.

Consideration for Colombia: Software licenses are adhesion contracts and must comply with the Consumer Statute if directed at end consumers.

Comprehensive Protection Strategy: Checklist

Implement this layered strategy to protect your source code comprehensively:

Layer 1 — Contractual (implement immediately):

• IP assignment agreements with all developers
• NDAs with the entire team and third parties with access
• Reasonable non-compete clauses
• Clear license terms for users

Layer 2 — Registration (implement in the first 3 months):

• Software registration with DNDA
• Product trademark registration with SIC
• Documentation of creation date for each version

Layer 3 — Technical (implement from day one):

• Repository access control (GitHub/GitLab with role-based permissions)
• Mandatory two-factor authentication
• Access and audit logs
• Branch management and code review policy
• Encrypted backups

Layer 4 — Organizational (implement in the first 6 months):

• Internal intellectual property policy
• Offboarding procedure with access revocation
• Team training on information protection
• Intellectual property asset inventory

At BREUK we help you implement this complete strategy, from drafting tech employment contracts to registration with DNDA and SIC.