Twenty questions. The answers tell you more than the portfolio.
Ask who owns the code and from what moment, where it is hosted and in whose account, and what you hold if the developer disappears. Then ask the other seventeen. These are the twenty questions we ask on our own engagements, with the reason each matters and the answer that should worry you.
Why the default position is against you
Under Australian law, a contractor owns what they build for you unless the contract says otherwise. IP Australia puts it in one sentence: “IP created by a contractor is the property of the contractor unless otherwise stated in the contract” (IP Australia, Who owns intellectual property?, checked September 2026). Most people hiring a developer for the first time assume the opposite.
That is why the list starts with ownership rather than skill. Skill is what the portfolio shows. Ownership, hosting and exit are what you find out about in year two — and the ABS lists insufficient skilled personnel as a barrier to innovation for 11% of businesses and lack of funds for 15% (ABS, Characteristics of Australian Business, 2024–25, released 25 June 2026), which is to say most owners hire a developer because they cannot check the work themselves.
These are the questions we ask on our own engagements, in the order we ask them. Our answers are on ownership and security and how we charge. Four of the twenty we do not pass comfortably; those are marked.
Ownership and code: questions one to five
Get these in writing before a deposit. None is commercially sensitive; hesitation on any of them tells you what the contract will feel like later.
- KNDR·011. Who owns the code, and from what moment?Because the legal default is that they do (IP Australia, Who owns intellectual property?, checked September 2026). “At the end” is weak if the end never formally arrives. Ours assigns ownership on payment of the final invoice, in the wording on the ownership page.
- KNDR·022. Do I get repository access from the first commit, or a zip file at the end?No cost excuse exists: GitHub’s free plan includes unlimited private repositories (GitHub pricing, checked September 2026). Whoever holds the repository holds your business.
- KNDR·033. Does anything I own depend on a component I only licence?You can own bespoke code that will not run without a layer you rent. Ask whether any part stops working when the relationship ends.
- KNDR·044. What happens to ownership if we stop halfway?A fair answer gives you what has been delivered and paid for. A vague one gets negotiated at the worst moment, by whoever has less to lose.
- KNDR·055. Which third-party libraries are in it, and under what licences?Every modern build stands on open-source code. Ask for the list; a few licences carry obligations, and you want to know which.
Hosting and data: questions six to ten
This is where privacy law lives. Turn over more than $3 million, handle health information or trade in personal information and the Privacy Act binds you (OAIC, small business and the Privacy Act, checked September 2026). One in five Australian businesses reported a cyber security incident in 2024–25 (ABS, Characteristics of Australian Business, 2024–25, released 25 June 2026).
- KNDR·016. Which provider, which region, whose account?“Cloud-hosted” is not an answer. AWS alone runs 39 regions (AWS global infrastructure, checked September 2026); which one is a real question. Ours are named on the ownership page: Hetzner in Singapore and Helsinki by default, NextDC in Australia when residency matters — which means you should ask us question 7 as well.
- KNDR·027. Does any personal information leave Australia, and to whom?APP 8.1 requires you to take reasonable steps before disclosing personal information overseas, and under section 16C you are accountable for the overseas recipient’s breaches as if they were your own (OAIC, APP Guidelines chapter 8, checked September 2026). An offshore developer with production access is a disclosure, and so is an offshore server. Our default servers are outside Australia; NextDC is there when your data cannot be. Ask us, and ask everyone.
- KNDR·038. What are the security measures, specifically?APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access (OAIC, Australian Privacy Principles quick reference, checked September 2026). Self-reported cybercrime cost the average small business $56,571 in 2024–25, up 14% on the year before (ASD, Annual Cyber Threat Report 2024–25, published October 2025). “Industry standard” is not a measure. Multi-factor authentication on every admin login is.
- KNDR·049. How are backups taken, where do they go, and when was a restore last tested?A backup nobody has restored is a hope. Ours run every three hours plus a daily snapshot, and the last restore test is dated on the ownership page.
- KNDR·0510. Which AI provider processes my data, if any, and under what terms?Human error caused 37% of notified data breaches in the first half of 2025 (OAIC, Notifiable Data Breaches statistics January–June 2025, published 4 November 2025), and pasting customer records into a consumer chatbot is human error. Only a named provider and a named data term will do. Ours is set per client, and we say so.
Money and scope: questions eleven to fifteen
Project size predicts outcome more than anything else in the published research. In the Standish CHAOS sample, small projects succeeded 61% of the time and the largest 6% (Standish Group, CHAOS Report 2015, projects sampled 2011–2015 — a US research firm and not an Australian dataset). Not an Australian dataset — but the direction is the whole argument for increments.
- KNDR·0111. How did you arrive at that number?A calculated number has a story; a round one was chosen. Only one tells you the developer understood the job. The nine red flags works through this line by line.
- KNDR·0212. What recurs after go-live, line by line?Hosting, model and API usage, third-party subscriptions. Platform fees compound with success: Zapier bills per completed task, from 100 a month free to paid tiers starting at US$19.99 a month (Zapier pricing, checked September 2026, USD). Ours is listed on how we charge, and hosting is one line of it.
- KNDR·0313. What will I be able to use at week two?If the answer is nothing, the risk is all yours. In two-week increments the most you can be wrong by is one increment.
- KNDR·0414. Which of my systems have you built against before, and which not?We have built against nine: Xero, MYOB, QuickBooks Online, ServiceM8, Simpro, Stripe, GoHighLevel, Zapier and n8n. Anything else, we say we have not. A developer who claims everything has read the marketing pages.
- KNDR·0515. What will it not do?Push past the first answer. The first limitation named is the safe one; the second is the one that will affect you.
People and exit: questions sixteen to twenty
Since 9 November 2023 an unfair term in a standard-form small business contract has been prohibited, not merely voidable, with penalties for corporations of up to $50 million, three times the benefit gained or 30% of turnover, and $2.5 million for individuals. The protection covers businesses with fewer than 100 employees or under $10 million turnover (ACCC, unfair contract terms penalties, released 1 November 2022, in force from 9 November 2023). Most software contracts you will be handed are standard form.
- KNDR·0116. Who actually does the work, and who else could pick it up?Marked: we do not pass this comfortably. Kindra is a small firm founded in 2025. For some projects that is the wrong shape and we will say so. Ask everyone.
- KNDR·0217. When it breaks, how fast do you respond, and is that written down?Ours is two hours. Ask what it covers — a reply is not a fix — and whether it survives the end of the build.
- KNDR·0318. What does the handover include, itemised?Code, credentials, documentation, runbook, architecture note. If it is not itemised, assume a login. Test: could a developer you hired next week pick it up from what you hold?
- KNDR·0419. What does leaving cost in month three?Automatic renewal, unilateral price changes and exit fees are exactly the kind of terms the unfair contract regime targets (ACCC, unfair contract terms penalties, released 1 November 2022, in force from 9 November 2023). Ours: you take the code and go, no export fee.
- KNDR·0520. Can I have all of this in writing before I pay a deposit?The only acceptable answer is yes. Ours asks for a 50% deposit, and every answer above is on the site before you pay it.
The answers that should worry you
“You’ll own it at the end.” Ask when the end is. “Cloud-hosted.” Ask which provider, which region, whose card is on the account. “We’re fully APP compliant.” Ask who assessed them and when — most firms who say it have not been assessed by anyone. We have not been either, and we say so.
“We have never had a project fail.” Every firm that has shipped has one. With 1,205 data breaches notified to the OAIC in 2025, up 8% on 2024 (OAIC, Notifiable Data Breaches statistics, calendar 2025, published 6 July 2026), and one project in five failing outright in the CHAOS sample (Standish Group, CHAOS Report 2015, projects sampled 2011–2015 — a US research firm and not an Australian dataset), a spotless record is a short one or a quiet one.
The pattern across all twenty: a good answer is specific and slightly uncomfortable. A bad answer is reassurance. For the short version, three of these remove most of the market on their own.
Where we do not pass comfortably
Four of the twenty. Question 16, depth of team: small firm, founded 2025. Question 8, assessment: not assessed against the Australian Privacy Principles. Question 17, the record behind the two-hour commitment: uptime of 100% over eleven months, a short window that should be read with the window attached. Question 12, recurring cost: set per engagement, because a band published without knowing your systems would mislead you.
We designed our terms around these questions, so of course we pass most of them. That is a reason to ask every developer the same twenty, ours included — not a reason to trust the list.
Score the answers you were given
Run this against one developer’s actual answers, not your impression of them.
Ten questions about the answers you received. “Partly” is for an answer that was given but was vague, verbal or conditional.
- Is ownership assigned to you in writing, with a named trigger?A licence or a right to use is not ownership.
- Will you hold repository access from the first commit?
- Did they name the hosting provider, region and account owner?
- Did they say plainly whether any personal information leaves Australia?
- Did they name a date for the last tested restore?
- Did they explain how the price was calculated?
- Is every recurring cost listed, line by line?
- Will you have working software to use within two weeks?
- Did they name at least two things it will not do?
- Is the exit path written, with no penalty for leaving?
0 of 10 answered. The result appears once you have answered them all.
If a firm scores well and still feels wrong, trust that. The twenty questions remove structural risk; they do not tell you whether you can work with someone for six weeks.
The questions people actually ask.
01Isn’t twenty questions a lot to put to someone before a job?
Fewer than a bank asks before a loan a tenth the size. They take twenty minutes in a first conversation, and a developer who resents them is telling you something. Ours are answered on the site so you do not have to ask.
02What if they answer everything well but are more expensive?
Compare scope, ownership and what happens when it breaks before comparing totals. A cheaper quote that fails questions 1, 6 and 19 has moved the cost to the exit.
03Do these apply to a freelancer as much as a firm?
More. A freelancer is the single point of failure on questions 16 and 17, so questions 2 and 18 — repository access and itemised handover — carry the whole risk. A good one hands you the repository on day one unasked.
Stop bending.
Start shipping.
Bring the one flow that keeps costing you a Tuesday afternoon. We map it live and tell you what we'd build, what we wouldn't, and what it costs.