The Client Has Your Code on AWS and Won’t Pay : The Code-Audit Breakdown
Look, you build the engine, you hook up the pipelines, and you push the final build to their staging or production instance. Everything works beautifully. Then, the calendar turns. Your invoice hits their inbox.
And suddenly, the Slack channel goes dead silent.
If you are a backend or full-stack engineer, this is the exact moment where you incur significant financial exposure. Client Has Your Code on AWS and Won’t Pay or on Heroku environment. They are actively using it to run their business, serve users, or raise their next funding round, while your bank account sits empty.
The critical issue is as follows: your immediate instinct is probably to log back into the server, drop the database, or pull down the repository access.
Don’t touch that keyboard yet.
What Does “Client Has Your Code on AWS and Won’t Pay” Mean ?
This refers to a situation where a client deploys and actively uses software developed by a contractor on their own cloud infrastructure (such as AWS or Heroku) without completing the agreed payment, creating a legal conflict between infrastructure access rights and intellectual property ownership.
If you handle this wrong, you can easily cross the line from an unpaid technical professional into a potential liability under cybercrime laws.
I have watched brilliant developers ruin their careers by turning a simple billing dispute into a multi-million dollar lawsuit because they didn’t understand the thin legal line between code repossession and data sabotage .
Let’s break down exactly how to handle this high-risk dispute scenario without ending up in a courtroom.
Table of Contents
Client Has Your Code on AWS and Won’t Pay : The 90-Day Recovery Timeline
When a client goes quiet after you push code, time is your worst enemy. You cannot afford to guess what to do next. Let’s look at exactly how this unfolds over a 90-day period.
The 90-Day Ghost Line
Your forensic day-by-day roadmap for professional debt recovery.
D1
The Deadline Missed
Invoice due date passes. Traffic is high, but the account is quiet.
Action: Send a polite, automated ping. Assume an accounting glitch. No access changes.
D7
The Silent Slack
Messages are read, but nobody types back.
Action: Review MSA/Payment terms. Check your Net cycle status.
D14
The “Accounting Loop”
Vague excuses about “finance directors” or “waiting on funds.”
Action: Cease all non-billable support and bug fixes immediately.
D30
The Official Warning
A full month of value delivered, zero dollars received.
Action: Send formal written notice of non-payment. Start your paper trail.
D45
IP Cut-Off Pivot
The conversation shifts from “missing bill” to “unauthorized IP usage.”
Action: Notify client that license to use your code has not legally transferred.
D60
Code-Audit Review
They are still running your infrastructure despite warnings.
Action: Conduct a passive audit of logs and access keys. Document everything.
D90
Final Ultimatum
Bad-faith client confirmed. Friendly emails are officially over.
Action: Initiate formal legal action. Protect your claim to the work.
Day 1 : Payment Missed After Client Has Your Code on AWS
The invoice due date passes. You notice the system logs show their platform is handling traffic perfectly using your new microservices architecture.
Your Action : Send a polite, automated ping. Assume it is an accounting glitch. Do not change any access tokens yet.
Day 7 : The Silent Slack Channel
Your messages show as “read,” but nobody is typing. This is where you realize you might be dealing with a problem.
Your Action : Check your master services agreement (MSA) for your payment terms. Are you on a net payment cycle? If you want to see how different cycles impact your options right now, understand payment cycles in Net 15 vs Net 30 vs Net 45: Which Payment Terms Protect Your Cash Flow
Day 14 : The “Accounting Loop” Excuse
If they do reply, they will say something like, “Our finance director is out this week,” or “We are waiting on our main client to clear our funds.”
You have given them ample time to clear the debt. Now, it is time to pivot the conversation from “unpaid bill” to “unauthorized usage of intellectual property.”
Your Action : Issue a formal notice stating that because payment has not been received, the license to use your code has not legally transferred.
Day 60 : Code Audit Phase (Client Has Your Code on AWS and Won’t Pay)
They are still using your infrastructure on Heroku or AWS, but ignoring your notices.
Your Action : Conduct a complete, passive audit of your repository access logs, deployment keys, and environments. Document everything. Do not modify or delete their files.
Day 90 : Legal Escalation When Client Has Your Code on AWS and Won’t Pay
Ninety days of silence or empty promises means you are officially dealing with a bad-faith client.
Case Study : The Broken Microservices Architecture
To see how this works in the real world, let’s look at a case involving an engineer named Marcus.
Marcus was hired as a senior backend contractor for a mid-sized B2B SaaS startup. His job was to rebuild their legacy data pipeline and deploy it across three AWS instances. The project took four months of intense, 60-hour workweeks.
1. The Breakdown
Marcus completed the work, verified the deployment, and sent his final invoice for $22,500. The startup’s CTO praised the performance improvements in writing. Then, the executive team completely ghosted him.
For 45 days, Marcus watched his code process millions of real-time events for the startup’s paying customers while his emails went completely unanswered.
The Deployment Breakdown
Marcus’s Local Machine
Source code, repository branches, and active development environment.
Pushed Code
Client’s AWS Instance
Live production infrastructure processing commercial data.
▼
Client uses code but ghosts invoice
▼
⚖️ Marcus Retains IP Ownership
2. The Twist
Frustrated and unable to pay his own rent, Marcus logged into his personal IAM account—which still had administrator rights to the staging cluster—and modified the security groups to block all inbound traffic to the database. The startup’s app went down for six hours.
Within twelve hours, the startup’s legal counsel sent Marcus a letter threatening a federal lawsuit under the Computer Fraud and Abuse Act (CFAA), claiming hundreds of thousands of dollars in damages for lost business.
3. The Strategic Takeaway
Marcus actually held all the legal cards because his contract clearly stated that intellectual property would only transfer upon final payment. However, by logging back into an environment owned and paid for by the client to cause a disruption, he turned himself from a victim into an alleged cybercriminal.
Client Has Your Code on AWS and Won’t Pay : Access vs Ownership Explained
Here is where most software developers get tripped up : they confuse system access with intellectual property ownership.
Just because your ssh key still lets you log into a production Heroku instance does not mean you have the legal right to touch it. Once a client pays for the underlying server infrastructure (the AWS account, the Heroku dynos, or the physical hosting), that environment is legally considered their private digital property.
The Dev’s Legal Trap
Understanding the invisible line between hosting environments and code ownership
Client’s AWS Instance
(Paid for by the client)
Legal Asset Classification
Private Digital Property
⚠️ Criminal Risk Warning
Logging in without explicit authorization to alter or delete code constitutes Criminal Mischief / CFAA violation.
Your Codebase
(Written entirely by you)
Legal Asset Classification
Your Intellectual Property
🛡️ Recommended Remedy
Pursue Copyright Infringement. Since no payment occurred, they are running unlicensed software inside their container.
If you log into their cloud account without explicit, ongoing authorization and modify, delete, or break anything, you are exposing yourself to severe liability. In the United States, this falls squarely under the Computer Fraud and Abuse Act (CFAA).
The law looks at it very simply :
You had permission to access the server to build the application.
Once the project ended or a dispute began, your authorization to modify that live environment was effectively revoked.
Entering the environment to cause a disruption constitutes “unauthorized access to a protected computer” to cause damage.
It does not matter if they owe you ten dollars or ten thousand dollars. The law does not allow you to commit a digital break-in to collect a debt.
Instead of messing with their servers, you need to rely entirely on your intellectual property rights. If your contract is written correctly, you still own every single line of code inside that repository until that final invoice is marked as paid.
Lien on Intellectual Property
In traditional construction, a mechanic can put a physical lien on a house if the owner refuses to pay for the new roof. In software engineering, your lien is your Intellectual Property (IP) ownership.
Under standard copyright law, independent contractors own the copyright to the creative work they produce from the moment it is written. This property right only transfers to the client when both parties fulfill the terms of the agreement. If your agreement says “IP transfers upon full payment,” and they haven’t paid you, the client is currently running stolen code.
This gives you an incredible amount of leverage, but you have to use it precisely. You aren’t trying to shut down their site by force; you are letting them know that they are committing willful copyright infringement by running your proprietary code in a commercial capacity.
This rule applies even if your contract was informal. If you don’t have a massive master services agreement, you can look at your chat history. For example, you might wonder, Can a WhatsApp Chat Count as a Legally Binding Contract? (US & UK Law). The short answer is yes—if the scope and payment terms were clearly agreed upon there, it counts, and your IP rights remain protected.
How to Safely Execute a Code Lockout Without Being Sued
If you want to protect your income without finding yourself on the wrong side of a computer crime statute, you need a safe, legal, and highly strategic operational framework.
Here is exactly how you protect your work safely.
1. The Pre-Emptive Local Kill-Switch (The “Phone Home” Method)
If you are dealing with a high-risk client or an unstable startup, you should implement a pre-defined license validation mechanism disclosed in the contract directly into the software before you deploy it to their staging environment.
This means the application naturally checks an external API utility that you control to confirm if its license is still valid. If the invoice goes unpaid, you simply suspend the external license validation service under your control on your side.
Why this is safe : You are not logging into their system to break anything. You are simply stopping a service on your own server that the software requires to run. You aren’t destroying data; you are letting a temporary license expire naturally.
2. The Repository Lockout
If you host the primary source code repositories on your own GitHub, GitLab, or Bitbucket organization account, you have every right to revoke their access to that repository if they stop paying.
The Rule : Do not delete the repository. Just change the permissions to read-only or remove their team access entirely. This prevents them from pulling down updates or cloning the codebase for other developers to work on while they owe you money.
3. The Professional IP Notice Stack
Instead of sending angry Slack messages, send a highly structured, formal legal notice via email and certified mail.
Step A : Clearly state the invoice is overdue.
Step B : Inform them that per the terms of your contract, no license to utilize, modify, deploy, or run the code has been granted because payment has not been received.
Step C : Explicitly state that continued operation of the software on their AWS/Heroku instances without an active license constitutes willful copyright infringement.
Before you make a single move or send a formal demand letter, you need to gather all your evidence and store it in a secure location outside of any systems controlled by the client. If they realize a dispute is brewing, they will instantly cut off your access to Slack, Jira, and AWS.
Pull down these pieces of data right now:
The Fully Executed Contract : The final signed PDF, or the complete email/chat thread where the scope and payment terms were explicitly approved.
The Complete Invoice Trail : PDF copies of the invoices, automated reminder notifications, and metadata showing when the emails were delivered.
Written Sign-Off / Acceptance : Screenshots or downloads of Slack messages, emails, or Jira tickets where the client explicitly stated that your code worked perfectly, passed QA, or was ready for production deployment.
Git Commit Logs : A full export of the repository commit history showing your author signature on every line of backend architecture or module you built.
Live Infrastructure Proof : Publicly accessible URLs, API responses, or system headers proving that their live application is actively serving traffic using your specific codebase.
The Risk Matrix for Code Repossession
Every action you take to get paid carries a specific level of legal and operational risk. Use this matrix to guide your next move.
Action
Risk Level
Legal Consequence
Strategic Value
Revoking GitHub Repo Access (Your Account)
Low
Totally legal. You own the account and the hosting environment.
High. Prevents them from hiring a cheap developer to finish your work.
Turning Off Your Own License Server
Low
Safe if defined as a temporary license in your terms.
Extremely High. The application becomes non-operational without any unauthorized access to the client’s infrastructure.
Sending an IP Cease & Desist Letter
Low
Standard legal practice. Zero criminal risk.
High. Forces their corporate counsel or investors to pay attention.
Logging into Client AWS to Delete Data
Critical
High risk of CFAA violations, criminal mischief, and massive civil lawsuits.
Negative. You lose all your leverage and can face criminal charges.
Modifying Live Server Passwords/SSH Keys
High
Can easily be interpreted as unauthorized access or extortion.
Very Low. Turns a clear collection issue into an ugly cyber-attack dispute.
US vs. Global Jurisdictions : A Technical Comparison
Legal treatment varies significantly across jurisdictions. The way you handle a missing payment doesn’t just depend on your contract—it depends on where you and your client are physically sitting on the map.
If you are a developer in India dealing with a US-based SaaS company, the legal ground beneath your feet shifts the moment you move from “polite email” to “technical intervention.”
United States & United Kingdom : The IP High Ground
In the US and UK, the legal framework is built around robust intellectual property protections. Under the US Copyright Act (17 U.S.C. § 101), independent contractors automatically retain copyright ownership of their work unless there is an explicit, written agreement clearly defining it as a “work made for hire.”
If they stop paying, you aren’t just a disgruntled creditor; you are the owner of the code they are currently running. You can leverage federal copyright law to demand they cease and desist. If you find yourself in a situation where they steal your source files outright, you need to be precise. Immediately follow the steps in How to Write a Clean Cease-and-Desist Letter If a Client Steals Your Code or Designs.
India: The Criminal Mischief Trap
Things get much sharper—and more dangerous—in the Indian legal landscape. Under Sections 43 and 66 of the Information Technology Act, 2000, altering, damaging, or disrupting any computer resource without the explicit permission of the owner is a serious criminal offense.
Here is the hard truth: If you are an unpaid developer based in Bangalore or Delhi, and you log into a client’s server to “switch off” your code, you can easily be arrested for hacking. It doesn’t matter that they owe you money. The law sees your action as a digital break-in.
Instead, lean on the Indian Copyright Act, 1957. You have the right to file for a civil injunction to stop them from using your software architecture until your bill is cleared. It is slower than a kill-switch, but it won’t land you in a jail cell.
Cross-Border Engineering Contracts : The Delaware Problem
If you are based in Asia or Europe, but your client is a Delaware-registered LLC, your local laws won’t magically shield you if you disrupt their production server.
When you cross borders, you enter the messy world of Private International Law. If you break a system in a foreign jurisdiction, you could be facing litigation in a court thousands of miles away, governed by laws you don’t understand.
You need to ensure your contracts are properly insulated before you push the first line of code. Don’t wait for a dispute to figure this out. I highly recommend reading How to Protect Yourself When Working With International Clients to ensure you have actual legal recourse that holds up across borders.
Pro Tip: Always define the “Governing Law” clause in your contracts. If you are in India and the contract says “Governing Law: California,” you have already made your recovery process significantly more expensive and complex. Stay grounded, stay local, and keep your contracts clean.
Technical Solutions to Generate a Safe Lockout Notice
If your client is using your code on their servers without paying, you shouldn’t log in and break things. Instead, use this clean, professional tool to draft a formal notice that sets clear boundaries and establishes your intellectual property rights.
Safe Lockout & IP Notice Generator
Click the button above to generate your legal notice text.
Quick Decision Guide : What Should You Do Right Now?
If you are currently looking at a live production system and wondering what your next move should be, take a deep breath and follow this quick path.
Quick Decision Guide
Follow this framework before taking any technical action on a non-payment issue
Is your invoice overdue?
YES
Do you have active access to their cloud account?
▼
YES
🛑 STOP!
Do NOT modify, delete, or disrupt any live files or configurations. Step back to avoid liability.
NO
🛡️ TAKE ACTION
Issue a formal Intellectual Property Notice and immediately revoke access to repos hosted on your accounts.
NO
Hold Pattern
Wait calmly until the contractually agreed milestone or due date officially passes before sending collections notices.
Frequently Asked Questions
Can I log in and change the API keys to stop my code from working ?
Look, if the API keys belong to accounts that are owned and paid for by the client, changing them is highly risky. It can easily be viewed as unauthorized access to their private business systems. If the API key points to an account you personally pay for, you can and should disable that token on your end immediately.
What if my contract says “Work Made For Hire” but they haven’t paid me ?
Even in a “Work Made for Hire” scenario, a contract is a reciprocal agreement. If they commit a material breach by completely failing to pay you, their legal right to claim ownership over that work is deeply compromised. You should immediately send a formal notice asserting your rights to the underlying code until the breach is resolved.
Can I reach out to AWS or Heroku directly to take down their servers ?
Yes. If you hold the verified copyright to the code and they are running it without a valid license, you can legally file a DMCA Takedown Notice with their cloud hosting infrastructure provider (like AWS, DigitalOcean, or Heroku). Cloud providers take these statutory notices very seriously and will often force the client to address the issue to avoid having their hosting account suspended.
How can I prevent this scenario from happening on my next software project ?
Never deploy the final production build directly to an environment controlled by the client until the final payment has cleared your bank account. Always host staging and QA builds on your own cloud infrastructure, and only migrate the codebase to their infrastructure after the financial terms of your agreement have been fully satisfied.
Can I charge them extra fees or interest for the time they spend ghosting me ?
Turning Technical Leverage into Financial Recovery
Here’s the bottom line: don’t let anger dictate your engineering decisions. When a client takes your backend architecture and ghosts your invoice, they are counting on you to either walk away quietly or do something reckless that gives them an excuse to sue you.
Don’t give them that victory.
Keep your cool, keep your hands off their live cloud environments, and use your intellectual property rights like a sharp tool. Lock down your own repositories, pull down your project documentation, and send a clean, forensic notice that targets their legal liabilities.
If you want to make sure your invoices get prioritized by their accounts payable team before things turn into an ugly legal battle, learn How to Design an Invoice That Accounts Payable Teams Can’t Ignore. It will help you structure your billing workflow so you never find yourself left holding an empty bag again.
About Author
Adv. Sagar Haribhau Shirsat is an active legal professional specializing in commercial transaction architectures, cross-border corporate compliance, and digital debt recovery systems. He designs strategic asset-protection and recovery frameworks that help freelancers, independent contractors, and global agencies defend their cash flow and enforce their billing rights.
Disclaimer : This guide is intended for educational purposes and risk management analysis. It does not replace formal legal counsel. For specific cross-jurisdictional contract disputes, always consult a certified attorney or local legal advocate.
