If a client or agency refuses to pay after a website migration, you are not just dealing with a payment issue — you are dealing with potential copyright infringement.
This situation is extremely common in freelance development: you complete the build, migrate the database, transfer the domain, and suddenly lose access while your invoice remains unpaid.
Quick Answer:
If a client refuses to pay after a website migration, you still retain copyright over the code and database unless explicitly transferred. You can enforce your rights by gathering evidence, notifying stakeholders, and filing a DMCA takedown with the hosting provider.
In this guide, you will learn exactly what to do if a client keeps your code or database without payment, including legal rights, DMCA takedown strategy, and step-by-step recovery actions.
Then, the unthinkable happens. You are suddenly locked out of the hosting control panel. They change the credentials.
They keep the database you meticulously built. Meanwhile, your final invoice sits completely ignored. You are officially ghosted.
I see this exact scenario play out every single week. It is infuriating, stressful, and incredibly common in the freelance development world.
Today, I am breaking down the mechanics of this theft. I will show you exactly how devs reclaim stolen migrations without losing their minds.
This is a complete structural breakdown of multi-party development vulnerabilities and systemic recovery strategies. We are going deep.
The Problem : The Anatomy of a Stolen Migration
Let me give you a real-world scenario where a client refuses to pay after migration . I worked with a brilliant freelance backend contractor last year. We will call him David.
David spent three months building a complex, custom Laravel application for a mid-sized marketing agency.
The agency was acting as a middleman for a massive corporate end-client. Everything was going perfectly fine.
David pushed the final code. The agency asked him to point the domain to their newly provisioned AWS server.
He transferred the domain. He migrated the database. He sent his final invoice for $8,500.
The agency immediately revoked his SSH access. They stopped returning his calls. The end-client started using the application the very next day.
David was terrified and broke. He felt completely powerless. If you are in this situation, read What to Do When a Client Uses Your Work But Refuses to Pay You to understand your immediate baseline rights.
The agency used the migration as a leverage point. They secured the asset, deployed it, and cut the creator out of the loop entirely.
This is not a simple misunderstanding. This is calculated leverage. They assume you do not have the legal firepower to fight back.
But here is the thing : this assumption is legally incorrect.
The Law : Code vs. Data vs. Domains
Before we get into tactics, you need to understand the legal landscape. A website is not one single legal entity.
It is a collection of intellectual property rights bundled together. The domain name is just a digital signpost. It points traffic.
The code files (HTML, PHP, JS) are structural instructions. But the database? That is the brain.
Under the US Copyright Act, specifically 17 U.S.C. § 103, compilations of data and derivative works carry their own distinct copyright protections.
Similarly, the UK Copyright, Designs and Patents Act 1988 (Section 3A) provides specific, rigorous protection for database rights.
If you engineered the schema, structured the relationships, and populated the initial data, you hold significant leverage.
The agency might control the domain, but they are illegally hosting your intellectual property. which clearly establishes a payment dispute after migration.
Section 1 : The White-Label Disconnect
Agencies love white-label contracts. They allow the agency to pretend they built the software in-house.
They charge the end-client a premium, pay you a fraction, and keep the difference. It is a standard business model.
But when an agency ghosts you, the white-label agreement becomes their biggest vulnerability.
The end-client usually has zero idea that a freelancer was involved. They think the agency handled everything.
This information gap is your most powerful leverage point. The agency is terrified of looking incompetent or dishonest to their cash cow.
If you are an unpaid subcontractor, the agency’s nightmare is you breaking that white-label silence.
They do not want the end-client discovering the software they just bought is legally encumbered by unpaid debt.
To learn how to navigate this delicate situation, check out Unpaid Subcontractor? Here is When You Can Sue the End-Client Directly.
Section 2 : The Database as Separate Property
When an agency steals a migration, they assume possessing the files equals legal ownership. That is legally illiterate.
In almost every jurisdiction, the creator of the work retains the copyright until a transfer of IP is signed.
Most freelance contracts clearly state that intellectual property transfers only upon full payment of the final invoice.
If they haven’t paid, they are committing copyright infringement. The database schema you designed is legally yours.
The custom queries you wrote are your intellectual property. They are using stolen goods to run a commercial enterprise.
You do not always need an expensive legal team to enforce this. You can handle the initial steps on your own.
Read How to Recover an Unpaid Invoice Yourself (Without Hiring a Lawyer) to see how powerful self-advocacy can be.
Section 3 : Tracing the Data Lineage
To win this fight, you need absolute proof that you created the database and executed the migration.
Agencies will often lie and claim they built it, or that your work was defective and they had to rewrite it.
You need a bulletproof paper trail. I call this tracing the data lineage.
First, gather all your Git commits. Version control is your best witness. It proves exactly what you built and when.
Second, locate the raw SQL dumps from your local machine or staging environment. Check the timestamps.
Third, pull all communication regarding the migration. Emails, Slack messages, and even text messages are crucial.
Many developers do not realize that informal chats carry legal weight. See Can a WhatsApp Chat Count as a Legally Binding Contract? (US & UK Law) for proof.
Compile this evidence into a single, organized folder. This is your supporting evidence.
Section 4 : Intercepting End-Client Communication Legally
This is the psychological turning point. You must bypass the agency and contact the end-client.
But you must do it legally. If you are reckless, the agency could sue you for “tortious interference with a business contract.”
You cannot send an angry, emotional email demanding money from the end-client. That will backfire instantly.
Instead, you send a calm, professional, highly factual Notice of Unpaid Intellectual Property.
You simply inform them that the database powering their application contains unlicensed intellectual property due to the agency’s non-payment.
You clarify that you are not blaming the end-client, but that they need to be aware of the liability.
This forces the end-client to put massive pressure on the agency to clear the title. The agency will panic.
If you need the exact wording for this kind of maneuver, review How to Write a Clean Cease-and-Desist Letter If a Client Steals Your Code or Designs.
The Solution for client not paying after website migration : Executing the Takedown
If the agency still refuses to pay after you expose the white-label disconnect, it is time for the formal legal enforcement step.
You initiate a hosting-level complaint infrastructure using the Digital Millennium Copyright Act (17 U.S.C. § 512).
The DMCA allows copyright holders to demand the immediate removal of infringing content from servers.
You find out where the application is hosted. You run a simple WHOIS or DNS lookup. Maybe it is AWS, DigitalOcean, or GoDaddy.
You submit a formal DMCA takedown notice to the hosting provider’s abuse department.
Hosting companies do not play around with DMCA claims. They are legally required to act quickly to maintain their own safe harbor status.
They will often suspend the server entirely until the dispute is resolved. Suddenly, the agency’s client has a temporarily inaccessible website.
The leverage completely flips back to you. If you need step-by-step instructions on this, read Client Launched the Site But Cancelled My Stripe Subscription : How to Freeze a Live Domain Legally.
Quick Decision Flowchart : What to Do Right Now when client not paying after website migration
I know your head is spinning. Let’s simplify this into a practical, step-by-step decision matrix.
Status Assessment Engine
Has the invoice due date passed by more than 15 days?
Follow this logical flow to determine your immediate next action.
Step 1 : Has it been more than 15 days past the invoice due date?
- NO: Send a polite follow-up. Do not escalate yet.
- YES: Proceed to Step 2.
Step 2 : Are you locked out of the hosting environment?
- NO: Download a fresh backup immediately. Secure your access if possible.
- YES: Proceed to Step 3.
Step 3 : Is the end-client actively using the application?
- NO: Send a formal demand letter to the agency.
- YES: Proceed to Step 4.
Step 4 : Draft the End-Client Notice.
Reach out to the end-client notifying them of the IP dispute. Do not demand money directly from them yet.
If you are unsure about the timing of these steps, consult When is it Officially Time for a Freelancer to Take Legal Action?.
Evidence Gathering Checklist
Do not make a single legal threat until you have organized your proof. I use this exact checklist with my clients.
- [ ] The Original Contract : Ensure it contains a clause stating IP transfers only upon payment.
- [ ] The Final Invoice : Must clearly show the exact amount owed and the due date.
- [ ] Migration Logs : Server logs, cPanel transfer receipts, or command-line history showing you moved the database.
- [ ] Version Control History : A clean export of your Git commit history showing your structural database work.
- [ ] Communication Records : Screenshots of the agency approving the work and then ignoring payment.
- [ ] DNS Proof : A historical snapshot of the domain pointing to the new server they control.
Keep all of this in a secure, backed-up cloud folder. You will need it for the DMCA notice.
Risk Matrix for Developers
Every action you take carries a risk. You must calculate your moves like a system engineer debugging a critical error.
| Action Taken | Potential Reward | Associated Risk Level | Legal Vulnerability |
| Polite Follow-up | Gets paid if it was an honest accounting error. | Low | None. Completely safe. |
| Sending a Demand Letter | Shows the agency you are serious and know your rights. | Low | Minimal. Establishes a paper trail. |
| Contacting End-Client | Massive pressure on the agency. Usually forces immediate payment. | Medium | Risk of tortious interference if worded unprofessionally. |
| Filing DMCA Takedown | Takes the site offline. Ultimate leverage. | High | Perjury risk if you do not actually own the copyright. |
| Filing a Lawsuit | Legally binding judgment and potential damages. | High | Expensive, time-consuming, and emotionally draining. |
Always start at the low-risk end of the matrix and escalate methodically.
The US Legal Shield ( And How It Works Globally )
Look, I used to think international law was this impossible maze. I remember staring at a contract from a Chicago agency, sweating because I lived 8,000 miles away. I felt completely unprotected.
Here is the calm reality. If you are dealing with a US-based agency or server, United States law is your primary shield. The US Copyright Office explicitly outlines protections for computer programs and databases.
It is not just about the raw data. It is about how you structured it. Your schema, your custom SQL relationships—that is where the intellectual property lives. You built the architecture.
Let’s look at a real-life legal precedent. It actually goes back to a landmark US Supreme Court case about phonebooks, of all things. It changed everything for developers.
In Feist Publications, Inc. v. Rural Telephone Service Co., the court ruled that raw facts are not copyrightable. However, the original selection and arrangement of that data absolutely is.
You can read the full legal breakdown of this exact doctrine over at Cornell Law School’s Legal Information Institute. It is dense reading, but incredibly empowering.
How does this apply to your stolen migration? The agency can keep their end-client’s raw text data. But the moment they use your relational database structure without paying, they cross the line.
They stole your “arrangement.”
Now, what if you live in India, the UK, or South America ? Does US law even care about you ? Surprisingly, yes. It actually works heavily in your favor.
Because of international treaties like the Berne Convention , if a US agency steals your work, they are violating US law on US soil. Your physical location matters far less than where the actual infringement happens.
If you are curious about navigating international client dynamics safely, check out How to Protect Yourself When Working With International Clients.
You do not need to hire an expensive lawyer and fly to New York to fight this. You just use the DMCA framework.
The Official Congress statute for the DMCA (17 U.S.C. § 512) gives foreign freelance creators the exact same digital takedown power as American citizens.
You send the notice directly to their US-based hosting provider. The host takes the server offline to protect their own liability.
It is a quiet, administrative process. You enforce a global boundary and protect your cash flow without ever leaving your home office.
Authoritative Legal References:
- U.S. Copyright Act, 17 U.S.C. § 103 (Compilations and derivative works)
- Digital Millennium Copyright Act, 17 U.S.C. § 512
- Berne Convention for the Protection of Literary and Artistic Works
These frameworks establish that database structure, schema design, and compiled data arrangements qualify for copyright protection when created with originality.
Interactive HTML Tool : The IP Demand Email Generator
I built a simple tool to help you draft the perfect, legally sound email to an agency that stole your migration.
This avoids emotional language and sticks purely to the facts. You can save this HTML code and run it in your browser.
Legal IP Demand Generator
Fill in the details to generate a professional, non-emotional demand letter.
Use this template. It is cold, factual, and incredibly effective at forcing accounting departments to cut a check.
Infrastructure Strategy to Prevent Payment Disputes
If you are a freelancer managing your own hosting environment before handover, you need better infrastructure.
Never build on the client’s server until you are paid. Always build on your own isolated cloud instances.
Tools like Cloudways or DigitalOcean allow you to clone and transfer servers with a single click.
More importantly, they give you an absolute paper trail of server creation and IP ownership.
If you use professional migration tools, you hold all the cards until the exact second you decide to release them.
Invest in proper staging environments. It is the cheapest legal insurance you can buy.
Frequently Asked Questions
Can they legally keep the database if they bought the domain name ?
No. The domain name is registered through ICANN and acts purely as an address.
The database contains compiled data and structural schema, which is governed by copyright law.
Owning a street address does not mean you own the custom house built on the property.
What if my contract doesn’t explicitly mention intellectual property ?
In the absence of a “work for hire” clause, standard copyright law defaults to the creator.
Unless you signed a document expressly transferring your rights, you own the code and the database structure you created.
The agency merely has an implied license to use it, which is immediately revoked upon non-payment.
Will a DMCA takedown actually work on a database ?
Yes, absolutely. A database schema, SQL dumps, and custom queries are recognized as protected literary works and compilations.
If the host receives a valid DMCA notice proving you created those files, they must comply to protect their own liability.
They will disable access to the server directories containing the stolen data.
Can the agency sue me for taking the site down ?
They can threaten it, but a counter-suit is rare if your unpaid invoice is thoroughly documented.
If you hold the copyright and they haven’t paid, they are in breach of contract first.
Filing a frivolous lawsuit against a freelancer requires capital that most shady agencies do not want to spend.
Should I just build a “kill switch” into my future code ?
I strongly advise against malicious kill switches after client not paying after website migration. It crosses the line into computer fraud and hacking.
Instead of a hidden kill switch, use licensing keys or host the core database on your own controlled environment.
Rely on legal contracts and staging servers, not hidden malware. Keep your hands clean.
Final Thoughts : Changing Your Posture
Look, getting cut out of a migration is a rite of passage for many developers. It hurts.
But it only happens because agencies exploit the power dynamic. They rely on your fear of legal complexity.
By understanding your rights over the database, tracing your data lineage, and utilizing DMCA tactics, you neutralize their leverage.
You are not a helpless victim. You are a business owner enforcing a commercial transaction.
Act like a system engineer debugging a problem. Remove emotion, gather the logs, and execute the solution.
You built the value. Do not let anyone walk away with it for free.
About Author :
Adv. Sagar Haribhau Shirsat is an active legal professional specializing in commercial transaction architectures, cross-border corporate compliance, and digital debt recovery systems. He designs strategic asset-protection and recovery frameworks that help freelancers, independent contractors, and global agencies defend their cash flow and enforce their billing rights.
Connect via his Official Professional LinkedIn Profile or visit About Us page.
Legal Disclaimer:
This article is intended for informational and educational purposes only and does not constitute legal advice. Legal outcomes may vary based on jurisdiction and contractual terms. For specific disputes, consult a qualified legal professional.