Do not rely on work-for-hire by default
In the United States, "work made for hire" is a specific statutory concept that applies to employees and to a narrow list of commissioned categories. It does not automatically extend across borders, and it is not the framework a Brazilian court would reach for.
The practical fix is not exotic: an explicit, present-tense assignment clause. "Contractor hereby assigns all right, title and interest…" rather than "agrees to assign", which creates only a promise you might have to enforce later. Add a clause requiring the contractor to sign any further documents needed to perfect the assignment.
This is standard in international contractor agreements and no competent counterparty will object to it.
Choose the governing law deliberately
Most U.S.–Brazil contractor agreements name a U.S. state as governing law with arbitration or a chosen venue. That is normal and generally accepted.
Be realistic about enforcement: winning a judgment in Delaware against an individual in Brazil is not the same as collecting it. The real protection in practice is operational — access control, code review, and not handing complete production credentials to someone in week one — not the choice-of-law clause.
What the NDA should actually cover
Define confidential information broadly but not absurdly; a definition that covers everything covers nothing when a judge reads it.
Say explicitly what may be stored on a personal machine. Most engineers work from their own hardware, which is fine, and the contract should reflect reality instead of pretending otherwise.
Set a survival period. Two to five years post-termination is customary for commercial confidential information; trade secrets are typically carved out to survive indefinitely.
Include a return-or-destroy obligation at termination, and actually run it. Revoking access on the last day matters more than the clause requiring it.
The operational controls that do the real work
Least-privilege access from day one. Repository access does not imply production database access.
Code review on every merge. It protects the codebase and creates a record of who wrote what — which is also your evidence of authorship.
Separate credentials per person, never shared accounts. Shared credentials make it impossible to prove who did anything.
Offboarding checklist that runs the same day, not the same week.
When you contract through a studio rather than an individual, the IP assignment chain runs studio-to-client and engineer-to-studio, and you should ask to see that both links exist. A vendor that cannot show you the second link is selling you a gap.
Key takeaways
- Use an explicit present assignment of IP — "hereby assigns", not "agrees to assign".
- Do not assume U.S. work-for-hire doctrine applies across borders.
- Name governing law, and understand that enforcement across borders is slow regardless.
- Access control and code review protect you more than any clause.
- With a studio, verify both links of the assignment chain.
- This is a general overview, not legal advice — have counsel review your agreement.