Report, incuding industry benchmarks and recommendations

Audit and improve your ESG reporting (Environmental, Social and Governance)

Evaluates the quality of ESG management and organisational resilience in terms of climate risks and social governance

Provides essential insight into the target's ESG performance and recommendations to improve your decision making 

Highlights the current performance on environmental and sustainability matters

Provides concrete guidance on the processes to put in place to achieve, and maintain, a net-zero goal

Proves to stakeholders and investors that you are meeting industry standards

ESG audits explained

100% online
1 account for all solutions
Collaborative platform
Connect from any device at anytime


45 years of experience
Collaboration with IT and cyber specialists


ISO27001 certified
Automatic data encyption
Data stored on our servers
Servers located in Europe

Efficiency, Expertise, Security: our 3 promises to our clients

Our clients

Simple, complete, concrete

Do you need more information on our ESG audits ? 

Comprehensive online ESG audits to help organisations score their ESG performance and create an action plan to improve their results

Online ESG Audit solution | Vaultinum

DORA aims to establish a harmonised framework for managing technological risks across the European financial sector. It applies to a wide range of stakeholders, including banks, insurance companies, payment institutions, crowdfunding platforms, and their ICT service providers. 

The regulation introduces direct oversight of critical third parties, such as cloud service providers and fintech companies, which play a pivotal role in maintaining financial institutions' operational continuity. As a specialised regulation (lex specialis), it supersedes the general provisions of the NIS2 Directive concerning digital resilience within the financial sector. This specificity highlights the strategic importance of financial stability in an environment where cyber threats are rapidly evolving.

DORA is built on five core pillars, which guide the efforts of affected entities to achieve compliance: 

Financial institutions must implement proactive ICT risk management practices. This includes identifying vulnerabilities, conducting regular backups, developing business continuity plans, and training teams. These measures aim to ensure optimal readiness for potential disruptions. 

The regulation mandates the establishment of specific protocols for handling ICT incidents. These protocols must include mechanisms for early detection, resolution procedures, and mandatory reporting of major incidents to competent authorities. Documenting and rapidly communicating incidents ensure an effective and coordinated response. 

Resilience testing involves regular assessments of critical systems and infrastructure. These tests include penetration testing, simulations of cyberattack responses, and disaster recovery exercises. Such measures evaluate the operational robustness of entities in extreme scenarios. 

DORA promotes greater cooperation among financial institutions and their partners by encouraging the sharing of information about emerging threats and identified vulnerabilities. This collaboration aims to enhance collective awareness and mitigate systemic risks. 

Relationships with ICT providers are strictly regulated. Financial institutions must: 

Document all contracts to identify critical functions. 

Incorporate contractual clauses on audits, service continuity, and transition mechanisms. 

Rigorously monitor the performance of third parties, including their subcontractors. 

These measures minimise risks associated with outsourcing and ensure compliance throughout the supply chain. 

Practical recommendations for affected entities 

To meet DORA requirements, financial institutions and their service providers must undertake significant adjustments. The following steps are recommended: 

Mapping ICT contracts: identify existing agreements and assess their criticality. 

Updating contracts: include DORA-specific addenda with clauses addressing audits, data security, and exit strategies. 

Collaborating with providers: educate partners on the new requirements and ensure their compliance capability. 

Planning and testing: conduct regular simulations to evaluate the effectiveness of continuity plans and incident management frameworks. 

These actions should be underpinned by rigorous documentation and continuous monitoring to ensure sustained compliance. 

DORA redefines operational resilience standards and directly affects the governance of financial institutions. For investors, assessing the measures taken by ICT providers to align with these new obligations is critical. 

Key considerations for investors include: 

Risk management strategy: are systems adequately designed to identify and mitigate vulnerabilities? 

Quality of third-party relationships: do contracts include DORA-compliant clauses, and are suppliers monitored effectively? 

Resilience capability: do entities perform regular tests to ensure readiness against cyber threats? 

Data protection: do existing measures safeguard the confidentiality, integrity, and availability of sensitive data? 

Vaultinum’s white paper on DORA contractual clauses for ICT companies provides detailed guidance on the regulatory requirements for agreements between financial institutions and their ICT providers. These written, dated, and signed agreements must: 

Fully describe the ICT service provided. 

Specify conditions for subcontracting, if applicable. 

Precisely locate the geographic regions where services will be delivered. 

Detail the security obligations and processes implemented by the provider. 

Guarantee the institution’s business continuity, which may involve escrow clauses to secure access to source codes and sensitive data. 

Outline exit and transition procedures in case of service termination.

DORA represents a turning point in European financial regulation, introducing strict standards for digital resilience. Financial institutions and their ICT providers must adopt a methodical approach to integrate these requirements. This will strengthen their ability to navigate an increasingly complex digital landscape. For investors, compliance with these obligations serves as a marker of reliability and sustainability, enabling more secure agreements in a rapidly evolving sector. 

The opinions, presentations, figures and estimates set forth on the website including in the blog are for informational purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.

The use of any content on this website, including in this blog, for any commercial purposes, including resale, is prohibited, unless permission is first obtained from Vaultinum. Request for permission should state the purpose and the extent of the reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.

Philippe is the CEO of Vaultinum. An expert in new technologies and high finance, and after 20 years in the international fintech industry, Philippe now heads Vaultinum.

Philippe Thomas

Adopted in January 2023, the Digital Operational Resilience Act (DORA) represents a major milestone in financial regulation within the European Union. This legislation imposes specific obligations on financial institutions and their ICT service providers to enhance resilience against digital risks. With mandatory compliance required from January 2025, affected entities must adapt their structures and practices to meet heightened standards. These changes directly impact their operations, governance, and contractual relationships. 

Discover how the Digital Operational Resilience Act (DORA) reshapes EU financial regulation and learn the key compliance steps for financial institutions and ICT providers.

All you need to know about DORA regulation

Understanding DORA regulation: what are the implications for investors? 

Who owns the source code? What about intellectual property?

Behind every piece of software, every mobile application and every website there is a source code that allows it to run. As for any intellectual work or invention, its intellectual property belongs to its creator. This is called copyright. In a simplified vision of things, there are two types of creators. The creator can be an individual, such as a developer, or a legal entity (commercial company, organisation, community, etc.).

In addition to the source code, the architecture of the software, the accompanying documentation, its interface, and the preparatory design material of the software are also protected by copyright. More clearly, the software is protected from its very first trial and test versions.

In addition, to be recognised as intellectual property, a software program and its source code must demonstrate their original character. In other words, it must be possible to prove that the computer program is the result of an original intellectual contribution, of an effort made by the developer or the owner company and demonstrates a creative choice.

While a freelance developer automatically owns the rights to their software, employees in a company automatically assign the copyright to the organization that employs them. Ownership by the employees of the source code’s intellectual property is only possible following a specific agreement between them and their employer. It should be noted that there are some particular cases concerning identification of the author of a work not covered in this article.

For businesses, it is advisable in all cases to have explicit copyright assignment agreements with employees, consultants, and subcontractors to avoid any disputes over intellectual property.

How to protect source code from counterfeiting?

From the moment they create software, the developer or company automatically own the rights to it. Nevertheless, to avoid counterfeiting and misuse of the source code by third parties, it is strongly recommended to adopt specific actions that reinforce the protection of the source code.

Registering software copyright with a deposit

Whatever the form of the program, registering your software copyright through an Intellectual Property depositgives you irrefutable proof of the creation date and enables you to claim authorship in the event of litigation. You can register this copyright with a specialist trusted third party, even before offering the application to the general public. It is strongly recommended to make this deposit from the first development phases and to remember to update it regularly.

Following the initial registration, it is advisable to update it to take account of each patch or upgrade. The trusted third party with whom the source code has been registered will issue a time-stamped certificate that will serve as proof if the authorship of your software is challenged.

In addition to the source code, the graphic interfaces of a website, the processes, methods and technical documentation, the databases, operating systems and 3D images, the plans and drawings for video games, etc. are also protected by copyright if they meet the condition of originality.

Take the time to write the license for the program

As a general rule, software and mobile and web apps are not sold to the user. Instead, a user license is granted allowing purchasers to benefit from the services provided by the computer program. In other words, users are informed of their rights and restrictions, particularly with respect to copying and access to source codes.

For reasons of interoperability, some software is sometimes obliged to reveal some or all of its source code to users. This does not mean that the owner loses its intellectual property rights, as the licence agreement does not imply a transfer of intellectual property and the software publisher retains full ownership of its copyright.

If the user misuses the source code, even partially, contrary to the restrictions imposed by the legal notices and licence agreement, they are liable to legal proceedings. If in doubt about the limits of the rights and uses related to protection of your software’s source code, we advise you to get in touch with a consultant in intellectual property law who will be able to guide you.

These confidentiality clauses must be carefully drafted to protect not only the source code but also the algorithms and other intellectual property not explicitly included in the code.

Whether the source code is for PC/Mac/Linux software, an iOS/Android mobile app, an online store or a SaaS (Software as a Service), it can lead to a security breach by offering a gateway for hackers to enter your systems.

To ensure your program’s cyber security and protect your customers, perform as much security testing as possible and comply with your national cyber security agency’s recommendations for implementing good IT security practices. If you don’t know where to start, have a third-party cyber security audit performed.

Whenever a vulnerability is detected, patch it as soon as possible. Even if your software creation is partly based on third-party software, especially open source, you are responsible for the entirety of your production and its security level.

It should be noted that cyber security is an ongoing process – even after patches are produced and released, you must continue testing regularly to prevent hackers from eventually finding the flaw in your application and exploiting it to steal your customers' data or block their systems.

To summarise: answers to your questions about the intellectual property of source code

Since the Berne Convention was signed in 1979, successive decisions by the European Courts have ruled that software belongs to its developer if they have developed it individually. In a company, if employees develop a program in the course of their work and using the company’s resources, the program’s intellectual property belongs entirely to the company. If, on the other hand, an employee creates an application outside of their working hours and using their own resources, the work belongs to them without the employer having any right of review, except in the case of infringement of its intellectual property. In some cases, attribution of authorship of the work is more complex (in the case of a consultant or co-authors, for example) and will require the setting up of a contract for transfer of copyright. 

It is advisable for businesses in all cases to establish detailed specifications to monitor development, as well as to implement explicit copyright assignment agreements with employees, consultants, and subcontractors, to prevent any future disputes over ownership.

If in doubt, we advise you to contact your intellectual property rights consultant.

In simple terms, source code can be defined as the human-understandable language used to create a computer program. It can be contrasted with object code, which is the machine-understandable language. All software, mobile apps, websites or even SaaS (Software as a Service, on the cloud) include source code.

The primary protection for source code is legal. Anyone who copies, uses, translates or exploits your code or your software without your consent can be prosecuted. You will be able to claim damages for the loss suffered. To prove the authorship of your computer program, register it with a certified trusted third party who will affix a certified time-stamp to it. This registration can be done from the first prototypes and test versions of the software.

Source code can be analysed to identify technical errors and then correct them. We can also analyse source code in order to notice a possible plagiarism by a program or a competing site. A source code audit can also be used to determine its security level and the presence or absence of known vulnerabilities in the code. Developer teams can use tools such as Review Board or Crucible to analyse their code, but only source code scanning tools, such as the one offered by Vaultinum, will comprehensively reveal all cybersecurity and intellectual property vulnerabilities in the code.

The opinions, presentations, figures and estimates set forth on the website, including in this blog, are for informational purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.

Marine is our Marketing Director. She is a branding and brand activation specialist with international experience in BtoB and BtoC.

Marine YBORRA

The source code of a computer program is protected by the Intellectual Property Code. As for any creation, this source code can be copied by hackers or competitors. Several measures can be taken to protect it and so preserve the added value of the computer program or website.

The intellectual protection of source code represents a major issue for software, application and website developers. On various aspects, it is necessary to protect the computer program to preserve its added value. Discover our advice.

The importance of Source code Intellectual property and how you should protect it

Source Code Intellectual Property: How To Protect It

Vaultinum

Tech Due Diligence

Tech Vendor Due Diligence

IP Audit

Cyber Audit

Scalability and Quality Audit

ESG Audit

IP Deposit

Software Escrow

Solutions

Our Solutions adapted to your needs

Our Solutions

Blog

Resources

Learn

About us

Contact

Change Language

This website uses cookies to enhance user experience. You can learn more about how we handle your data in our legal notice.

Use this sitemap to find all the information you need about Vaultinumand go directly to the sections you're interested in.

ESG Audit

Who should use Vaultinum's ESG audits ?

For Investors

For All Organisations

Efficiency, Expertise, Security: our 3 promises to our clients

Efficiency

Expertise

Security

They choose Vaultinum's ESG audits

How does Vaultinum's ESG audit work ?

Do you need more information on our ESG audits ?

Latest articles