A Contributor License Agreement (CLA) is a signed agreement defining the terms of a contribution. A Developer Certificate of Origin (DCO) is a short statement a contributor certifies with each commit. If your startup accepts outside code, pick one, document it, and keep the records. This is general information, not legal advice.
What a DCO says
The Developer Certificate of Origin, version 1.1, is a four point statement. By making a contribution, the contributor certifies that they created it and have the right to submit it under the open source license indicated, or that it is based on prior work under an appropriate open source license, or that someone else provided it who certified the same. The fourth point says the project and the contribution are public and that a record of the contribution, including personal information and the sign off, is kept indefinitely.
In practice contributors add a sign off line to each commit message. The certification travels with the commit history.
What a CLA does
The Apache Software Foundation describes its contributor license agreements as defining the terms under which intellectual property is contributed, so the project can defend itself if there is a dispute. It offers an individual agreement (ICLA) and a corporate agreement (CCLA). Its page notes that contributors keep full rights to use their own contributions for other purposes, and that a corporate agreement does not remove the need for individual developers to sign their own. Smaller contributions to Apache projects come in under the contribution clause of Apache 2.0, which says an intentionally submitted contribution is under the license terms unless stated otherwise.
Comparing the two approaches
| Aspect | CLA | DCO |
|---|---|---|
| Form | Signed agreement, often through a tool | Sign off line on every commit |
| Contributor effort | One time signature | Small step on each commit |
| What it records | Agreed terms for the project | A certification of the right to submit |
| Corporate contributors | Often a separate corporate agreement | Individual certification |
Neither is automatically right. A CLA gives the project owner broader written terms, which matters if you plan to dual license or change terms later. A DCO is lighter and fits projects that simply want proof of origin.
What investors will look for
If you publish an open source repo, expect a question like "who owns the code outside contributors wrote?" A clear answer names the mechanism: a CLA bot, a required sign off check, or the license's own contribution clause. It also shows where the records live. Without a mechanism, you may find it hard to show what rights you have. Your counsel should pick the instrument, since it affects what you can do with contributed code later.
Steps to put it in place
- Decide who may contribute (employees only, contractors, outside people).
- Choose CLA or DCO and write the choice in CONTRIBUTING.md.
- Add an automated check on pull requests so the sign off cannot be skipped.
- Store signed agreements or the sign off history where you can export them.
- Record the license that applies to inbound code in your inventory.
For related reading, see employee open source contributions in diligence and dual licensing your own code.
Quick check
Does a DCO transfer ownership of the code?
The DCO text is a certification about the right to submit and the license that applies. It does not describe an assignment. Ask counsel what you need if you want more.
Do we need either one for a private repo with only employees?
Employee contributions usually fall under employment terms, which your counsel handles. The mechanisms above matter most when people outside the company contribute.
Sources
- Developer Certificate of Origin 1.1
- Apache Software Foundation, contributor agreements
- Apache License 2.0 text
Last reviewed: 19 October 2026.
