Startup IP Audit Checklist: Find Gaps in 90 Minutes
An IP audit is a structured review of what intellectual property your startup has, who owns it and what could go wrong. Work through each asset type, name and brand, code, inventions, data, content, agreements, open source and domains, score what you find, fix the biggest gaps first, and take the unclear items to counsel.
Startup lifecycle A to Z · Letter Q · Stage: Raise
What an IP audit is and why do one now
An intellectual property (IP) audit is a structured look at the things your company owns or uses that the law treats as property: brand names, code, inventions, content, data and know-how. It answers three plain questions. What do we have? Who actually owns it? What could someone challenge?
Most founders have never done one, and that is exactly why it pays off. Gaps tend to be boring and fixable: a contractor who never signed an assignment, a name nobody searched, a library with an unclear license, a domain registered under a founder's personal email. They become expensive only when they are found late, usually by an investor's lawyer or an acquirer during diligence.
An audit is not a legal opinion. It is an organized self-review that tells you what to fix yourself and what to hand to counsel. Think of it as a smoke alarm check: quick, cheap and best done before there is smoke. This guide gives you a checklist you can filter by asset type, a way to score what you find, and a 90 minute workflow to run it.
When to run one
- Before a financing round, when investors will ask. See protecting IP before fundraising.
- Before launch, when your brand becomes public.
- When a co-founder, key employee or contractor leaves.
- Before a partnership or licensing deal.
- Before a sale or wind-down, as covered in what happens to IP when you sell or shut down.
- Once a year, as routine housekeeping.
What investors and buyers check
Understanding what a reviewer looks for tells you where to look first. Reviewers differ, but the pattern is consistent: they care less about how much IP you have and more about whether the company clearly owns what it says it owns.
The usual questions include:
- Does the company own its core code and inventions, supported by signed assignments from every founder, employee and contractor?
- Is the company name and main product name available, and is there a plan to protect it?
- Is there any open source in the product that could force a disclosure or create a conflict?
- Are trade secrets protected by agreements and reasonable practices?
- Are there any patent filings, and are the deadlines under control?
- Are important contracts, licenses and customer terms in order, and do any of them give away IP rights?
- Is anyone threatening a claim, or does the company know of a risk of infringing someone else?
You can see how this plays out in IP and startup valuation. Fixing a gap before the reviewer arrives is nearly always cheaper and calmer than explaining it after.
The checklist, organized by asset type
Use the table below as a working checklist. Each row is one thing to check. The third column describes what a good answer looks like. If you cannot answer a row, that is a finding. You can filter the table by reading only the asset types that apply to your business.
| Asset type | What to check | What good looks like |
|---|---|---|
| Name and brand | Did you search before choosing the company and product names? | A dated search record exists, no obvious conflicts, and the plan for registration is written down. See trademark your startup name. |
| Name and brand | Are the logo and brand assets owned by the company? | Designer agreement assigns rights or licenses them clearly, and source files are stored by the company. |
| Name and brand | Are notices used correctly? | TM and registered symbols are used only as appropriate. See notices guide. |
| Code | Who wrote the code? | Every author is an employee or contractor with a signed agreement, and a list of authors exists. |
| Code | Is the repository under company control? | Company-owned accounts, with at least two admins and no personal-only ownership. |
| Code | Is code copyrighted and notices in place? | Basic notices in files or footers. See copyright for software startups. |
| Inventions | Do you have records of what you invented and when? | Dated invention disclosures with named contributors. |
| Inventions | Have you disclosed anything publicly or offered it for sale? | A log of disclosures and dates, reviewed against patent filing deadlines. See the patent process. |
| Inventions | Is there a patent or trade secret decision? | A written choice for each key invention. See patent vs trade secret. |
| Data | What data do you collect and where does it come from? | A short data map, with rights to use it documented in terms and privacy policies. See terms and privacy policy. |
| Data | Is confidential data protected? | Access limited, agreements in place, and clear rules on who may share what. |
| Content | Who made your website copy, images, videos and docs? | Created by employees or by contractors with assignment or license terms, and stock or third-party assets are licensed for your use. |
| Agreements | Do all founders, employees and contractors have IP assignment and confidentiality terms? | Signed copies, stored in one place. See employee and contractor agreements. |
| Agreements | Do customer, partner and vendor contracts affect IP ownership? | Reviewed for assignment, license, exclusivity and feedback clauses. See joint development and partnerships. |
| Agreements | Are NDAs tracked? | A list of who signed what, with dates and expiry. See NDAs for startups. |
| Open source | Do you have an inventory of components and licenses? | A current list, with copyleft and unknown items reviewed. See open source licenses. |
| Domains | Who owns the domain and social handles? | Registered to the company, with shared recovery access and auto-renew on. See domains and brand protection. |
| Risk | Have you looked at what could infringe others? | A basic check for obvious conflicts. See freedom to operate. |
If you are not sure how names, patents and copyrights differ, the IP glossary defines the terms used in the table.
How to score and triage what you find
An audit usually produces more findings than you can fix this week. Scoring helps you pick. A simple two-number system works well: rate each finding on impact and effort to fix.
A simple scoring approach
| Rating | Impact if left unfixed | Effort to fix |
|---|---|---|
| 3 (high) | Could block a financing or sale, or lose ownership of a core asset. | Needs outside help or significant time. |
| 2 (medium) | Creates a visible question or minor risk. | A few hours of work. |
| 1 (low) | Housekeeping or a cosmetic problem. | Minutes. |
Then sort into four buckets:
- Fix now: high impact and low or medium effort, such as getting a missing assignment signed.
- Schedule: high impact and high effort, such as replacing a core component under a troublesome license.
- Batch: low impact and low effort, done in one housekeeping session.
- Accept or ignore: low impact and high effort, and write down why.
Example
For example, an audit of a small software startup might turn up five findings: no signed assignment from a part-time developer (impact 3, effort 1), a domain registered in a founder's personal account (impact 2, effort 1), an unknown license on a pasted code snippet (impact 2, effort 2), no search record for the product name (impact 3, effort 2), and old NDAs not tracked (impact 1, effort 1). The first and fourth go on top, because they could hurt a deal and are quick to fix. The domain transfer comes next. Notice that the highest priority items are usually ownership problems, not paperwork polish.
What counts as a red flag
- Anyone who wrote core code or designed core features without a signed assignment.
- A founder who left without assigning their rights.
- A core component under a license you do not understand.
- A product or company name that you have reason to believe conflicts with someone else's.
- Public disclosure of an invention you wanted to patent, if filing deadlines may be affected.
Red flags are not necessarily disasters, but they are the items to take to counsel before anyone else sees them.
The 90 minute self-audit workflow
You can do a first pass in a single focused session. Block out 90 minutes, bring the people who know the history (usually the founders and the lead engineer), and use the checklist above. Here is a time-boxed plan.
Minutes 0 to 15: List your assets
- Write the names: company, products, features, taglines.
- List the repositories, key libraries, datasets and design files.
- List the inventions or special methods your product depends on.
- List domains, social handles and app store accounts.
Minutes 15 to 40: Ownership and agreements
- List everyone who has ever contributed: founders, employees, interns, freelancers, agencies, advisors.
- For each, mark whether a signed IP assignment and confidentiality agreement is on file. See IP assignment agreements for startups.
- Note anyone missing, and anyone who has left.
- Skim customer and partner contracts for anything about ownership or licenses.
Minutes 40 to 60: Names, domains and notices
- Check whether you ran a search for each name. If not, run one now. The USPTO's trademark search is free to use, and Wysebridge's free trademark law guide explains how to read the results.
- Confirm domains and accounts belong to the company, with shared admin access.
- Check how TM, registered and copyright symbols are used.
Minutes 60 to 80: Code, open source, inventions and data
- Run a dependency license scan and list copyleft and unknown items.
- Ask engineers what code was copied or generated and from where.
- Review a list of recent inventions and any public talks, demos or sales that may affect patent options.
- Note what data you collect and where the rights to use it come from.
Minutes 80 to 90: Score and assign
- Score each finding for impact and effort.
- Pick the top three to fix this week and name an owner and date for each.
- List the items that need counsel and write the questions down.
- Save the audit as a dated document in a shared folder.
The result is a one-to-two page document: assets, gaps, scores and actions. It is also your first piece of evidence when someone asks, "Have you looked at this?"
Fixing the common gaps
Missing assignments
If someone who contributed never signed an assignment, get one signed as soon as possible. A lawyer can draft the language. It is usually easier to do while the relationship is good and the person is still reachable, and may involve a small payment or other consideration depending on your state's rules and the facts. Ask counsel how to handle it.
Unprotected names
If you have not searched or registered your name, search first, then decide. Registration at the USPTO has a base application fee of $350 per class of goods or services, and the USPTO page on how much a trademark costs explains the rest. Wysebridge's practitioner directory is for patent work, so for trademark counsel use your state bar's referral service or recommendations from other founders.
Trade secrets without protection
A trade secret only stays one if you take reasonable steps to keep it secret. Check access controls, confidentiality agreements and exit procedures for departing staff. Wysebridge's trade secret law guide explains what counts, and our guide on trade secrets and NDAs covers the practical side.
Inventions at risk
If you may have an invention worth patenting, review dates before anything else. A public disclosure or offer for sale starts clocks, in the US and especially abroad, as discussed in international IP protection. Talk to a registered practitioner promptly if you are close to a deadline.
Unclear open source
Replace, rewrite, relicense or accept, case by case. Our guide on open source licenses for startups shows how to think about each option.
Mistakes to avoid and when to get a lawyer
Common mistakes
- Treating the audit as a one-off. IP changes as you hire, build and sign deals.
- Auditing only what you registered. Unregistered rights such as copyright and trade secrets matter too.
- Letting the most technical person run it alone. Ownership questions need founders and contracts in the room.
- Fixing cosmetic items first and leaving ownership gaps for later.
- Not writing anything down. A reviewer wants evidence, not recollection.
- Assuming a clean scan or a clean search means no risk. These are signals, not guarantees.
When to bring in counsel
Bring in an attorney for missing assignments from people who have left, conflicts with someone else's brand, core code under copyleft or unclear licenses, anything that looks like a possible infringement claim, and contract clauses that could transfer or restrict your IP. For patent matters, a registered practitioner can help; see how to find an IP attorney and the directory of USPTO-registered patent attorneys and agents. The audit makes those meetings shorter, because you arrive with a list instead of a vague worry.
Where this fits in the startup lifecycle
The audit sits at the Raise stage, as the step you take before investors look. Before it, the patent process for startups and open source licenses guides cover two of the areas you will check. After it comes freedom to operate, which looks outward at other people's rights, and then IP and startup valuation. See the full sequence in the startup lifecycle A to Z. For the broader legal housekeeping, the startup legal checklist pairs well with this one.
Frequently asked questions
What is an IP audit for a startup?
It is a structured review of the intellectual property your company owns or uses, covering names, code, inventions, data, content, agreements, open source and domains. It checks who owns each item, whether it is protected and what risks exist. A founder can run a first pass internally and take unclear items to counsel.
How do I do an IP audit?
List your assets by type, check who created each and whether signed agreements exist, review names, domains and notices, scan code for open source licenses, review inventions and public disclosures, then score each finding for impact and effort. Fix the highest-impact, easy items first and bring unclear ones to a lawyer.
What do investors check in an IP audit?
Commonly, they check whether the company clearly owns its core code and inventions through signed assignments, whether the name is available, what open source is in the product, how trade secrets are protected, patent filing status and deadlines, and whether contracts give away IP. Requests vary by investor and deal.
How long does an IP audit take?
A first self-audit can take about 90 minutes if you have the founders and lead engineer together and use a checklist. A thorough review with legal counsel takes longer and depends on the size of the company. The time is mostly spent finding documents and confirming who owns what.
How often should a startup do an IP audit?
At least once a year, plus at key moments: before fundraising, before launch, when a key person leaves, before a major partnership and before a sale. Each change in team, product or contracts can create new gaps, so a short regular check beats one big rescue.
Do I need a lawyer to do an IP audit?
Not for the first pass. Founders can list assets, check agreements, run a name search and scan for open source. Use a lawyer for missing assignments, conflicts with other brands, risky licenses, possible infringement claims and contract terms that affect ownership.
Key terms on this page
Keep reading
- IP Due Diligence for Startups Before Fundraising IP guideIP due diligence for startups: what investors ask about IP, a practical checklist, and why founder IP assignment should come before funding.
- IP Assignment Agreements for Startups Explained IP guideIP assignment agreement basics for startups: founder IP assignment, invention assignment for employees, contractor IP ownership and what to include.
- Open Source Licenses for Startups: A Practical Guide GuideOpen source licenses for startups explained: permissive vs copyleft, MIT vs Apache vs GPL, what triggers obligations, license scanning and investor diligence.
- Freedom to Operate: Infringement Risk for Startups GuideFreedom to operate explained for founders: why owning a patent is not enough, how clearance searches work, and what to do if a cease and desist letter arrives.
- How IP Affects Startup Valuation: What Investors Weigh GuideHow IP affects startup valuation: what investors and buyers check (ownership, scope, defensibility), what moves confidence, and how to show IP in a data room.
Learn more from Wysebridge
Wysebridge owns, operates and sponsors Revolutionary Startups, so these are links to its own free resources and directories. Read the disclosure.
- Wysebridge U.S. IP law courseA 20-chapter self-study course on U.S. patent, trademark, copyright and trade secret law; module 1 is free.
- Learn patent law free at WysebridgeFree patent, trademark, copyright and trade secret guides, MPEP flashcards and more, with no account needed.
- Find a USPTO-registered patent attorney or agentProfiles of USPTO-registered patent attorneys and agents, built from the public USPTO roster. Covers patent practitioners, not trademark-only lawyers.
Part of Protecting Your Startup · All guides · Glossary
Sources
General information, not legal, tax or financial advice. Reviewed 11 November 2026.