Who owns building automation system data?

Who owns building automation data by default?#

Building automation data has no single default owner; the installation contract, the service agreement and the software license usually decide. In practice, data the building generates, such as trend logs and alarms, tends to be treated as the building owner's, while the controls contractor's methods and the vendor's software stay with them.

Many contracts were written before cloud analytics and remote access became routine, so they say a lot about drawings and warranties and little about trend data. Where contracts are silent, disputes turn on what was delivered at turnover, what the parties did in practice and which laws may apply, which is a question for counsel.

For a controls contractor, the useful question is narrower: which records can we keep, reuse or license, and which belong to customers?

Who controls what: owner, contractor and vendor#

The table shows the usual position for each type of record and who typically controls it. It reflects common contract patterns, not a legal rule, and any specific agreement can change the answer.

Contract clauses that decide ownership#

Ownership is settled, or left open, by a handful of clauses. Read these in every installation contract, service agreement and software license before deciding what you can do with the records.

Where clauses conflict, such as a broad confidentiality clause in the service agreement and a data-use clause in a platform's terms, counsel should decide which governs for the specific use you have in mind.

• 1Deliverables and work product: which programs, graphics and documents become the owner's property.
• 2License back: whether the contractor keeps the right to reuse code, libraries and standards on other jobs.
• 3Turnover and closeout: which programs, passwords, licenses and backups must be handed over.
• 4Data access and use: who may collect, store and analyze trend and alarm data during the service term.
• 5Confidentiality: whether building data counts as the owner's confidential information.
• 6Platform terms: whether the vendor may use aggregated or de-identified data, and for what purpose.
• 7Termination and transition: what each party keeps, returns or destroys when the agreement ends.

What a controls contractor can usually reuse#

A controls contractor can usually reuse its own internal records and know-how, subject to confidentiality terms, but needs permission to reuse a customer's building data. The distinction matters most when a contractor wants to analyze trend data across sites or license records to a third party.

Remote access adds a wrinkle. When a contractor connects to a site through a cloud gateway or a remote workstation, copies of trend data can end up on the contractor's own servers or in a vendor's analytics platform. Those copies usually remain the customer's building data under the contract, even though they sit on equipment the contractor controls. Map where copies live before assuming anything on your servers is yours to reuse.

Protecting your programming and libraries#

Programming libraries and sequence templates are often a controls contractor's most valuable know-how, and their legal protection depends on how the contractor treats them. Under the federal Defend Trade Secrets Act, information is a trade secret only if its owner has taken reasonable measures to keep it secret and it derives independent economic value from not being generally known.

Department of Justice guidance says protective measures need not be absolute but must be reasonable under the circumstances, such as limiting access on a need-to-know basis and requiring confidentiality agreements. Reasonable measures in a controls business may include confidentiality terms in customer and employee agreements, access controls on code repositories, marking libraries as confidential, and leaving on site only what contracts require at turnover. Handing unrestricted source libraries to every customer weakens that position.

The same logic runs in reverse. If a customer's confidential building information sits in your systems, your agreements may require you to protect it with similar care, and a careless reuse could breach them even when no harm follows.

Illustrative: a controls contractor reviews its agreements#

Illustrative: a fictional mechanical and controls contractor services building automation systems for office landlords and a university campus. Its leaders want to know whether years of service tickets, commissioning reports and trend data could be licensed to AI developers studying building operations.

Counsel reviews the service agreement templates. Most give the contractor ownership of its internal service records and require confidentiality for customer information; none grants rights to reuse trend data. One landlord's agreement expressly allows de-identified analytics.

The contractor scopes a license to its own service tickets and commissioning workflows, with site names and addresses removed, and asks that one landlord for written permission to include its trend data. Every other customer's trend logs stay out.

How SourceX handles building automation records#

SourceX handles building automation records by separating what a contractor owns from what its customers own before anything else happens. The rights step of the SourceX five-step transaction reviews installation contracts, service agreements and platform terms, and customer building data is excluded unless written permission covers the specific use.

For records that proceed, the SourceX Evidence Packet documents provenance, licensing rights, permitted use, the privacy record and release authorization. The contractor approves every step and keeps ownership, and large trend archives can stay in the contractor's own storage.