外包開發團隊合約範本解析：香港公司委託越南菲律賓團隊必備條款 2026

1## Schedule A — Scope of Services
2
3### 1. Project Description
4Development of a cross-border e-commerce platform ("the Platform") 
5consisting of:
6- Web application (React 19 + Next.js 15)
7- Mobile application (React Native 0.76)
8- Admin dashboard
9- REST API backend (Node.js 22 LTS + PostgreSQL 16)
10
11### 2. Deliverables
12<!-- table:table-1 -->
13
14### 3. Exclusions
15The following are explicitly excluded from this engagement:
16- Third-party API subscription fees
17- App Store / Google Play submission fees
18- Post-launch marketing or SEO services

1## Clause 7 — Use of AI-Assisted Development Tools
2
37.1 The Service Provider may use AI-assisted coding tools 
4    (including but not limited to GitHub Copilot, Cursor, 
5    Amazon CodeWhisperer) subject to the following conditions:
6
7    (a) All AI-generated code must be reviewed by a human 
8        developer before inclusion in any Deliverable;
9    (b) The Service Provider shall maintain a log of AI tool 
10        usage, including tool name, version, and percentage 
11        of AI-assisted code per module;
12    (c) The Service Provider warrants that AI-generated code 
13        does not infringe any third-party intellectual property 
14        rights;
15    (d) The Client retains the right to request removal of any 
16        AI-generated code segment.
17
187.2 The Service Provider shall not input any of the Client's 
19    proprietary data, trade secrets, or confidential information 
20    into any publicly hosted AI model or service.

1## Clause 9 — Data Protection Compliance (Vietnam)
2
39.1 The Service Provider shall comply with Decree 13/2023/ND-CP 
4    on Personal Data Protection, including:
5
6    (a) Completing a Data Transfer Impact Assessment (DTIA) 
7        prior to any cross-border transfer of personal data;
8    (b) Filing the required dossier with the Ministry of 
9        Public Security within the statutory timeline;
10    (c) Implementing encryption (AES-256 minimum) for all 
11        personal data at rest and in transit.
12
139.2 The Service Provider shall appoint a Data Protection 
14    Officer and provide the Client with their contact 
15    details within 14 days of contract execution.

1## Clause 11 — Payment Terms
2
311.3 The Client shall have 10 business days from receipt of 
4     each Milestone Deliverable to conduct acceptance testing. 
5     If the Deliverable fails to meet the Acceptance Criteria 
6     defined in Schedule B, the Client shall provide written 
7     notice specifying the deficiencies.
8
911.4 The Service Provider shall have 15 business days to 
10     remedy any identified deficiencies at no additional cost.
11
1211.5 Payment of the final 15% retention amount is contingent 
13     upon:
14     (a) 30 consecutive days of production uptime exceeding 
15         99.5%;
16     (b) Resolution of all Priority 1 and Priority 2 bugs;
17     (c) Complete handover of source code, documentation, 
18         and access credentials.

1# 範例：CI/CD pipeline 中的品質關卡設定 (GitHub Actions)
2name: Quality Gate
3on: [pull_request]
4jobs:
5  quality-check:
6    runs-on: ubuntu-latest
7    steps:
8      - uses: actions/checkout@v4
9      - name: Run tests with coverage
10        run: npm run test -- --coverage --coverageThreshold='{"global":{"branches":80,"functions":80,"lines":80}}'
11      - name: ESLint check
12        run: npx eslint . --max-warnings 0
13      - name: SonarQube scan
14        uses: SonarSource/sonarqube-scan-action@v3
15        env:
16          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
17      - name: Security scan
18        run: npx snyk test --severity-threshold=high

1## Clause 15 — Dispute Resolution
2
315.1 Any dispute arising out of or in connection with this 
4     Agreement shall be referred to and finally resolved by 
5     arbitration administered by the Hong Kong International 
6     Arbitration Centre (HKIAC) under the HKIAC Administered 
7     Arbitration Rules in force at the date of commencement 
8     of the arbitration.
9
1015.2 The seat of arbitration shall be Hong Kong.
11
1215.3 The arbitration shall be conducted in English.
13
1415.4 The number of arbitrators shall be one (1) for disputes 
15     under HKD 5,000,000 and three (3) for disputes at or 
16     above that threshold.
17
1815.5 This Agreement shall be governed by and construed in 
19     accordance with the laws of the Hong Kong Special 
20     Administrative Region.

1#!/bin/bash
2# contract-compliance-check.sh
3# 自動檢查交付物是否符合合約品質標準
4
5echo "=== Contract Compliance Check ==="
6echo "Date: $(date +%Y-%m-%d)"
7
8# 1. 測試覆蓋率檢查
9COVERAGE=$(npm run test -- --coverage --json 2>/dev/null | jq '.coverageMap.total.lines.pct')
10if (( $(echo "$COVERAGE >= 80" | bc -l) )); then
11  echo "✅ Test coverage: ${COVERAGE}% (threshold: 80%)"
12else
13  echo "❌ Test coverage: ${COVERAGE}% — BELOW CONTRACT THRESHOLD"
14fi
15
16# 2. ESLint 錯誤檢查
17LINT_ERRORS=$(npx eslint . --format json 2>/dev/null | jq '[.[].errorCount] | add')
18if [ "$LINT_ERRORS" -eq 0 ]; then
19  echo "✅ ESLint: 0 errors"
20else
21  echo "❌ ESLint: ${LINT_ERRORS} errors — REQUIRES REMEDIATION"
22fi
23
24# 3. 安全漏洞掃描
25SNYK_HIGH=$(npx snyk test --json 2>/dev/null | jq '[.vulnerabilities[] | select(.severity=="high" or .severity=="critical")] | length')
26if [ "$SNYK_HIGH" -eq 0 ]; then
27  echo "✅ Security: 0 high/critical vulnerabilities"
28else
29  echo "❌ Security: ${SNYK_HIGH} high/critical vulnerabilities — BLOCKING"
30fi
31
32echo "=== Check Complete ==="