Latest / Hardware Startups with Fexingo: Devices, Robotics, and Manufacturing Tech Companies / How Hardware Startups Protect IP During Contract Manufacturing
Transcript
- Lucas: If these conversations are useful for what you're building or running, a couple of dollars a month is genuinely what keeps these shows going — buy me a coffee dot com slash fexingo, if you've gotten something out of them. Luna: Yeah, it makes a real difference. No pressure, but if you've learned something, it helps. Lucas: Alright, today we're talking about something every hardware founder I know has lost sleep over: how do you hand your design to a contract manufacturer without handing them the keys to your entire business? Luna: It's the classic 'trust but verify' problem, except the verification part can get expensive if you get it wrong. Lucas: Right. And it's not just about signing an NDA. NDAs are important, but they're paper. I want to talk about three concrete tactics that cost very little but create real separation between what your C-M gets and what they could actually copy. Luna: Let's start with the first one — split-bom sourcing? Lucas: Exactly. Split bill of materials. The idea is simple: you don't let your contract manufacturer source all the parts for your product. You source the critical, custom, or hard to find components yourself and ship them directly to the C-M as a kit. Luna: So the C-M sees the full BOM, but they never get a complete supplier list for the key pieces. Lucas: Right. They know they need this specific sensor, but they don't know who makes it, what it costs, or how you qualified it. That alone raises the bar for anyone thinking about cloning your product. Luna: I've heard founders worry that this makes logistics harder — you're managing two supply chains instead of one. Lucas: It does add complexity. But the trade-off is usually worth it, especially in the early production runs. You can always transition to full turnkey later once you've established trust and maybe filed some patents. Luna: Second tactic — firmware locks. This is where hardware gets really interesting. Lucas: Yeah, this is probably the single most effective thing you can do. If your product has any kind of microcontroller or processor, you can lock the firmware to the specific chip using a unique ID or a crypto authentication chip. Luna: So even if someone gets the hex file, they can't flash it into a different board. Lucas: Exactly. The chip checks a signature at boot. No valid signature, no operation. It's not unbreakable — nothing is — but it raises the effort required from 'teenager with a screwdriver' to 'state-level reverse engineering lab.' Most copycats won't bother. Luna: And you can combine that with a staged release where you only ship the C-M the bare minimum firmware needed for production testing. Lucas: That's the third tactic — staged release. You don't give them the final production firmware until the very last minute. You give them a test firmware that exercises the hardware but doesn't include your secret sauce — the calibration algorithms, the proprietary control loops, the user interface logic. Luna: I talked to a founder last month who does this with a secure portal. The C-M flashes a base firmware at the factory, then the final firmware is downloaded over the air only after the device is in the customer's hands. Lucas: That's next-level. And it works because the C-M never has the final image on their network. They can't leak what they don't have. Luna: Let's talk about a real example. There was a robotics startup in Austin — I won't name them — that designed a very efficient motor controller. They sent it to a C-M in Shenzhen for a pilot run of 500 units. Lucas: What happened? Luna: Within three months, a nearly identical controller showed up on Alibaba for half the price. The startup's C-M had spun up their own version using the same PCB layout, same components, just with the firmware stripped out. The startup had no patent, no firmware lock — they were selling a commodity hardware board with software value. Lucas: That's the nightmare. And it could have been avoided with a simple crypto chip that costs thirty cents. The firmware would have been useless on the cloned boards. Luna: Right. And the split-bom approach would have made it harder for them to source the exact same sensor suite. Lucas: The sad part is, the startup didn't even think about IP protection until it was too late. They were so focused on getting the product out the door. Luna: It's a common trap. You think 'we're just doing a pilot, nobody will copy us yet.' But the C-M sees hundreds of startups. They know which ones have valuable IP. Lucas: So what's the counterargument? I've heard some founders say, 'If I make it too hard for the C-M to do their job, they'll drop me.' Luna: That can happen. But a good C-M will understand. The ones that push back hard on these protections — that's a red flag. Lucas: Exactly. You want a partner, not someone who insists on having full access to everything. And you can frame it as quality control: 'We need to ensure only authentic parts go into our product.' Luna: Another thing I've seen work is using a third-party programming house. You send them the firmware, they program the chips, and they ship the programmed chips directly to the C-M. The C-M never touches the binary. Lucas: That's a great example of physical separation. And it costs maybe an extra ten cents per chip, but it completely removes the risk. Luna: What about patents? Do they help in practice? Lucas: Patents help if you have the resources to enforce them. For a startup that's bootstrapping, a patent is mostly a deterrent and a signal to investors. It won't stop a C-M in a jurisdiction where enforcement is weak. Luna: So the real protection is operational, not legal. Lucas: Exactly. The paper is secondary. The primary protection is how you structure your supply chain and your firmware delivery. Luna: I want to come back to the staged release point, because I think it's underused. Most startups treat firmware as a final delivery, not a phased handoff. Lucas: Right. You can give them a test firmware that does loopback checks, power-on self-tests, maybe a simple blink pattern. That's enough for them to validate that the board works. Then once the units are shipped, you push the real firmware over-the-air or through a secure update mechanism. Luna: That also gives you an advantage: you can fix bugs after the hardware is built. The C-M can't ship a flawed final image because they never had it. Lucas: Good point. It's both a security and a quality play. I think the key takeaway for any hardware founder listening is: don't assume your C-M is your enemy, but don't assume they're your ally either. They're a business partner with their own incentives. Luna: And those three tactics — split-bom, firmware locks, staged release — are cheap enough that there's no excuse not to do them from day one. Lucas: Yeah. Even if you're only building a hundred units, you should think about it. Because if you succeed, those hundred units are just the beginning, and the risk scales with volume. Luna: One last thing — what about signing a manufacturing agreement that explicitly prohibits the C-M from using your tooling for other customers? Lucas: That's important too. You want to own your molds, your test fixtures, your programming jigs. Make sure the contract says 'these are our assets, not yours.' And enforce it with regular audits if you can. Luna: Alright, I think we've given the listeners a solid checklist. Anything else you'd add? Lucas: Just one thing: talk to other founders who have used the same C-M. Reputation matters more than any contract. A C-M that has a history of respecting IP is worth ten times the cheapest quote. Luna: Good advice. That's it for this episode of Hardware Startups with Fexingo.