To start an IT company in the United States, you form a legal entity with your state, get a federal tax ID, open a separate business bank account, and then layer on the obligations that specifically apply to technology businesses: code ownership language in every contractor agreement, correct worker classification, data security and breach notification compliance, professional and cyber liability insurance, and sales tax registration in states where your software or services are taxable. The entity paperwork takes a few weeks and costs a few hundred dollars in filing fees. The compliance work that follows is where founders get into trouble.
Pick an Entity That Fits How You Plan to Grow
Your entity choice shapes personal liability, taxation, and your ability to raise capital. Four structures are worth knowing.
A sole proprietorship is the default if you file nothing. Business income goes on your personal return and no formation paperwork exists. The problem is unlimited personal liability. In an industry where one botched deployment can cost a client six figures, exposing your home and savings to that risk is hard to defend.
A limited liability company is the most common structure for small IT firms. It separates personal assets from business debts and lawsuits. By default the IRS treats a single-member LLC as a disregarded entity, so profits flow to your personal return without a corporate-level tax. Multi-member LLCs are taxed as partnerships by default. Paperwork and ongoing compliance are lighter than for a corporation.
An S corporation is a tax election, not an entity type. An LLC or corporation makes the election by filing Form 2553 with the IRS. Income, losses, and deductions pass through to shareholders’ personal returns, which avoids the double taxation that hits a regular corporation. For IT founders the appeal is splitting income between a reasonable salary (subject to payroll tax) and distributions (not subject to payroll tax), which can reduce self-employment tax. S-corps are capped at 100 shareholders and one class of stock, so they don’t work for venture-backed companies.1Internal Revenue Service. S Corporations
A C corporation is the structure designed for outside investment. It can issue multiple classes of stock, has no shareholder cap, and is what venture capitalists expect. The tradeoff is double taxation. One significant offset for tech founders is the Section 1202 exclusion for qualified small business stock: if the C-corp’s gross assets stay below $50 million at issuance and you hold the stock for at least five years, you may exclude up to 100 percent of the capital gain on sale. Section 1202 excludes businesses whose principal activity is consulting, engineering, or certain other professional services, so an IT consulting firm may not qualify while a software product company likely does.2Office of the Law Revision Counsel. 26 U.S. Code 1202 – Partial Exclusion for Gain From Certain Small Business Stock
Most IT companies that aren’t chasing venture capital start as LLCs. If institutional funding is part of the plan from day one, a Delaware C-corp is the standard path because investors and their counsel already know the framework.
Clear and Protect Your Business Name
Every state requires your business name to be distinguishable from names already on file with the Secretary of State. Search the state’s business name database before filing. The name must include a legal designator identifying the entity type: “LLC” or “L.L.C.” for a limited liability company, “Inc.” or “Corp.” for a corporation.
Clearing a name with the Secretary of State does not give you trademark rights. Another company in a different state may already be using the same name for similar IT services, and if they have common-law trademark rights or a federal registration, they can force you to rebrand. For an IT company that operates online and serves clients across state lines, this is a live risk. A state filing protects your name only within that state’s business registry; it says nothing about trademark law.
Federal trademark registration through the USPTO gives you presumed nationwide rights and the ability to stop others from using a confusingly similar name in your industry. Filing starts at $350 per class of goods or services through TEAS Plus, or $550 per class through TEAS Standard.3United States Patent and Trademark Office (USPTO). USPTO Fee Schedule Average time from filing to registration is roughly ten months.4United States Patent and Trademark Office (USPTO). Trademark Processing Wait Times You don’t need to register before launching, but filing early locks in a priority date against later applicants.
File Your Formation Documents
The paperwork that creates your entity is called the Articles of Organization for an LLC or the Articles of Incorporation for a corporation. The forms come from your state’s Secretary of State, usually as downloadable PDFs or through an online portal. Before you start, have the following ready.
- The exact business name and entity type, including the legal designator.
- A registered agent with a physical street address in the state of formation, available during business hours to receive legal documents and government notices. You can serve as your own, but many founders use a professional service so a home address doesn’t end up in public records.
- A principal office address. Most states will not accept a P.O. Box.
- Names and addresses of organizers or directors. For an LLC, the members or managers. For a corporation, the initial directors.
- Company duration. Most founders choose perpetual, meaning the entity exists until you formally dissolve it.
Most states now offer online filing with turnaround in a few business days; paper filings typically run two to four weeks. Filing fees generally fall between $50 and $500. Expedited processing is often available for an extra fee when a contract start date or funding deadline is on the line.
Once approved, you’ll receive a stamped copy of your filed documents or a Certificate of Good Standing. Keep it accessible. You’ll need it to open a bank account, apply for licenses, register in other states, and respond to client and investor due diligence.
Write the Operating Agreement or Bylaws
Operating agreements for LLCs and bylaws for corporations are internal documents that most states don’t require you to file publicly. Skipping them is one of the most common early mistakes. Without a written operating agreement, your LLC defaults to whatever your state’s statute says about profit splits, voting rights, and member exits. Those defaults rarely match what the founders actually agreed to.
An LLC operating agreement should at minimum cover how profits and losses are allocated, each member’s contribution, who has authority to sign contracts, and what happens if a member dies or leaves. Corporate bylaws should define the roles of directors and officers, how board meetings are called and conducted, and procedures for issuing stock. These documents also serve as evidence that you’re treating the company as a genuine separate entity, which matters if your liability protection is challenged in court.
Get an EIN and Separate the Money
An Employer Identification Number is a nine-digit federal tax ID that functions like a Social Security number for the business. The IRS issues EINs for free online and provides the number immediately upon completion.5Internal Revenue Service. Employer Identification Number You need one to file federal tax returns, hire employees, and open a business bank account.
A separate business bank account is your first line of defense against piercing the corporate veil. Running business expenses through personal checking, depositing client payments alongside your paycheck, or paying personal bills from the business account lets a court decide your LLC or corporation is just an alter ego. At that point the liability shield disappears and creditors can go after personal assets. Clean, documented transactions in a dedicated account make that argument much harder to win.
Classify Workers Correctly From the First Hire
IT companies routinely mix full-time employees with independent contractors, and misclassification is one of the fastest ways to trigger an IRS audit, a Department of Labor investigation, or both. The IRS evaluates three categories: behavioral control (do you direct how and when the work gets done?), financial control (do you provide tools, reimburse expenses, and control how the worker is paid?), and the type of relationship (written contract, benefits, expectation of indefinite work?).6Internal Revenue Service. Independent Contractor (Self-Employed) or Employee? No single factor is decisive.
A developer who works exclusively for you, uses your equipment, attends your stand-ups, and follows your deployment schedule is almost certainly an employee regardless of what the contract calls them. Misclassification penalties include back payroll taxes, interest, and penalties for each worker. Getting it wrong across a team of five contractors can cost tens of thousands of dollars.
For every employee you hire, complete Form I-9 to verify employment eligibility. Section 2 must be finished within three business days of the employee’s first day of work for pay.7U.S. Citizenship and Immigration Services (USCIS). Completing Section 2, Employer Review and Attestation If you hire IT professionals under the FLSA’s computer professional exemption, the currently enforced salary threshold is $684 per week ($35,568 annually), or $27.63 per hour for hourly workers.8U.S. Department of Labor. Earnings Thresholds for the Executive, Administrative, and Professional Exemption From Minimum Wage and Overtime Protections Under the FLSA Pay below those thresholds means the worker is entitled to overtime regardless of job title.
Make Sure You Actually Own Your Code
Code ownership catches more IT founders off guard than almost any other legal issue. When a full-time employee writes software within the scope of their job, copyright law generally treats that code as a “work made for hire” and the company owns it automatically. When an independent contractor writes code for you, the contractor owns the copyright by default. A contract calling the deliverables a “work made for hire” is not sufficient on its own, because software doesn’t fall neatly into the statutory categories eligible for work-made-for-hire treatment.
The safe approach is to include both a work-made-for-hire clause and a separate assignment clause in every contractor agreement, so that if the work-for-hire designation fails, the contractor has already assigned all rights to you. Without proper assignment language, a disgruntled contractor could claim ownership of your core product’s codebase. Fixing that after the fact, through negotiation or litigation, costs far more than drafting the contract correctly in the first place.
Protect client relationships and proprietary methods with non-disclosure agreements. If you’re building a product rather than providing services, consider whether patent protection makes sense for novel technical approaches.
Carry the Right Insurance
Your entity’s liability shield protects personal assets from business debts. It does nothing to protect the business itself from claims. IT companies face two distinct risk categories that each need their own coverage.
Professional liability insurance, usually called Errors and Omissions (E&O) insurance, covers claims that your work product caused financial harm to a client. A misconfigured server causing downtime, a software bug corrupting data, a missed deadline costing a client revenue — all can trigger E&O claims. Many enterprise clients and government contracts require proof of E&O coverage before they’ll sign a statement of work.
Cyber liability insurance is separate and covers your exposure when a data breach, ransomware attack, or other security incident affects your company or your clients’ data. A typical policy covers forensic investigation, breach notification costs, legal defense, regulatory fines, and data restoration. For any IT company that handles client credentials, personal data, or financial information, cyber coverage is not optional in any practical sense. Some policies bundle E&O and cyber liability into a single technology package, which reduces gaps between policies.
Depending on the state, workers’ compensation insurance kicks in once you hire your first non-owner employee.
Meet Your Data Privacy and Breach Notification Obligations
IT companies sit in a uniquely exposed position because they often have access to clients’ systems, credentials, and customer data. Federal law does not impose a single comprehensive data privacy statute on all businesses, but the FTC enforces a general requirement under its authority to police unfair or deceptive practices. The FTC expects businesses to implement reasonable data security measures proportional to the sensitivity of the information they handle, and it has brought enforcement actions against companies whose practices fell short.9Federal Trade Commission. Data Security “Reasonable” is not a checklist; it’s a standard the FTC applies based on company size, data sensitivity, and industry norms.
On the state side, all 50 states, the District of Columbia, and U.S. territories have enacted data breach notification laws requiring businesses to notify affected individuals when a breach exposes personally identifiable information like Social Security numbers, financial account numbers, or login credentials.10National Conference of State Legislatures. Summary Security Breach Notification Laws Notification deadlines, what counts as a breach, and whether you must also notify a state attorney general vary by jurisdiction. An IT company with clients in multiple states must comply with every state’s law where affected individuals reside.
Building security practices in from day one — encryption, access controls, documented incident response, regular vulnerability assessments — is far cheaper than responding to a breach after the fact.
Handle Sales Tax on SaaS and Digital Services
If your IT company sells software-as-a-service, downloadable software, or other digital products, you may need to collect and remit sales tax in states where those products are taxable. Roughly half the states tax SaaS or digital services in some form, but the rules are inconsistent. Some states tax SaaS the same as tangible goods. Others exempt it entirely. A few tax it only for business-to-consumer transactions.
Even without a physical office in a state, you can trigger a sales tax collection obligation through economic nexus. The common threshold is $100,000 in annual revenue or 200 transactions in a given state, though exact numbers vary. For an IT company selling subscriptions nationwide, filing obligations can appear in a dozen or more states quickly. Tracking nexus thresholds and maintaining compliance across jurisdictions typically requires specialized software or a tax advisor experienced in multi-state SaaS taxation.
Register in Other States When You Expand or Hire Remote
If your IT company is formed in one state but conducts business in another, whether by hiring a remote employee there, maintaining an office, or having sustained physical presence, you likely need to file a foreign qualification. “Foreign” here doesn’t mean international; it means any state other than where you were formed.
Foreign qualification typically requires an application with the other state’s Secretary of State, a registered agent in that state, and a Certificate of Good Standing from your home state. You’ll owe that state’s filing fee and be subject to annual report requirements going forward. Operating in a state without proper registration can result in fines and, more importantly, the loss of your right to sue in that state’s courts, so you can’t enforce contracts against clients there until you register and pay any back penalties.
The remote-employee trigger is one IT companies particularly need to watch. Even one full-time remote worker in another state can create enough nexus to require foreign registration, along with potential payroll tax withholding and workers’ compensation obligations in that state.
Stay in Good Standing Year After Year
Formation is a one-time event. Staying in good standing is perpetual. A few recurring obligations catch IT founders off guard when they’re ignored.
Most states require LLCs and corporations to file an annual or biennial report to keep the entity active. Fees range from nothing in a few states to several hundred dollars, with most under $100. Miss the deadline and the state can administratively dissolve your entity, which means your liability protection evaporates until you reinstate.
The IRS requires business tax records be kept at least three years from the filing date, or two years from the date you paid the tax, whichever is later. Employment tax records have a longer minimum: at least four years after the tax is due or paid.11Internal Revenue Service. How Long Should I Keep Records Records for property you depreciate, including servers, computers, and other equipment, should be kept until at least three years after you dispose of the asset.
Many local jurisdictions require a general business license, and some impose occupation-specific requirements for technology services. These licenses are typically renewed annually and may include a fee based on gross receipts. Check with your city or county’s business licensing office rather than assuming state formation covers everything.
If your IT company owns servers, networking equipment, laptops, or other tangible assets, you may owe business personal property tax to your local jurisdiction. About three dozen states impose some form of this tax, though many exempt property below a certain value. The filing is your responsibility: you typically itemize each asset with its acquisition cost, date, and depreciation schedule on an annual return filed with your county or city assessor.