Well, I guess encrypting should be looked into after you verify from the contract that the client doesn't have right to the source code. If he does, you have to work it out with them.