What is source code escrow / software escrow

Software escrow diagram

Source code escrow is a way to ensure that critical software can continue operating even if its vendor ceases operations, changes ownership, terminates support or breaches the contract.

The secure deposit stores source code, documentation and other materials required to operate the information system.

Based on a tripartite or bipartite escrow agreement, the escrow holder (software escrow agent) takes custody of the deposited materials as an independent party and releases them only in predefined cases or situations.

If the release conditions are not met, the stored data is permanently deleted.

Why are source codes so important?

Source code is the foundation of the entire information system.

Without it, it is not possible to:

  • fix bugs,
  • add new functionality,
  • migrate the system to a new server,
  • keep the system technically alive.

Vendors usually provide customers only with compiled code, which is not sufficient for long-term operation.

Why a developer may not want to hand over source code

A developer may not want to give source code directly to a customer because it represents their trade secret, know-how and competitive advantage.

By handing it over, the developer could lose control over security and future development of the system.

Escrow allows the code to be stored safely: the customer receives it only when precisely defined conditions are met, so both parties are protected.

Security and trustworthiness

  • We have been providing our services since 2009.
  • Data accepted into escrow is always strongly encrypted and password-protected.
  • We store data within the European Union, in a data centre certified to ISO/IEC 27001.
  • We use modern technologies and processes for data archiving.
  • Our methods follow the principles of the European eIDAS regulation.
  • Our procedures are fully auditable and provable.

What is included in escrow

  • application source code, libraries and modules
  • build scripts, configuration files, CI/CD pipelines
  • database schemas and migration scripts
  • installation and deployment documentation
  • list of external dependencies

Technical verification / content audit

  • Acceptance and identification of escrow content
  • Integrity and completeness check
  • Analysis of project structure and dependencies
  • Verification of reproducible build or deployment
  • Technical validation of the running application
  • Functional testing of selected features

Detailed description

Escrow agreement

The agreement includes these essentials:

  • Contracting parties
  • Scope and content of escrow
    Definition of deposited materials, update method and responsibilities of individual parties.
  • Conditions for release from escrow
    Clearly defined trigger events, such as vendor termination, breach of contract or loss of support.
  • Connection to other contractual documentation