Software escrow: terms, testing and continuity

Software escrow may help when your business depends on software whose required materials remain with a supplier. A third party holds agreed materials, with conditions for access if a specified event occurs. That isn’t a promise of uninterrupted service. This guide explains the questions that determine whether an arrangement is useful. Our article on code ownership covers rights and handover for custom software; the custom software guide explains the broader project approach.

What does software escrow arrange?

An escrow agreement describes the relationship between the supplier depositing materials, the beneficiary who may receive access and the party holding them. In its explanation of software escrow, provider Escode identifies deposited materials, release conditions and permitted usage rights among the contract elements.

Start with the task your business needs to continue. Is temporary manual working possible? Do you mainly need access to historical records, or must the same application be available again quickly? Those goals may require different measures.

A source-code copy doesn’t replace an export if you only want to move case records into another package. A data export doesn’t replace the application if you need its calculations or particular workflow. Define the intended outcome first.

Which materials should you discuss?

Have each item described, including how its version can be identified. Use this table as a discussion list, not a guarantee that every escrow product includes everything.

Item	Question for supplier and escrow provider	What should you be able to check later?
Source code	Which application and version are covered?	Do the materials match the version you use?
Required components	Which libraries or licences are needed?	Will they be available and usable during recovery?
Build and installation instructions	What must a successor do?	Do the instructions produce a working application?
Configuration	Which environment settings are required?	Are manual settings documented?
Data and files	What is protected separately?	Are exports, attachments and relationships usable?
Access	Which rights and permissions are needed after release?	Who can lawfully provide them?
Verification	What is tested, and against which version?	Which findings have been resolved or remain open?

Ask how changes are handled. A new release may need different settings or components. Current code paired with old instructions may not form a usable recovery package. Agree who is responsible for consistency and what evidence you receive.

Secrets, customer data and licences need suitable security and usage arrangements. Don’t copy a collection of passwords and personal data to a third party without assessment. The agreement and technical setup must fit what’s actually being held.

How does release work when something goes wrong?

Release follows the agreed procedure. Escode’s release management, for example, includes written notice, an opportunity for the supplier to respond and a route for disputes. Exact conditions vary by agreement. Don’t assume immediate access as soon as a problem occurs.

Discuss which events matter to your dependency and what evidence is required. Have a lawyer assess the agreement, usage rights and position in insolvency. A general explanation or standard document doesn’t predict how your specific situation will unfold.

The business also needs to know who makes decisions in the meantime. Who requests materials, who can commission a recovery environment and who communicates with users? Prepare those responsibilities before they become urgent.

What does verification establish, and what remains untested?

Safekeeping and verification are different activities. Escode distinguishes, for example, between building in the supplier’s environment and an independent rebuild in a clean environment. That helps frame a focused question: has someone demonstrated that another party can use the deposited materials, or only that they work at the current supplier?

Ask about the report’s scope. Was the software only built, also started or tested through relevant user tasks? Which components or services were excluded? A successful check on one date doesn’t prove that later changes also work.

Consider a hypothetical scheduling application. The code builds and its login screen opens. But schedules won’t load because documentation for an external integration is missing. The result establishes that the software builds, not yet that employees can plan work. The missing step needs investigation and a fresh test.

Give unresolved findings an owner. Agree who supplies missing materials and when another check happens. Otherwise, the same known gap can remain while the application continues to change.

What changes with SaaS escrow?

With SaaS, the supplier or its infrastructure partners operate the service. Escode’s SaaS recovery guidance therefore also addresses infrastructure, configuration and deployment alongside source code. The SaaS escrow label alone doesn’t establish which support your contract provides.

Map data separately. Where are current business records held, which export is available and how does it fit the version being restored? Ask what happens to changes made between the last available export and the service stopping. That’s a business decision about potentially re-entering work, not just a technical question.

Investigate services outside the package too, such as email, authentication, payment or an integration with another business application. A rebuilt environment doesn’t automatically have access to them. Our guide to connecting software helps describe the exchanges and responsibilities involved.

A recovery plan therefore needs both technology and execution. Who provides the environment, checks data and decides whether users can resume work? Rehearse these steps for the tasks your business can’t do without. Start with what you need to demonstrate, rather than an assumed recovery time.

Is code ownership an alternative to escrow?

Ownership, access and escrow answer different questions. If you already hold the required materials and a successor can use them, that may meet part of your continuity need. An ownership agreement alone doesn’t make missing instructions or services available, though.

Conversely, escrow may arrange access without transferring every intellectual property right. Examine the operations permitted after release. May another maintainer perform the required work, and which restrictions remain? Align those rights with the intended recovery.

With TopDevs custom software, the code is and remains yours, with technical documentation and handover. Whether an additional arrangement is useful depends on the application and remaining dependencies. There’s no universal project price below which continuity stops mattering or above which escrow automatically becomes the right choice.

How do you compare the cost of escrow arrangements?

Request specific quotes for the same application and desired checks. Have setup, safekeeping, updates, verification and release assistance identified separately. Check who pays and which activities are charged again after a change. This article gives no market price: an annual range would explain little without that scope.

Also budget for work after release. Receiving materials, building an environment and checking business data aren’t the same service. If nobody is available to do that work, a paid deposit won’t solve the problem. Our software cost guide separates one-off activities from recurring maintenance.

Compare the agreement with other ways of meeting the same goal, such as a tested handover, usable exports or a temporary alternative process. Assess what each proposal demonstrably enables. The lowest storage fee isn’t automatically the cheapest recovery plan.

How do you actually get started?

Choose the application whose loss would affect the most work. Describe the task you must continue and which materials are demonstrably available. Discuss gaps with your supplier and, if escrow seems relevant, a specialist provider. Align the legal arrangements and technical trial with the same recovery goal.

If you’re commissioning custom software development, address continuity in the assignment. With existing software, start by understanding dependencies and making a plan you can test. Book a call to discuss its technical side.