- One template for all eight "What we deposit" pages, as production has: hero, why it matters for recovery, what's included, how it gets in and how it's proven, which protection fits, the other seven materials, the evidence pack, FAQ and close. Every page follows the same fictional SaaS application, Booking Hub (also on the SaaS escrow page), so the set reads as one story: one application needs several kinds of material to come back.
- Headline: keeps the search phrase (long, so the mint phrase is kept to four words); the sub names both kinds of dependency.
- Visual: a mock of what this part of the deposit holds. Production's hero image couldn't be opened from the kit to check it for old product names, so it isn't reused; swap it back only after someone has checked it.
- Dropped: "Book a free demo" (now Book a demo), the closing line "Let's build bulletproof software resilience together", the press quotes with publication logos (Product Hunt and two others; not customer reviews, and the logos need permission), the third-party tool logos, the per-page e-book block (the sample evidence pack band replaces it) and "Unlimited automated deposits", "can turn minor disruptions into major outages" (fear line), the Adyen, Chargebee, Mailchimp, Okta, Sendbird, Shopify, Stripe and Twilio logos, and "start at $195/month".
Third-party dependencies escrow. What it relies on.
Applications call payment, email, identity and messaging services, and they're built on libraries and packages. Codekeeper holds what it takes to maintain or replace them: configuration, API references, private packages and access details, kept current and checked.
From $199. Per application per month, with the protection you choose.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- AES-256 encryption at rest
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
Why it matters for recovery
An application is only as recoverable as what it depends on.
If the vendor stops, its accounts with payment, email and identity providers can lapse, and the details of how each one is wired in can go with them. A rebuilt application that can't take a payment or send an email isn't back yet.
Dependencies left undocumented
- Service accounts and settings known only to the vendor
- Private packages missing, so the build stops
- No list of what the application calls, or why
Dependencies with Codekeeper
- Configuration, API references and integration diagrams for each service
- Private packages held with the code, and with Pro, an SBOM from each rebuild
- With Continuity, critical services mapped at setup and kept paid and switched on for an agreed period
What's included
What a dependencies deposit holds.
The agreement lists the services and packages in scope, and what's deposited for each. For most applications, that means:
- Service configuration. How each external service is set up and connected: its settings and configuration files.
- API references and SDK instructions. What the application calls, and how.
- Integration diagrams. Where each service fits, and what depends on it.
- Libraries and private packages. The packages the build needs, including in-house ones that can't be fetched from anywhere else.
- Access details. The accounts and keys used to manage each service, held as credentials.
That covers payment, billing, email, messaging, identity and commerce services, as well as hosting components and managed runtimes.
- Usually part of
- SaaS deposits, and any application that calls external services
- How it gets in
- With the code through integrations, or secure upload
- How it's checked
- Automated check, with a vault report
- How it's proven
- With Pro, resolved in a rebuild and listed in an SBOM
How it gets in, and how it's proven
Listed, resolved and kept current.
Packages and configuration arrive with the code; service details and access are deposited alongside. With Pro, a rebuild shows whether everything resolves.
Connect or upload
Packages and configuration in your repositories arrive with the code through our 50+ integrations and sync daily. Upload API references, diagrams and service details securely, and deposit access details as credentials.
Checked and certified
An automated check confirms what's in the deposit, with a vault report, and you receive a Software Resilience Certificate.
Resolved in a rebuild, with Pro
AI agents rebuild the application in the Codekeeper AI Verification Lab, cut off from the open internet. Anything the build can't find, such as a private package, is flagged so it can be added, and each run returns an SBOM.
Watched between runs
With Pro, we compare the deposit with the live repositories and flag what changed, so you know when to rebuild.
Software Resilience Certificate
The dependency details and packages are held with the code, and an automated check confirms what's there, with a vault report.
Proves: it's there.
Recoverability Certificate
AI agents rebuild the application in the Codekeeper AI Verification Lab, with no help from the vendor, in hours. You get the run report, an SBOM of the components used and an Exit workbook.
Proves: it builds. Agentic Verification
Tested Exit Report
Our specialists rebuild by hand in a clean room and test the business functions you nominate, without the original developers.
Proves: you could exit and keep working. Exit Exercise
The higher you go, the more it proves. The Recoverability Certificate documents the rebuild; release rights come from the agreement. How verification works
Which protection fits
Choose who reconnects the services.
Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on.
Escrow
Released to you→Self-Run Recovery
The dependency details are released to you, so your team can reconnect each service or replace it. Explore Escrow
From $199
Resilience
Comes to us→Managed Recovery
They come to Codekeeper, and we use them to reconnect or replace each service in the recovery we run. Explore Resilience
From $399
Continuity
Live service kept on+Managed Recovery
Critical services the vendor pays for are mapped at setup and kept paid and switched on for an agreed period while we recover. Explore Continuity
From $1,449
Software list prices, per application per month; SaaS and AI have their own rows. Escrow Pro (from $449), Resilience Pro (from $649) and Continuity Pro (from $1,699) add Agentic Verification. Setup is $499 per arrangement, or $999 for Continuity. See all prices
Everything else we deposit
One application. Eight kinds of material.
An application usually needs more than one of these to come back. The agreement lists which ones your deposit holds, and they're checked together.
Source code
The codebase, scripts and libraries the application is built from.
Source code escrowDeployment assets
Build scripts, pipelines and infrastructure definitions that turn code into a running system.
Deployment assets escrowData
Database exports, reference data and the files the application needs to work.
Data escrowDocuments
Installation guides, architecture and runbooks: how to build, run and support it.
Document escrowThird-party dependencies
What it takes to maintain or replace the services and packages it relies on.
You're on this pageIP and designs
The designs, diagrams, algorithms and research behind the application.
IP escrowHosting environment
Where it runs and the accounts it depends on, mapped and kept current.
Hosting environment escrowCredentials
The logins, billing roles and keys needed to manage where it runs.
Credentials escrowSample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
Questions
Third-party dependencies escrow, answered.
What is third-party dependencies escrow?
An agreement in which a software vendor deposits the information needed to maintain or replace the external services and packages its application relies on, with a neutral party such as Codekeeper. If an agreed release condition is met, the materials are released to the beneficiary.
What's included in a deposit?
Service configuration, API references and SDK instructions, integration diagrams, the libraries and private packages the build needs, and access details. The agreement defines exactly what's in scope.
Can you keep a third-party service running if the vendor stops?
With Continuity, we map the services the application needs at setup and keep the map current. If the vendor stops, we keep them paid and switched on for an agreed period while we recover, and recharge the bills at cost. Each service still runs under its provider's own terms.
Do you know which components the application uses?
With Escrow Pro, Resilience Pro and Continuity Pro, each rebuild returns an SBOM: a list of the components the build used. Anything the build needed but couldn't find is flagged.
How are access details held?
Like every deposit: encrypted at rest with AES-256 and in transit with TLS, by a company certified to ISO/IEC 27001:2022. See credentials escrow and the Trust Center.
Keep what it relies on within reach.
We'll go through the services and packages your application depends on, and what a deposit would hold.