NewResilience, Continuity, the Pro levels and Agentic Verification: from safekeeping to proof you can recover.The new line-up is here.See what's new
Why this page looks like this. Production's /3rd-party-dependencies files dependencies under "SaaS Escrow" and promises they "remain accessible, supported, and recoverable when it matters most". In the new model they're one of eight materials a deposit can hold. The page covers both kinds: external services the application calls, and the packages it's built with (which a rebuild resolves and an SBOM lists). It touches security, so it states only confirmed facts about how access details are held.
  • One template for all eight "What we deposit" pages, as production has: hero, why it matters for recovery, what's included, how it gets in and how it's proven, which protection fits, the other seven materials, the evidence pack, FAQ and close. Every page follows the same fictional SaaS application, Booking Hub (also on the SaaS escrow page), so the set reads as one story: one application needs several kinds of material to come back.
  • Headline: keeps the search phrase (long, so the mint phrase is kept to four words); the sub names both kinds of dependency.
  • Visual: a mock of what this part of the deposit holds. Production's hero image couldn't be opened from the kit to check it for old product names, so it isn't reused; swap it back only after someone has checked it.
  • Dropped: "Book a free demo" (now Book a demo), the closing line "Let's build bulletproof software resilience together", the press quotes with publication logos (Product Hunt and two others; not customer reviews, and the logos need permission), the third-party tool logos, the per-page e-book block (the sample evidence pack band replaces it) and "Unlimited automated deposits", "can turn minor disruptions into major outages" (fear line), the Adyen, Chargebee, Mailchimp, Okta, Sendbird, Shopify, Stripe and Twilio logos, and "start at $195/month".
What we deposit

Third-party dependencies escrow. What it relies on.

Applications call payment, email, identity and messaging services, and they're built on libraries and packages. Codekeeper holds what it takes to maintain or replace them: configuration, API references, private packages and access details, kept current and checked.

From $199. Per application per month, with the protection you choose.

  • Trusted by 3,500+ teams
  • ISO/IEC 27001:2022 certified
  • AES-256 encryption at rest
Social proof straight after the promise. These are the logos production already uses, loaded from codekeeper.co. Where an image can't load (for example in the preview), the name shows instead. Use the approved set only.

Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors

Airbus Bayer European Parliament General Motors Intuit Nestlé PepsiCo Pfizer
Steps 1 and 2: the exposure and the shift, for dependencies. Production asks "What happens if a critical API your product depends on shuts down or changes unexpectedly?". Escrow can't stop a third-party provider changing its API, so the page frames the exposure we can address: when the vendor stops, its accounts and the knowledge of how each service is wired in can go with it. Production's "Dependency failures can trigger unexpected outages" and "Dependency risks decrease across contracts, operations, and renewals" are replaced by what the deposit does. The Continuity line uses the agreed wording.

Why it matters for recovery

An application is only as recoverable as what it depends on.

If the vendor stops, its accounts with payment, email and identity providers can lapse, and the details of how each one is wired in can go with them. A rebuilt application that can't take a payment or send an email isn't back yet.

Dependencies left undocumented

  • Service accounts and settings known only to the vendor
  • Private packages missing, so the build stops
  • No list of what the application calls, or why

Dependencies with Codekeeper

  • Configuration, API references and integration diagrams for each service
  • Private packages held with the code, and with Pro, an SBOM from each rebuild
  • With Continuity, critical services mapped at setup and kept paid and switched on for an agreed period
Step 3 in detail: what a dependencies deposit holds. The groups are production's FAQ list ("API references, SDK instructions, configuration files, access details, integration diagrams"), plus libraries and private packages, as the SaaS escrow page lists them. Production capability claim to confirm: which services. Production shows eight payment, billing, email, messaging, identity and commerce logos and says "From hosting components to authentication providers and managed runtimes, Codekeeper protects the service information"; the page says it in plain words. Access details are held "under the same controls as credentials", which is production's key-escrow line; no other handling detail is added.

What's included

What a dependencies deposit holds.

The agreement lists the services and packages in scope, and what's deposited for each. For most applications, that means:

  • Service configuration. How each external service is set up and connected: its settings and configuration files.
  • API references and SDK instructions. What the application calls, and how.
  • Integration diagrams. Where each service fits, and what depends on it.
  • Libraries and private packages. The packages the build needs, including in-house ones that can't be fetched from anywhere else.
  • Access details. The accounts and keys used to manage each service, held as credentials.

That covers payment, billing, email, messaging, identity and commerce services, as well as hosting components and managed runtimes.

Usually part of
SaaS deposits, and any application that calls external services
How it gets in
With the code through integrations, or secure upload
How it's checked
Automated check, with a vault report
How it's proven
With Pro, resolved in a rebuild and listed in an SBOM
Steps 3 and 4: from the package manager to the proof. "50+ integrations" is production's figure, kept and flagged (agreed: production stats stay, flagged). The hub has setup pages for 24 platforms and production's grid shows 40, so Product must confirm the real count.md. "Sync daily" is a production claim, flagged. The proof steps are confirmed facts: an automated check with a vault report and a Software Resilience Certificate with every protection; on Escrow Pro, Resilience Pro and Continuity Pro, Agentic Verification (the Codekeeper AI Verification Lab, no vendor help, hours, missing items flagged, monitoring between runs). The ladder is the agreed proof ladder, kept short; its last line keeps the agreed wording on release rights. This is where a rebuild says the most about dependencies: the Verification Lab is cut off from the open internet, so a package that isn't deposited shows up as missing, and the SBOM lists what the build used. To confirm with product: how public open-source packages reach the Verification Lab, which is cut off from the internet (deposited, or mirrored); the page doesn't say. The mock reuses the "private package flagged, then added" example from the run reports elsewhere on the site. 16 Oct: Continuity Pro added; base Continuity no longer includes Agentic Verification, so the Recoverability Certificate rung names Continuity Pro.

How it gets in, and how it's proven

Listed, resolved and kept current.

Packages and configuration arrive with the code; service details and access are deposited alongside. With Pro, a rebuild shows whether everything resolves.

1

Connect or upload

Packages and configuration in your repositories arrive with the code through our 50+ integrations and sync daily. Upload API references, diagrams and service details securely, and deposit access details as credentials.

2

Checked and certified

An automated check confirms what's in the deposit, with a vault report, and you receive a Software Resilience Certificate.

3

Resolved in a rebuild, with Pro

AI agents rebuild the application in the Codekeeper AI Verification Lab, cut off from the open internet. Anything the build can't find, such as a private package, is flagged so it can be added, and each run returns an SBOM.

4

Watched between runs

With Pro, we compare the deposit with the live repositories and flag what changed, so you know when to rebuild.

Escrow · Resilience · Continuity

Software Resilience Certificate

The dependency details and packages are held with the code, and an automated check confirms what's there, with a vault report.

Proves: it's there.

Escrow Pro · Resilience Pro · Continuity Pro

Recoverability Certificate

AI agents rebuild the application in the Codekeeper AI Verification Lab, with no help from the vendor, in hours. You get the run report, an SBOM of the components used and an Exit workbook.

Proves: it builds. Agentic Verification

Add-on to any plan

Tested Exit Report

Our specialists rebuild by hand in a clean room and test the business functions you nominate, without the original developers.

Proves: you could exit and keep working. Exit Exercise

The higher you go, the more it proves. The Recoverability Certificate documents the rebuild; release rights come from the agreement. How verification works

Step 3 continued: which protection to attach. The three-job cards appear on every deposit page, each with one line on what that job means for this material on the day it's needed. The "from" prices are the 6 Oct list (Software row); the lead is the price logic sentence, word for word. No card is outlined, but the Continuity card carries the point that matters most for services the vendor pays for, in the agreed wording (critical third-party services are on the Continuity map). Nothing promises a provider's availability. 16 Oct: Continuity Pro (from $1,699) added to the Pro levels in the note under the cards; base Continuity no longer includes Agentic Verification. 17 Oct: the recovery models are named, as in the launch film (Danny): Self-Run Recovery for Escrow, Managed Recovery for Resilience and Continuity.

Which protection fits

Choose who reconnects the services.

Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on.

Released to you

Escrow

Released to you→Self-Run Recovery

The dependency details are released to you, so your team can reconnect each service or replace it. Explore Escrow

From $199

Recovered by us

Resilience

Comes to us→Managed Recovery

They come to Codekeeper, and we use them to reconnect or replace each service in the recovery we run. Explore Resilience

From $399

Stays online

Continuity

Live service kept on+Managed Recovery

Critical services the vendor pays for are mapped at setup and kept paid and switched on for an agreed period while we recover. Explore Continuity

From $1,449

Software list prices, per application per month; SaaS and AI have their own rows. Escrow Pro (from $449), Resilience Pro (from $649) and Continuity Pro (from $1,699) add Agentic Verification. Setup is $499 per arrangement, or $999 for Continuity. See all prices

Close the loop on the story: one application, eight kinds of material. Production's "Cover your full software infrastructure" block links to only two to five of the other asset pages, and files them under three old products (Software, SaaS and Continuity Escrow). Here all eight appear in the same order on every page, with this one marked, because one application usually needs several of them to come back. The order follows a recovery: what it's built from, how it's built, what it runs on, how to run it, what it calls, the thinking behind it, where it runs and the keys to it. The names match the footer. The links underneath go to the application pages, which say which materials each application type usually deposits, and to the guides hub instead of production's per-page e-book block.
The secondary conversion, on every page. Visitors who aren't ready to talk can still leave their email. The sample evidence pack is the same offer on every page, so the site has one lead magnet instead of a different e-book per page. It also carries the launch story: proof, not promises. The button goes to the sample evidence pack page.

Sample evidence pack

See what your auditor would receive.

An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.

  • Recoverability Certificate
  • Run report
  • SBOM and Exit workbook excerpts
Get the sample evidence pack
Production's questions, minus the promises. Kept: what it is, what's included and security. Production's "ensures recovery by giving teams access" becomes what the deposit holds. New: whether we can keep a third-party service running (Continuity, in the agreed wording, with the provider's own terms named so nothing reads as an availability promise) and the SBOM, which answers "do you know what's in it?". Removed: "$195/month" and "ISO 27001-aligned environments". 16 Oct: the SBOM answer names Continuity Pro; base Continuity no longer includes Agentic Verification.

Questions

Third-party dependencies escrow, answered.

What is third-party dependencies escrow?

An agreement in which a software vendor deposits the information needed to maintain or replace the external services and packages its application relies on, with a neutral party such as Codekeeper. If an agreed release condition is met, the materials are released to the beneficiary.

What's included in a deposit?

Service configuration, API references and SDK instructions, integration diagrams, the libraries and private packages the build needs, and access details. The agreement defines exactly what's in scope.

Can you keep a third-party service running if the vendor stops?

With Continuity, we map the services the application needs at setup and keep the map current. If the vendor stops, we keep them paid and switched on for an agreed period while we recover, and recharge the bills at cost. Each service still runs under its provider's own terms.

Do you know which components the application uses?

With Escrow Pro, Resilience Pro and Continuity Pro, each rebuild returns an SBOM: a list of the components the build used. Anything the build needed but couldn't find is flagged.

How are access details held?

Like every deposit: encrypted at rest with AES-256 and in transit with TLS, by a company certified to ISO/IEC 27001:2022. See credentials escrow and the Trust Center.

The same close on every page. The close names the outcome without a promise: what the application relies on stays within reach, whatever happens to the vendor. Every page ends on the same two actions in the same order: Book a demo, then the sample evidence pack.

Keep what it relies on within reach.

We'll go through the services and packages your application depends on, and what a deposit would hold.

Chat widget goes here. Production runs HubSpot chat in this corner. Keep it on launch: it catches visitors with a quick question who won't book a demo yet. Route it to sales during office hours.