The compliance briefing, in the shared briefing structure. Same hero, same six-phase tracker (phase 2 marked "Your part"), same order of sections as the other five briefings. A compliance officer says yes when three things are clear: what evidence they'll hold for each application, how it fits their framework, and whether Codekeeper itself passes their due diligence. Those are the three numbered topics.

Production's claim is replaced. "Codekeeper helps you meet resilience and third-party risk requirements in frameworks like ISO 27001, SOC 2, GDPR, HIPAA, DORA, and NIS2" becomes evidence that supports your assessment, with the agreed disclaimer. GDPR and HIPAA are dropped: the kit has no page for them and nothing about them is confirmed.
Production's badge wall is gone. It shows ISO 9001, ISO 27017, ISO 27018, SOC, PCI and CSA badges. Only ISO/IEC 27001:2022 is confirmed, so only that is claimed.

Briefing · Compliance officers

Due diligence on us. Evidence for your file.

This briefing covers what a compliance team needs to approve Codekeeper: the evidence you'll hold for each application, how it fits your framework, and the documents you'll need to review Codekeeper itself.

Book a demo Get the sample evidence pack

Trusted by 3,500+ teams
ISO/IEC 27001:2022 certified
Audited by BSI

Your Codekeeper setupSix phases, one briefing for each teamPhase 2 of 6

DecideDecision makers · demo, proposal and scopePhase 1

Due diligenceCompliance officers · questionnaires and documentsYour part

Supplier onboardingProcurement and finance · prices and registrationPhase 3

Account setupProject managers · team, roles and settingsPhase 4

AgreementLegal advisors · terms, release and signaturesPhase 5

Deposits and proofTech teams · integrations, deposits and rebuildsPhase 6

Due diligence can run alongside the other phases.

Topic 1: the evidence (arc step 4), written as a compliance officer reads it. The left column is what a file usually has to show; the right column is the Codekeeper document that supports it and the level it comes with. Every document and level is from the proof ladder and MESSAGING §6. Wording stays at "supports" and "evidence for". The live environment map isn't listed: whether customers receive it as a document is still open (to-confirm). "Synced daily" is the production integration claim, flagged in to-confirm. 16 Oct: Continuity Pro added; the rebuild rows now name Continuity Pro, since base Continuity no longer includes Agentic Verification.

1 · The evidence

Dated evidence, for every application.

Each protection produces documents tied to one application, so your file shows what was held, what was rebuilt, what was tested, and when.

What your file needs to show	Codekeeper evidence
The deposit is held, checked and current	Software Resilience CertificateVault reportEvery protection. An automated check confirms what's deposited, and deposits sync daily through integrations.
The application can be rebuilt without the vendor	Recoverability CertificateRun reportEscrow Pro, Resilience Pro and Continuity Pro. AI agents rebuild the deposit in the Codekeeper AI Verification Lab, with no help from the vendor.
You know what's inside it and how to recover it	SBOMBuild stepsExit workbookEscrow Pro, Resilience Pro and Continuity Pro, with every successful rebuild.
Testing is repeated over time	Dated Recoverability CertificatesFour rebuilds a year included, run when you choose: before an audit, after a release or when the deposit changes.
The exit has been tested in practice	Tested Exit ReportFramework annexExit Exercise, an add-on to any plan. Our specialists rebuild in a clean room and test the business functions you nominate, with an annex mapped to your framework, such as DORA.

The Recoverability Certificate documents the rebuild. It doesn't grant release rights; those come from the agreement. See examples in the sample evidence pack.

Topic 2: the frameworks, with the regulation stance (MESSAGING §7). I checked both PRA quotes myself against the Bank of England's SS2/21 PDF (November 2024 update): paragraphs 10.10 and 10.24 match word for word. The March 2026 update should be rechecked for 10.24 (to-confirm). The DORA Article 28(8) quote is not used here: I couldn't read the article text on EUR-Lex from this environment, so DORA appears as a label only, with the wording the Solutions hub uses. The framework cards reuse the Solutions hub's labels and link to the kit pages. The disclaimer sits under the quotes. Legal must review the quotes, the labels and the disclaimer before launch.

2 · The frameworks

Regulators now ask whether the exit plan works.

The question has moved from "do you have a contract?" to "could you leave, and keep running?" Codekeeper's documents are evidence for that answer.

UKPRA SS2/21 · 10.10

“Firms' exit plans should cover stressed exits and be appropriately documented and tested as far as possible.”

PRA Supervisory Statement SS2/21, paragraph 10.10

UKPRA SS2/21 · 10.24

“Firms should take reasonable steps to test exit plans; in particular, those relating to stressed exits.”

PRA Supervisory Statement SS2/21, paragraph 10.24

Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.

DORA

Regulation (EU) 2022/2554 · financial entities

Exit plans for ICT services that support critical or important functions, documented, sufficiently tested and reviewed periodically.

DORA evidence UK

PRA SS2/21

PRA supervisory statement · outsourcing and third parties

Exit plans for material outsourcing that cover stressed exits and are tested as far as possible.

PRA SS2/21 evidence EU

NIS2

Directive (EU) 2022/2555 · essential and important entities

Cybersecurity risk management, including the risks that come from your software suppliers.

NIS2 evidence EU

CRA

Regulation (EU) 2024/2847 · products with digital elements

Security for products with digital elements, including documenting their components in an SBOM.

CRA evidence ISO

ISO 27001

ISO/IEC 27001:2022 · information security management

Evidence your ISMS can draw on when auditors ask about suppliers and recovery.

ISO 27001 evidence US

SOC 2

United States · service organisation audits

Evidence for vendor continuity questions in your audit.

SOC 2 evidence

Not sure which frameworks apply to you? Take the compliance scan, or see all solutions.

Topic 3: due diligence on Codekeeper itself. The process is production's ("Submit your due diligence request", "Sign an NDA for full documentation access", "Review completed compliance docs"). Security facts are limited to what's confirmed: ISO/IEC 27001:2022 audited by BSI, AES-256 at rest (production says "AES-256/512", flagged in the brief) and TLS in transit. Production lists "security assurance reports" among the NDA documents; that could be read as SOC reports, so it's "audit summaries" here, as on the FAQ. Production names two questionnaire portals (OneTrust, Whistic); the copy says "your portal" instead, so we don't imply a supported list. The mock is an example with fictional states.

3 · Due diligence on Codekeeper

Review us properly, without the chase.

Send your questionnaire, and our compliance team completes it. Confidential documents follow under NDA, through secure channels.

ISO/IEC 27001:2022 certified, audited by BSI
AES-256 encryption at rest, TLS in transit
Agentic Verification runs on Codekeeper's own models, so code never leaves our environment
Security policies, ISMS summaries and audit summaries, under NDA where they're confidential
Questionnaires completed by our compliance team: tell us the format or portal you need, and our technical team helps with specialist questions

Open the Trust Center

Due diligence requestExample Logistics plc · vendor reviewIn progress

QuestionnaireCompleted by our compliance teamCompleted

NDAFor confidential documentsSigned

ISO/IEC 27001:2022 certificateThrough the Trust CenterShared

Security policies and audit summariesUnder NDA, through a secure channelShared

Follow-up questions2 open with your Codekeeper contactAnswering

Example request. Names are fictional.

Production's three steps and checklists, in the shared table. Rows 1 to 3 are production's ("Submit your due diligence request", "Sign an NDA", "Review completed compliance docs"); the right column is production's "Our key responsibilities". Row 4 is new: once the protection is live, the compliance officer's job becomes filing the evidence, which is what the new line-up sells. Production's parallel-review note is kept.

Your steps, and ours

From questionnaire to a file you can show.

Your review can start as soon as the proposal is shared, alongside the rest of the setup.

Your part

What Codekeeper does

1 · Send your request

Send your questionnaire or document request to your Codekeeper contact, with clear requirements and any portal access or format you need.

Completes the questionnaire, and brings in our technical team for specialist questions.

2 · Sign an NDA

Sign the NDA for confidential documents, and confirm the scope of documentation you need.

Shares security policies, ISMS summaries and audit summaries through secure channels.

3 · Review

Review the documents internally, and flag anything missing or unclear.

Answers follow-up questions and provides additional documentation.

4 · Build your file

Once the protection is live, add each application's certificates and reports to your file.

Issues a dated certificate or report every time a check, a rebuild or an Exit Exercise runs.

The page-specific offer on educational pages. Agreed 7 Oct: on explainers, video guides, magazine articles and role briefings, the mid-page offer is the matching guide instead of the sample evidence pack. Visitors who are still learning convert better on a guide about their question. The hero and closing section still carry Book a demo and Get the sample evidence pack. Guide source on production: the "resources-getting-started-with-software-escrow" item on /resources. Before launch: update the guide itself to the October line-up (it still uses the old product names and verification tiers) and connect this form to the HubSpot form that sends it. On the compliance briefing the guide matches the reader's next question: how to find the critical vendors and build the evidence file.

Free guide

Getting Started With Software Escrow

Practical first steps: find your critical vendors, set up deposits and build the evidence your auditor will ask for.

Finding the vendors you can't do without
Setting up deposits that stay current
Building evidence for DORA, NIS2, CRA and CPS 230 files

The compliance officer's objections. The regulator answer uses the agreed disclaimer. The certification answer claims ISO/IEC 27001:2022 only. The NDA answer is the FAQ's Trust Center wording. The parallel-review answer is production's note on this page. Legal should review the regulator answer with the other regulation copy. 16 Oct: Continuity Pro added; the DORA and PRA answer now credits the rebuild documents to the Pro levels, since base Continuity no longer includes Agentic Verification.

Questions

Before you sign off.

Will Codekeeper's evidence satisfy our regulator?

Codekeeper gives you evidence for your file: certificates, run reports, SBOMs, Exit workbooks and, with an Exit Exercise, a Tested Exit Report. It supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.

Which certifications does Codekeeper hold?

Codekeeper is ISO/IEC 27001:2022 certified, audited by BSI. Policies and audit summaries are available through the Trust Center.

Do we need an NDA?

Only for confidential documents. Some documents are public in the Trust Center. For the rest, we ask for a signed NDA first, then share them through secure channels.

Can our review start before sign-up?

Yes. Due diligence can run alongside the other phases, so it doesn't hold up procurement or account setup.

Which documents go in a DORA or PRA SS2/21 file?

The Software Resilience Certificate shows the deposit is held and checked. With the Pro levels, the Recoverability Certificate, run report, SBOM and Exit workbook show it builds and how you would exit. A Tested Exit Report adds functional testing, with an annex mapped to your framework. See DORA and PRA SS2/21.

The people, the rest of the set, and the booking route for this role. Production's compliance briefing shows Eric (Account Manager, Sales) and Robyn (Account Support, Customer Success), with photos by absolute URL. Before launch, confirm with each person that they agree to appear, that the role is current and that the photo is recent. Names are flagged until then. The compliance route is the support briefing call: production's support call covers "compliance documentation or due diligence requests".

Your Codekeeper team

Who'll answer your questions.

Send your request to either of them. They'll bring in our compliance and technical teams where needed.

Account manager · Sales

Eric

The proposal, the scope of each protection and what goes in your file.

Book a demo

Account support · Customer Success

Robyn

Questionnaires, NDAs and document requests, from first request to follow-ups.

Book a support briefing

Self-serve

Trust Center

Our security documentation, and a way to request confidential documents under NDA.