Outside the October line-up, reworked and flagged (Danny, 7 Oct). This replaces /software-custodian. The production copy dates from 2023 and 2024 and is vague ("upholding your commitment to stakeholders, safeguarding compliance and accountability without interruption"). It's rebuilt as a product page for organisations that want one party accountable for their software and data across vendors and the life cycle. Product must confirm the scope, the pricing, and whether Software Custodian is still sold as described, before this page goes live. No price is stated.

Nothing here goes beyond production's own description: Codekeeper manages your software and data on your behalf; invites your clients and vendors; covers in-house systems, vendors and their vendors; and handles data operations (privacy-framework operations, SLA operations support, certified removal of data and records, data migration and export) where you or your vendors can't.
Removed: "guarantee compliance to all your stakeholders", "not only meets but exceeds compliance standards", "without interruption", "Fully automated process" (which contradicts "we handle data operations"), the fear cards ("Regulatory noncompliance", "Stakeholder mistrust") and the typo "full control over you software".
"Trusted by 3,500+ teams" is production's figure (MESSAGING §6), used unflagged as on the home page. Confirm it with the other production claims in to-confirm.md.
The visual is built from the mock component and flagged: Product should confirm what customers actually see.

Software Custodian

One party accountable for your software and data.

Software Custodian puts Codekeeper in charge of managing your software and data on your behalf, across your own systems and your vendors', for the whole life cycle. When you or a vendor can't act, we carry out the data operations.

Book a demo Get the sample evidence pack

Trusted by 3,500+ teams
ISO/IEC 27001:2022 certified
Securing software since 2014

Software CustodianExample Group · three layersActive

In-housePayments Core · Resilience ProProtected

Your vendorsClaims Portal · SaaS · ContinuityProtected

Their vendorsHosting and data services behind Claims PortalMapped

Data export for migrationCarried out by CodekeeperIn progress

Privacy requestHandled under GDPRCompleted

Example screen with fictional names. Product to confirm the scope and the interface.

Social proof straight after the promise. These are the logos production already uses, loaded from codekeeper.co. Where an image can't load (for example in the preview), the name shows instead. Use the approved set only.

Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors

Step 1, the exposure, from production's own questions. Production asks "Who keeps track of which data is kept where?" and lists five "hurdles" (vendor complexity, access anxiety, compliance challenges, collaborative oversight, compliance readiness). They're folded into three calm cards. Production's "Laws and regulations are clear, you are responsible for data throughout its entire life cycle" is a legal generalisation with no citation, so it becomes "clients and regulators look to you", which makes the same point without stating the law.

The exposure

Who keeps track of which data is kept where?

Your software and data are spread across your own systems, your vendors and the vendors they rely on. The responsibility isn't spread with them.

Data spread across vendors

Every vendor holds part of your software and data. Keeping track of what sits where gets harder with each one you add.

Accountability stays with you

Clients and regulators look to you for your data, wherever it's stored and whoever runs the system.

Someone has to act

If a vendor goes down, data still has to be exported, migrated or removed on request. Someone needs the access and the authority to do it.

Steps 2 and 3: how Software Custodian relates to the protections. This is the question the old page never answered. The protections attach to each application and decide what happens when it fails, in the canonical lines. Software Custodian sits above them: one party acting for you on the software and data itself. Production describes it as extending the disaster recovery solutions ("Use all disaster recovery solutions and extend it with services"), so the page says it builds on the protections. Production's FAQ also says the custodian makes "arrangements to keep hosting and support services running"; in the new line-up that's Continuity's job, so the callout says so. Product to confirm whether Software Custodian requires a protection, and which ones.

How it fits

The protections bring applications back. The custodian acts for you.

Each protection decides what happens to one application on the day it fails. Software Custodian puts one party, Codekeeper, in charge of your software and data across all of them.

Escrow: Released to you. The deposit is released under the agreement, and you run the recovery. Escrow
Resilience: Recovered by us. The deposit comes to Codekeeper, and we bring the application back. Resilience
Continuity: Full continuity. We keep the live environment paid and switched on for an agreed period while we recover. Continuity
Software Custodian: One accountable party. We manage your software and data on your behalf, and carry out data operations when you or a vendor can't.

It builds on your protections; it doesn't replace them. Keeping a vendor's live environment switched on is Continuity's job. Bringing an application back is Resilience's. The custodian handles what happens to your software and data around them.

Production's four data operations, word for word in substance, and nothing more. "As custodian we handle data operations in catastrophic situations where you or vendors can't", with the list: GDPR and other privacy framework operations, Service Level Agreement operations support, certified removal of data and digital records, and data migration and export. "Catastrophic situations" becomes "when you or a vendor can't", which is calmer and means the same. Every card is flagged until Product confirms the scope. "Certified removal" in particular needs confirming: certified by whom, and to what standard.

What the custodian does

Data operations, carried out when you or a vendor can't.

As custodian, Codekeeper handles the operations your software and data still need when a vendor is gone or your own team can't reach them.

Privacy operations

Operations under GDPR and other privacy frameworks, such as requests your clients ask you to carry out.

SLA operations support

Support for the operations your service level agreements commit you to.

Certified removal

Certified removal of data and digital records, when they have to go.

Migration and export

Data migration and export, so your data can move to where it needs to be.

Production's "Designed for life cycle control" and registration list, kept and flagged. The four points are production's: invite your clients and vendors, one central dashboard, "Multi-layer: Internally, with vendors, (and their vendors)" and "You have a solid legal framework in place". "Fully automated process" is dropped (it contradicts the hands-on data operations), and "guarantee compliance to all your stakeholders" is dropped. Production's images for this section (designed-for-life-cycle-control.png, Data-Operations-and-SLA-Performance.png, software-custodian-register.png) are 2024 screenshots that likely show old product names, so a placeholder brief is used instead.

Designed for life cycle control

Your software and data, from build to retirement.

Software Custodian brings the parties around your software into one place, with the terms agreed before anything happens.

Invite your clients and your vendors to one account
One central dashboard to set up and manage every part of it
Every layer: in-house, your vendors, and their vendors
A legal framework in place before you need it

Image to produceThree layers, one custodianBrief: three stacked horizontal bands labelled In-house, Your vendors and Their vendors, each holding two or three application tiles with a small protection tag (Resilience Pro, Continuity, Escrow). A single teal line runs down through all three bands to the Codekeeper symbol at the side, labelled "Software Custodian". Flat, light background, no people, no product names beyond the protections. Replace production's 2024 images, which likely show the old names.

Production's three regulated markets, one line each. Production names finance, healthcare and life sciences, and government and defence, with "Requirements that don't end when disaster strikes you or your vendors". Each card says why that market cares, with no claim about any regulation. British spelling: "defence".

Who it's for

For organisations where data duties outlast a vendor.

Some industries need special care with data, and those requirements don't end when a vendor fails.

Finance

Banks, insurers and payment firms that answer to clients and supervisors for every system they outsource.

Healthcare and life sciences

Organisations holding sensitive records across many vendors, where data has to be handled correctly at every stage.

Government and defence

Public bodies and contractors that need one accountable party for software they don't build themselves.

Production's three-step "action plan", rewritten plainly. Demo and discovery call; plan selection and registration (now "agree the scope", since there's no confirmed package list); onboard and deposit. "Fortifies your compliance strategy" and "ensuring complete data governance" are dropped.

How to start

Three steps to one accountable party.

Demo and discovery call

We look at your applications, your vendors and the data duties you carry, across every platform.

Agree the scope

Which applications, which layers and which data operations the custodian covers for you.

Onboard and deposit

Connect your systems, invite your vendors and clients, and start depositing.

The secondary conversion, on every page. Visitors who aren't ready to talk can still leave their email. The sample evidence pack is the same offer on every page, so the site has one lead magnet instead of a different e-book per page. It also carries the launch story: proof, not promises. The button goes to the sample evidence pack page.

Sample evidence pack

See what your auditor would receive.

An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.

Recoverability Certificate
Run report
SBOM and Exit workbook excerpts

Get the sample evidence pack

Production's ten questions, cut to the six a buyer needs. Production's answers repeated "ensures compliance", "without interruption" and "under any scenario"; each answer is rewritten from production's own description, with no new capability. The capability answers are flagged, like the rest of the page, until Product confirms the scope. The Continuity answer draws the line the old page blurred. The compliance answer carries the agreed disclaimer. No price is stated.

Questions

About Software Custodian.

What is Software Custodian?

A service in which Codekeeper manages your software and data on your behalf, across your own systems, your vendors and their vendors, for the whole life cycle. When you or a vendor can't act, we carry out the data operations: privacy-framework operations, SLA operations support, certified removal of data and records, and migration and export.

How is it different from Escrow, Resilience and Continuity?

Those are protections for one application each: released to you, recovered by us, or kept online while we recover. Software Custodian builds on them. It makes Codekeeper the one party accountable for your software and data across all of them.

Will the custodian keep a failed vendor's services running?

That's Continuity: we keep the live environment paid and switched on for an agreed period while we recover the application. Explore Continuity

Which industries is it for?

Any organisation with data duties that outlast a vendor, especially in finance, healthcare and life sciences, and government and defence.

Will it make us compliant?

No service can do that on its own. Software Custodian acts for you on your software and data, and our protections give you evidence for your file. Whether that meets a specific requirement is for you and your assessor to decide.

What does it cost?

Talk to us. We scope Software Custodian with you and quote it for your organisation.

The same close on every page. The close repeats the page's single idea: one accountable party, across the layers the old page called multi-layer. Every page ends on the same two actions in the same order: Book a demo, then the sample evidence pack.

One party accountable. Across every vendor.

Book a demo and we'll map your software, your vendors and the data duties you carry.

Book a demo Get the sample evidence pack