- Removed: production's hero chain ("When your AI fails, your automation breaks… Then you fall behind."), "can't be wiped out overnight", "aren't guaranteed to stay operational", "verified recovery certificates that prove your protection actually works", the Validated, Verified and Certified levels and "bulletproof".
- No third-party names. Production names workflow tools (Zapier, Make, n8n) and shows AI vendor logos. None is named here until the team confirms each integration and has permission.
- The mock uses the layers from the AI escrow page. Risk Assistant is the fictional AI application from the homepage. Production's hero image couldn't be checked from the kit, so it isn't used.
What is AI escrow?
AI escrow is an agreement in which the components of an AI system, such as model versions, prompts, agent definitions, pipelines and workflows, are deposited with a neutral third party. If an agreed release condition is met, they're released to the business that depends on them, so the system can be redeployed without the vendor.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Rebuilt on our own models, no third-party AI
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
AI escrow, defined
AI escrow applies the idea of software escrow to AI systems, where the value sits in far more places than the code.
The AI vendor, or the team that built the AI system, deposits its components with a neutral escrow agent. The agent holds the deposit, keeps it current and releases it under the conditions in the agreement. A mature AI deployment usually includes:
- a foundation model, often hosted and maintained by a third-party provider;
- a fine-tuning layer, trained on your own data, which took real time and compute to build;
- system prompts, prompt chains and agent definitions that encode months of engineering judgement;
- workflows connecting the AI to other systems and processes; and
- the deployment configuration that makes it all available to the people who use it.
- Depositor
- The AI vendor, or the team that built the AI system.
- Beneficiary
- The business that relies on the AI system and receives the deposit on release.
- Escrow agent
- The neutral party that holds and checks the deposit. At Codekeeper, that's us.
- The agreement
- What's deposited, how it's kept current, and when it's released.
What you can and can't deposit
You can deposit what's yours to deposit: fine-tuned models, prompts, agent logic, workflows, and training data you hold. A foundation model hosted by a third-party provider usually can't go in. Its weights stay with the provider, so the deposit holds the configuration and access you use it with, and everything you've built on top. Data licensed from third parties may carry restrictions on how it's deposited, so scope it in the agreement.
Why it matters
AI adoption moves fast. A team starts using an AI tool, builds workflows around it, and within a year has dependencies that would be painful to unwind. By then, the moment to agree escrow terms has often passed.
The risks are familiar from software, but they move faster:
- A model is changed or retired. Agents and workflows built around one model can break when it's deprecated or altered.
- A provider closes or changes terms. Acquisitions, pricing changes and new terms of service can cut off what you've built on.
- The engineering is lost. Fine-tuning, prompts and orchestration take months to build. Without a copy, there's nothing to rebuild from.
For financial entities in the EU, exit plans for the ICT services behind critical or important functions are a regulatory expectation:
“Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically.”
Regulation (EU) 2022/2554 (DORA), Article 28(8). Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide. Working on AI governance? See EU AI Act and DORA.
An AI system is more than its code
A file check confirms what's in a deposit, not that it works. With an AI system, the gap is wider: a deposit can pass a file check and still fail in practice, for example because the model weights are incomplete, the fine-tuning data points to sources that weren't captured, or a workflow relies on a platform feature that doesn't exist anywhere else.
That's why an AI deposit has to be scoped layer by layer, kept current as models and prompts change, and tested by rebuilding it, not just by counting files.
How it works with Codekeeper
Your AI system, as an application you protect.
Add the AI system to your Codekeeper account, attach the protection that matches what should happen when it fails, then choose the level.
Add the application
The AI system your business depends on, from a vendor or built in-house. AI applications have their own price row.
Attach a protection
Escrow releases the deposit to you. Resilience brings the system back for you. Continuity also keeps the live environment on while we recover.
Choose the level
Escrow is everything you need to be protected. Escrow Pro is everything you need to recover: it adds Agentic Verification.
Escrow
Released to you→Self-Run Recovery
Released to you. When an agreed release condition is met, the deposit is released to the beneficiary, and your team redeploys the system. Explore Escrow
Resilience
Comes to us→Managed Recovery
The deposit comes to Codekeeper, and when the system fails, we bring it back for you. For vendor or in-house systems. Explore Resilience
Continuity
Live environment kept on+Managed Recovery
Everything in Resilience, plus we keep the live environment paid and switched on for an agreed period while we recover. Continuity Pro adds Agentic Verification. Explore Continuity
Want the product view? AI escrow at Codekeeper. Not sure which job you need? Compare the three protections.
What an AI deposit covers
Every layer, in one vault.
Not every arrangement needs every layer. The right scope depends on how the AI system is built and what it would take to run it without the vendor.
Models
Fine-tuned model versions and weights you hold, version histories, training data where it's yours, and the access details for hosted models.
Model deployments
API configurations, routing rules, rate limits, access controls and the infrastructure definitions that host the model.
Agents and prompts
System prompts, prompt templates and chains, agent logic and tool definitions: the engineering that makes the AI behave as you need.
Pipelines and vector stores
The pipelines that prepare data for the model, and the vector stores that give its answers context.
Workflows
The configurations, integration mappings and automation sequences that connect the AI to your systems and processes.
Code and documentation
The application code around the model, and how to run and maintain the system.
Kept current
AI systems change constantly. So does the deposit.
New model versions are deployed, prompts are refined and workflows updated. Manual deposits fall behind too quickly to rely on, so connect your platforms once and deposits sync daily. Anything else can be uploaded by hand.
Models, weights you hold, prompts and agents, pipelines, vector stores and workflows, synced into one vault.
When an AI deposit is released
Release conditions are defined in the agreement up front, and nothing is released outside them. The standard ones apply:
- The vendor's insolvency or bankruptcy
- The vendor ceasing to trade
- A material breach of the agreement
- A failure to maintain the AI system, after formal notice
- A change of ownership that ends support
AI relationships can also break down short of outright failure, so it's worth discussing conditions such as:
- a model being deprecated or replaced without enough transition time, in a way that materially affects the system;
- price changes beyond an agreed threshold within an agreed period;
- changes to the terms that restrict access to your fine-tuned models or training data;
- sustained performance below agreed benchmarks; and
- the vendor discontinuing the model version or plan the system depends on.
How a release works
- The beneficiary asks for a release and says which condition has been met.
- We verify the request before anything becomes accessible: a legal review, verification of the release condition and authentication of the beneficiary. The depositor is notified, and the agreement sets how a dispute is handled.
- Once the release conditions are verified, the beneficiary typically has access within two to three hours, and can restore or migrate the AI system.
What a release gives you
A release doesn't transfer ownership of the models or the intellectual property. The beneficiary receives the right to use the deposit to maintain and operate its AI system, as the agreement defines. Ownership of foundation models and their weights usually stays with the model provider.
The proof
Proof the deposit rebuilds, without sending it anywhere.
With AI systems, the failure modes are harder to spot, so evidence matters more. Every protection comes with it, and the higher you go, the more it proves.
Software Resilience Certificate
The deposit is held, and an automated check confirms what's in it, with a vault report.
Proves: it's there.
Recoverability Certificate
AI agents rebuild the deposit in the Codekeeper AI Verification Lab, on supported technology stacks, with no help from the vendor, in hours. They run on Codekeeper's own models: no third-party AI, and the deposit never leaves our environment.
Proves: it builds. Agentic Verification
Tested Exit Report
Our specialists rebuild by hand in a clean room and test the business functions you nominate, without the original developers.
Proves: you could exit and keep working. Exit Exercise
Four rebuilds a year are included with Escrow Pro, Resilience Pro and Continuity Pro. The Recoverability Certificate documents the rebuild. It doesn't grant release rights: those come from the agreement.
What it costs
One price row for AI applications.
Per AI application, per month. Choose the protection, then the level.
Escrow
Everything you need to be protected.
Custody, release under the Escrow Agreement, an automated check and a Software Resilience Certificate.
$649per application per month
Explore EscrowEscrow Pro
Everything you need to recover.
Escrow plus Agentic Verification: proof the deposit builds, and a Recoverability Certificate.
$849per application per month
Explore Escrow ProResilience
We recover it.
The deposit comes to Codekeeper. If the AI system fails, we run the recovery.
$949per application per month
Explore ResilienceResilience Pro
Proven before we need it.
Resilience plus Agentic Verification, so recovery starts from a deposit we know builds.
$1,149per application per month
Explore Resilience ProContinuity
Full continuity.
Everything in Resilience, plus the live environment kept paid and switched on for an agreed period while we recover.
$1,949per application per month
Explore ContinuityContinuity Pro
Full continuity, proven in advance.
Continuity plus Agentic Verification, so recovery starts from a deposit we know builds.
$2,149per application per month
Explore Continuity ProEscrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on. At every protection, Pro adds Agentic Verification. Setup is $499 per arrangement, or $999 for Continuity and Continuity Pro. One claimant is included; more are an add-on. Cost coverage is quoted for Resilience and Continuity. Enterprise: talk to us. See all prices
Free guide
Introduction to AI Escrow
Which parts of an AI system need protecting, from models and deployments to prompts and workflows.
- The components of an AI system, mapped
- What to deposit for each one
- How recovery works when access is disrupted
Questions
AI escrow, answered.
What is AI escrow?
An agreement in which the components of an AI system, such as model versions, prompts, agent definitions, pipelines, workflows and deployment configuration, are deposited with a neutral third party. If the vendor fails, changes terms materially or stops supporting the system, the deposit is released to the business that depends on it, so the system can be redeployed without the vendor.
How is AI escrow different from software escrow?
Software escrow protects source code and documentation. AI escrow protects the components that give an AI system its capabilities: model versions and weights you hold, fine-tuning, prompts, agent logic and workflows. Those have to be scoped layer by layer, kept current as they change, and tested by rebuilding them.
What happens if an AI vendor goes bankrupt?
Insolvency is one of the most common release conditions. The beneficiary asks for a release, we verify the request, and the deposit is released to the beneficiary, who can use it to restore or migrate the AI system.
How often should AI deposits be updated?
As often as the system changes: new model versions, refined prompts and updated workflows. In practice that means automated syncing. Connect your platforms once and deposits sync daily.
Does AI escrow cover training data?
Yes, if it's yours to deposit. It can cover proprietary datasets used to train or fine-tune models, with the training scripts and evaluation data behind specific model versions. Data licensed from third parties may restrict how it can be deposited, so scope it in the agreement.
Does Agentic Verification send our AI system to a third-party AI?
No. Rebuilds run on Codekeeper's own models, and the deposit never leaves our environment. Each run happens in the Codekeeper AI Verification Lab, sealed and cut off from production, development and the open internet.
AI is infrastructure now. Protect it like infrastructure.
Book a demo and we'll map the layers of your AI system and the protection each one needs.