- Removed: production's chain of fear lines ("When they fail, your operations break… your business stops"), "Let's build bulletproof software resilience", the Validated, Verified and Certified levels, Continuity Escrow as a product name, and "this process can run around the clock".
- The mock uses production's six SaaS deposit categories. Claims Portal is the fictional SaaS application from the homepage.
- Production's hero image (hero-pillar-what-is-saas-escrow.webp) couldn't be opened from the kit to check it for old product names, so it isn't used.
What is SaaS escrow?
SaaS escrow is an agreement in which the provider of a hosted application deposits what it takes to run the service, not just the source code, with a neutral third party. If an agreed release condition is met, the deposit is released to the customer, so the application can be brought back without the provider.
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- 50+ integrations, synced daily
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
SaaS escrow, defined
SaaS escrow applies the idea of software escrow to an application you don't host: a neutral party holds what you'd need to run it yourself.
With on-premise software, you protect the code. With SaaS, you protect a running service. The code, the data, the deployment set-up and the credentials all live with the provider. If the provider fails, the source code on its own won't bring the application back. So a SaaS deposit adds the infrastructure definitions, data, access and services needed to stand the application up somewhere new.
- Depositor
- The SaaS provider, which makes the deposits and keeps them current.
- Beneficiary
- The business that relies on the service and receives the deposit on release.
- Escrow agent
- The neutral party that holds and checks the deposit. At Codekeeper, that's us.
- The agreement
- What's deposited, how it's kept current, and when it's released.
How it differs from software escrow
| Software escrow | SaaS escrow | |
|---|---|---|
| What you protect | An application you install and run | A service the provider runs for you |
| What's deposited | Code, build files, data and documentation | All of that, plus infrastructure definitions, data exports, credentials and third-party services |
| How it's kept current | With each release | Continuously, because the service changes with every deployment |
| Who brings it back | Your team, on your own servers | Your team, in a new environment, or Codekeeper with Resilience |
For the wider picture, see What is software escrow?
Why it matters
Many businesses assume their cloud provider covers continuity. It covers part of it. AWS, Azure and Google Cloud keep the infrastructure running. They don't run the SaaS provider's application, and they don't step in if the provider's business fails.
If a provider becomes insolvent, the application can go dark, and the data stored on its infrastructure can become hard to reach. Its disaster recovery plan was built for technical failures while the business was still trading. Its uptime service level covers performance while the provider operates, and says nothing about what happens when it stops.
Regulators have noticed. Financial entities in the EU now need exit plans for the ICT services that support their critical or important functions:
“Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically.”
Regulation (EU) 2022/2554 (DORA), Article 28(8). Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide. Evidence for DORA
Code alone won't bring a service back
Getting a SaaS application back takes more than a copy of the code. You need the infrastructure definitions to rebuild the environment, a recent export of the data, access to the accounts it runs on and a list of the services it calls. And it has to be current: a SaaS application changes with every deployment, so a deposit made once a quarter soon falls behind.
Then there's time. Restoring a service takes a while, even with everything to hand. If your operations can't wait, the protection needs to keep the live environment running while the application is recovered.
How it works with Codekeeper
Choose what happens when the service fails.
Add the SaaS application to your Codekeeper account, attach the protection that matches the job you need on the day, then choose the level.
Add the application
The hosted service your operations depend on. Prices are per application, with their own SaaS row.
Attach a protection
Escrow releases the deposit to you. Resilience brings the service back for you. Continuity also keeps the live environment on while we recover.
Choose the level
Escrow is everything you need to be protected. Escrow Pro is everything you need to recover: it adds Agentic Verification.
Escrow
Released to you→Self-Run Recovery
Released to you. When an agreed release condition is met, the deposit is released to the beneficiary, and your team stands the service up again. Explore Escrow
Resilience
Comes to us→Managed Recovery
The deposit comes to Codekeeper, and when the service fails, we bring it back for you. Explore Resilience
Continuity
Live environment kept on+Managed Recovery
Everything in Resilience. We map the live environment at setup and keep the map current. If the vendor stops, we keep it paid and switched on for an agreed period while we recover. Continuity Pro adds Agentic Verification. Explore Continuity
Bills for the live environment are recharged at cost. Not sure which job you need? Compare the three protections.
What a SaaS deposit covers
Six layers, held together and kept current.
A complete SaaS deposit covers what it takes to rebuild and operate the application without the provider. Not every arrangement needs every layer: the right scope depends on how the application is built.
Source code
The code, scripts, libraries and dependencies needed to rebuild and run the application.
Infrastructure and deployment
Infrastructure definitions, deployment packages, pipeline configuration and environment variables.
Data
Database exports, datasets and the configuration the application needs. In SaaS, the data lives with the provider.
Credentials and access
The passwords, keys and cloud account access needed to deploy, manage or restore it. Without them, the rest can't be used.
Third-party services
The external services and dependencies the application relies on. A missing one is a common reason a deposit falls short.
Documentation
How the application works, how to set it up and how to maintain it under pressure.
Code, infrastructure definitions, data exports, credentials and third-party services, synced daily into one vault.
When a SaaS deposit is released
Release conditions are agreed up front and written into the agreement, and nothing is released outside them. The usual ones apply:
- The provider's insolvency or bankruptcy
- The provider ceasing to trade
- A failure to maintain or support the application, after formal notice
- A material breach of the subscription agreement
- A change of ownership that ends support
For SaaS, a few more are worth discussing: repeated outages beyond the thresholds in your service level, a security failure that amounts to a material breach, or the provider withdrawing the plan or product you rely on.
How a release works
- The beneficiary asks for a release and says which condition has been met.
- We verify the request before anything becomes accessible: a legal review, verification of the release condition and authentication of the beneficiary. The depositor is notified, and the agreement sets how a dispute is handled.
- Once the release conditions are verified, the beneficiary typically has access within two to three hours.
- Your team, or a partner you choose, stands the application up in a new environment. With Resilience, we do it for you.
What a release gives you
A release doesn't transfer ownership of the software or the infrastructure. The beneficiary gets the right to use the deposit to maintain and operate the application, as the agreement and the subscription terms define. The provider keeps its intellectual property.
The proof
Know the service would come back.
An agreement gives you the right to the deposit. Proof tells you it would work. Every protection comes with evidence, and the higher you go, the more it proves.
Software Resilience Certificate
The deposit is held, and an automated check confirms what's in it, with a vault report.
Proves: it's there.
Recoverability Certificate
AI agents rebuild the deposit in the Codekeeper AI Verification Lab, on supported technology stacks, with no help from the provider, in hours. Four rebuilds a year.
Proves: it builds. Agentic Verification
Tested Exit Report
Our specialists rebuild by hand in a clean room and test the business functions you nominate, without the original developers.
Proves: you could exit and keep working. Exit Exercise
The Recoverability Certificate documents the rebuild and its result. It doesn't grant release rights: those come from the agreement.
What it costs
One price row for SaaS applications.
Per SaaS application, per month. Choose the protection, then the level.
Escrow
Everything you need to be protected.
Custody, release under the Escrow Agreement, an automated check and a Software Resilience Certificate.
$249per application per month
Explore EscrowEscrow Pro
Everything you need to recover.
Escrow plus Agentic Verification: proof the deposit builds, and a Recoverability Certificate.
$599per application per month
Explore Escrow ProResilience
We recover it.
The deposit comes to Codekeeper. If the service fails, we run the recovery.
$449per application per month
Explore ResilienceResilience Pro
Proven before we need it.
Resilience plus Agentic Verification, so recovery starts from a deposit we know builds.
$799per application per month
Explore Resilience ProContinuity
Full continuity.
Everything in Resilience, plus the live environment kept paid and switched on for an agreed period while we recover.
$1,599per application per month
Explore ContinuityContinuity Pro
Full continuity, proven in advance.
Continuity plus Agentic Verification, so recovery starts from a deposit we know builds.
$1,949per application per month
Explore Continuity ProEscrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on. At every protection, Pro adds Agentic Verification. Setup is $499 per arrangement, or $999 for Continuity and Continuity Pro. One claimant is included; more are an add-on. Cost coverage is quoted for Resilience and Continuity. Enterprise: talk to us. See all prices
Free guide
Introduction to SaaS Escrow
How to protect a hosted application you don't run yourself: what to deposit, and how it comes back.
- What a SaaS deposit needs beyond source code
- Recovery scope for hosted and cloud services
- Automatic deposits from your vendor's repositories
Questions
SaaS escrow, answered.
What is a SaaS escrow agreement?
An agreement between the SaaS provider, Codekeeper and, usually, the customer. It sets out what's deposited, how it's kept current and the conditions under which it's released. If the provider fails, for example through insolvency, the customer receives what it needs to run the service elsewhere. How the agreement works
How is SaaS escrow different from software escrow?
Software escrow protects applications you install, with the source code and documentation. SaaS escrow protects a hosted service, where the software, the data and the infrastructure all live with the provider. The deposit adds infrastructure definitions, data exports, credentials and third-party services, and it has to keep pace with a service that changes with every deployment.
Do large, well-funded providers need it too?
Size reduces some risks, not all of them. Large providers are acquired, retire products and are targeted by attacks. If a service is critical to your operations, the question is what happens if it stops, whoever runs it.
Why would a SaaS provider agree to escrow?
It removes a common objection in enterprise procurement and shows operational maturity. The provider's code stays private: the deposit is released only under the agreed conditions, not on request.
How is a SaaS deposit kept current?
Connect the provider's repositories and cloud platforms once through our integrations, and deposits sync daily. Anything that doesn't live in a repository can be uploaded by hand.
Can Codekeeper keep the service on if the provider stops?
That's what Continuity is for. We map the live environment at setup (where it runs, the accounts it depends on, the services it needs) and keep the map current. If the vendor stops, we keep it paid and switched on for an agreed period, set per arrangement, while we recover the application. Bills are recharged at cost.
How much does SaaS escrow cost?
For a SaaS application, Escrow is $249 per month and Escrow Pro $599, with a $499 setup per arrangement. Resilience is $449 and Resilience Pro $799. Continuity is $1,599 and Continuity Pro $1,949, with a $999 setup. See pricing
Ready for the product page? SaaS escrow at Codekeeper
Protect the cloud applications your business runs on.
Book a demo and we'll map what your SaaS applications need in a deposit, and which protection fits each one.