What is source code escrow?

Source code escrow, defined

Source code escrow keeps a vendor's code with a neutral party, under terms agreed by both sides, so the customer has a way back if the vendor can't deliver.

The vendor deposits its source code and the supporting materials with an escrow agent such as Codekeeper. The agent holds the deposit and keeps it current. If the vendor goes out of business, stops maintaining the software or breaches the agreement in a defined way, the agent releases the deposit to the customer, who can then maintain and operate the software independently.

What is source code?

Source code is the human-readable set of instructions developers write to build an application. It sits behind every feature, workflow and integration. Without it, fixing bugs, making changes or moving the software to a new environment isn't practical. The vendor holds it, and without escrow, neither side has a plan for what happens to it if things go wrong.

Source code escrow or software escrow?

In most contexts, the terms mean the same thing. "Source code escrow" puts the code first. "Software escrow" is the broader term: it covers the code and everything a developer needs to maintain the application, from documentation to build scripts and dependencies. The difference matters when you decide what goes into the deposit, because code alone is rarely enough. What is software escrow?

Why a licence isn't enough

Most customers assume their software licence covers them if the vendor runs into trouble. Most vendors assume the licence protects their code. In the situations that matter, neither holds.

A licence grants the right to use the application. It doesn't give the customer the source code. The code is the vendor's most closely guarded asset: years of development and know-how. Handing it over, even to a long-standing customer, is something most vendors resist, and for good reason. But it leaves a gap.

If the vendor fails, nobody maintains the software. The customer can't fix bugs or make changes, and starting over is slow and expensive. The vendor, if it's going through insolvency or an acquisition, has no controlled way to decide what happens to its code.

Escrow closes the gap for both sides:

• The customer gets a written right to the code, held by a neutral party, if an agreed condition is met.
• The vendor keeps its intellectual property private. The code is released only under the agreed conditions, not on request.
• Both know in advance what happens, so nobody has to negotiate it in a crisis.

Depositing code isn't depositing working code

Until someone has tested a deposit, it's an open question whether the code is complete, the build instructions are accurate and every dependency is there. A snapshot from two years ago, or code without the tooling to build it, is protected on paper only.

For software your business relies on, that's worth answering before a release forces the question. And it's worth deciding who would do the recovery: your own team, or someone who does it for you.

When the code is released

Release conditions are the events that give the beneficiary the right to ask for the deposit. They're defined in the agreement up front, and nothing is released outside them. The most common are:

• The vendor's insolvency or bankruptcy
• The vendor ceasing to trade
• A failure to provide agreed maintenance or support, after formal written notice
• A material breach of the licence
• A change of ownership after which support obligations aren't honoured
• Persistent, documented failure to meet agreed service levels

Others can be negotiated, such as the departure of people essential to maintaining the software, or the vendor failing to keep the deposit current.

How a release works

1. The beneficiary asks for a release and says which condition has been met.
2. We verify the request before anything becomes accessible: a legal review, verification of the release condition and authentication of the beneficiary. The depositor is notified, and the agreement sets how a dispute is handled.
3. Once the release conditions are verified, the beneficiary typically has access within two to three hours.

Rights after a release

A release doesn't transfer ownership of the source code or create new intellectual property rights. The customer receives the right to use the code to maintain and operate the application, as the licence and the agreement define. The vendor keeps its intellectual property, and the agreement should say so clearly.