Source code escrow

What it means

Source code escrow is an arrangement under which a software supplier deposits the source code with an independent third party, who releases it to the customer if the supplier ceases to exist or stops supporting the software. It is a special form of escrow aimed at technology risk.

It protects businesses that depend on critical software, such as a custom ERP system, production control or a specialised application. Without the code, if the supplier failed they could not fix bugs or adapt the system to new needs and would have to find a replacement in a hurry.

Escrow complements the licence agreement. The customer usually owns only a licence to use the software, not the code, and the supplier does not want to disclose the code because it is a trade secret. Escrow is a compromise that protects both sides.

How it works in practice

The escrow agreement sets out what is deposited, how often it is updated, who verifies it and when the code is released, for example on the supplier's bankruptcy, end of support or material breach. The escrow agent is usually a specialist firm, a notary or a lawyer.

It is important to verify that the deposited code is complete and can actually be built into a working application. Without documentation, libraries and build instructions, the code may be worthless. Some escrow agents offer technical verification for an extra fee.

With a software development agreement, escrow is best agreed at signing, when the customer has the strongest negotiating position. Escrow forms part of the business continuity plan and reduces the risk of vendor lock-in.

What to watch out for

For SaaS solutions the code alone is often not enough, because the application runs on the supplier's infrastructure and the customer also needs data, configuration and the environment. Cloud services therefore add rules on data export and switching to another provider.

The code is only useful if the customer has people able to take it over and maintain it. On release, budget for a new supplier or in-house developers and for a handover that may take months.