A software escrow clause is the provision in a license or service agreement that puts a copy of the vendor’s source code, build materials, and credentials into the hands of a neutral third party, with instructions to release everything to you if the vendor can no longer support the software. It gives you a path to keep the application running without asking the developer to expose trade secrets during normal operations. The clause does real work only if three things are drafted carefully: what gets deposited, what events force release, and what you are allowed to do with the code once you have it.
What the Deposit Must Contain
Source code by itself rarely rebuilds working software. The clause should require the developer to deposit the complete source, build instructions, technical documentation, and any encryption keys or credentials needed to reach development tools. It should also require a full accounting of the build environment: compilers, third-party libraries, API keys, and a Software Bill of Materials listing every external dependency.1Escode. What is Software Escrow For cloud-native applications, add Infrastructure as Code files such as Terraform or CloudFormation templates, container images, and deployment scripts capable of recreating the production environment from scratch.
Third-party components are the trap. If the software depends on external libraries, APIs, or services owned by someone other than the developer, you may need separate licenses for those pieces after a release event.2The Escrow Company. Guide to Software Escrow Agreements: Key Legal Terms Explained Require the developer to list every third-party dependency and its license terms so you know in advance what further agreements will be necessary.
Freshness matters as much as completeness. The clause should require updates at least quarterly or whenever a major version ships. Many providers now support automated syncing directly from GitHub, GitLab, or Bitbucket, which keeps the escrowed code aligned with what is running in production.3Escrow London. 3 Reasons You Should Escrow Your Code Directly From GitHub Without automated integration or a firm update schedule, deposited materials can drift months behind the live version and become useless in an emergency.
Who Holds the Deposit
Software escrow is a three-party arrangement among the developer (licensor), the customer (licensee), and a neutral agent who holds the deposit.4Bloomberg Law. Commercial, Agreement – Tri-Party Source Code Escrow Agreement (Annotated) The agent safeguards the materials, verifies that they match the contract’s description, and releases them only when a documented trigger has occurred. Release does not happen on a phone call.
The agent cannot be affiliated with either party, and the escrow agreement is a separate contract from the underlying license.5U.S. Securities and Exchange Commission. Three-Party Escrow Agreement That separation is what makes the arrangement workable for both sides.
Specify the agent’s security posture in the clause. Reputable agents hold a current SOC 2 Type II audit report, the framework the American Institute of Certified Public Accountants uses to evaluate how service organizations protect data.6Codekeeper. SOC 2 Readiness With Software Escrow Requiring that certification by name gives you meaningful assurance about how your deposit is stored and handled.
Release Triggers
Triggers are the heart of the clause. Vague language invites disputes, so each event should be defined with enough precision that a neutral party can tell whether it has occurred.
Bankruptcy or Insolvency
The developer filing for bankruptcy or becoming insolvent is the most commonly specified trigger.7techUK. What are the Release Events and Clauses in Software Escrow Agreements Federal bankruptcy law adds a layer here. Under 11 U.S.C. § 365(n), if a bankrupt licensor’s trustee rejects a software license, the licensee can elect to retain its rights to the intellectual property for the remaining duration of the contract.8Office of the Law Revision Counsel. 11 USC 365 – Executory Contracts and Unexpired Leases The licensee continues paying royalties, and the trustee must provide the intellectual property and cannot interfere with the licensee’s rights to it. The escrow agreement serves as the supplementary agreement contemplated by the statute and is the mechanism through which the licensee actually receives the code.
One limit is worth noting. The Bankruptcy Code defines “intellectual property” to include trade secrets and copyrighted works, which covers most commercial software, but the definition does not explicitly cover trademarks, and some argue it does not reach every form of proprietary technology.9Cornell Law Institute. Definition: Intellectual Property from 11 USC 101(35A) A clause that relies solely on § 365(n) without independent triggers can leave gaps.
Failure to Support
The more common real-world trigger is the developer’s failure to maintain or support the software as required by the underlying agreement. This covers the vendor ceasing operations, discontinuing a product, or ignoring support requests. The clause should define what counts as a material support failure and specify a cure period, typically 30 to 60 days, during which the developer can fix the problem before the agent begins release.10Codekeeper. Software Escrow Release Conditions: A Practical Guide If the breach is not cured in that window, the agent proceeds.
What Happens If the Developer Objects
A release request does not produce automatic delivery. The developer typically has 10 business days to respond with objections after receiving notice of the request.11The Escrow Company. Triggering a Software Escrow Agreement: A Guide for Beneficiaries If the developer contests, many escrow agreements send the matter to arbitration, where an independent arbitrator reviews the evidence and issues a binding decision on whether a release event occurred. The more concrete your trigger definitions, the less room there is to argue.
Verification of the Deposit
Depositing files means nothing if those files cannot produce a working application. Verification is how you confirm the materials are complete, uncorrupted, and buildable, and the clause should spell out which level applies.
A basic integrity check confirms that files are readable and match the descriptions in the agreement. It catches missing files and damaged media but tells you nothing about whether the code actually compiles. A full build verification goes further: an independent technician recreates the build environment from the deposited materials and compiles the software into a functional application matching the production version. Full verification costs more, running roughly from $2,750 for straightforward applications to $29,000 or more for complex, multi-component systems. For mission-critical software, that expense is worth it. Discovering during an actual outage that the deposit is unbuildable defeats the point of having escrow.
Verification should happen shortly after the initial deposit and again whenever significant updates are submitted, with results documented in a formal report shared with both parties. For automated deposit integrations, verification can run on a recurring schedule, catching build environment drift before it matters.1Escode. What is Software Escrow
What You Can Do With the Code After Release
Receiving escrowed source code does not make you the owner. Under most escrow agreements, the licensee gets a right to use the code strictly for self-maintenance: fixing bugs, applying security patches, and keeping the software running in your own environment. You cannot sublicense the code, sell it, or use it to build a competing product.12devDept. What am I allowed to do with source code taken from escrow Restrictions from the original license, including seat counts, business unit limits, and territory, generally survive the release event.
Escrow gives you continuity, not ownership. That is a point worth internalizing before you negotiate the clause, because the drafting choices follow from it.
SaaS-Specific Terms
Traditional escrow was built for on-premise software. SaaS changes the picture, because the application runs in the vendor’s cloud and losing access means losing both the software and the data in it. A SaaS escrow clause should require deposit of git repositories, Infrastructure as Code deployment scripts, container and virtual machine images, and database backups.13The Escrow Company. SaaS and AI Escrow Services for AWS, Azure and Google Cloud It should also require the vendor to deposit and regularly update administrator credentials, including usernames, passwords, and multi-factor authentication keys, so that you or the agent can keep the service running by paying the cloud provider directly.
SaaS verification goes beyond a build. Cloud deployment verification has consultants observe a full deployment of the software and infrastructure from the deposited files, confirming that the escrowed assets can actually recreate a working production environment. Continuity options range from simple credential handover for the existing production instance, to managed continuity where the escrow provider hosts the service for a transitional period of about 90 days, to full recovery escrow that rebuilds the application in a secondary cloud environment.13The Escrow Company. SaaS and AI Escrow Services for AWS, Azure and Google Cloud Pick the model in the clause rather than leaving it open.
Who Pays
Costs fall into three buckets: a one-time onboarding fee, an ongoing annual fee, and optional verification. Onboarding typically runs $1,000 to $2,000. Annual fees start around $4,500 and climb with the number of deposits and the complexity of services. Verification adds $2,750 for a straightforward review and can exceed $29,000 for deep testing of complex environments. In many deals the licensee covers the annual maintenance and the licensor covers onboarding, but every piece is negotiable. Make the allocation explicit in the clause so no one receives a surprise invoice after signing.