Components of the escrow arrangement for source code

The supplier hands over the technology, under strict conditions, to us as an independent escrow agent. We manage this technology in a special and well-secured depot where no one can access it.

There are two basic variants of the arrangement, but because it often involves technology developed specifically and on demand, the individual escrow arrangement is the most common.

Overleg Escrow Regelingen

1. The escrow agreement (legal).

The escrow agreement is the legal document in which you record all agreements made.

We release the materials in our custody (the repository) to the beneficiary or foundation if the software vendor can no longer ensure the continuity of the software application. Then any arrangements for temporary continuation of services that may have been agreed with the service provider take effect. We release the materials under strict conditions and based on verifiable facts that must be consistent with the grounds for continuation from the escrow agreement.

Thus:

  • The escrow agreement protects the continuity of the beneficiary
  • The strict control of the predetermined grounds for continuation also protect the continuity of the supplier

2. The technical verification (control)

We check the material given on deposit so that software vendors and users can be sure that the material is complete and working properly. We call that Technical Verification Service (TVS). We perform these at four levels (TVS Levels), depending on the situation and supplier and user requirements.

TVS Level I - Integrity verification.

This basic verification is standard in our services; we perform it on every submission of material. It is basic verification, including checking for material integrity. It provides assurance that the material deposited is, among other things, virus-free, accessible and of the expected type.

TVS Level 2 - Material audit

This is basic verification, including an audit on the material given on deposit.

  • One way we verify is through spot checks (spot checks) on the material.
  • We check that specific agreements regarding the material have been met.
  • We determine if libraries or files are present.

TVS Level 3 - complete verification.

In a complete verification for a source code escrow arrangement, we demonstrate that the material deposited meets the stated continuity goals of the escrow arrangement. It is similar to a fire drill – our verification consultant simulates the same steps we take when issuing the deposit.

In a source code escrow arrangement, we check whether we can rebuild and maintain the software application.

  • We compile the source code based in part on the information contained in the repository.
  • We verify that this matches the software application made available to the software user.

We can perform the TVS level 3 at a software vendor location or at Escrow Alliance’s software lab.

TVS Level 4 - Customised verification.

Customised verification is possible, consider:

  • Testing components of the software
  • check how the software compares in a
  • complex environment
    specific controls applicable to your situation

3. The depot (secure storage).

The deposit (escrow deposit) consists of materials needed to ensure continuity if the supplier goes out of business.

In escrow for source code, the material consists of:

  • the source code
  • technical documentation that allows an engineer to apply debron code
  • any dependencies on third-party libraries

How can you submit?

We like to make submitting material as easy, efficient and manageable as possible. Therefore, we look at the options available to the software vendor.

Submissions can be made, for example, via:

  • secure ftp
  • various source code management systems such as GitLab, GitHub, Bitbucket
  • a mix of delivery methods

Always up-to-date material in storage?

How often you have to deliver the material depends on the arrangements made. In any case, it is possible to file in real time with us. That means we continuously update the materials online. We then process the material into an official registered deposit at pre-arranged times or ad hoc.

Dual storage

Escrow Alliance offers standard dual material storage. That is, we keep a copy of the deposit in two geographically separate locations. 

Storage takes place in the Netherlands and can:

  • physically, in specially equipped data vaults
  • electronically, on well-secured servers
  • both physical and electronic


The vaults are ISO 9001 and ISO 27001 certified, as is Escrow Alliance itself. Only authorised and screened personnel have access to the vaults.


What if Escrow Alliance falls away?

In the escrow agreement, we make it standard that the deposits will be returned to the supplier or go to a newly designated escrow agent if Escrow Alliance unexpectedly goes out of business. To fulfill this promise, the Continuity and Guarantee Escrow Alliance (SCWEA) Foundation manages the vaults. The foundation has the right to return materials in that case.

What is the most suitable solution
for your situation?

Find out about the possibilities, we are happy to think along with you.