Components of the escrow arrangement
Whatever arrangement you need, it consists of three parts: escrow agreement, verification & deposit.
1. The escrow agreement (legal).
The escrow agreement is the legal document in which you record all agreements made.
We will release the source code and any other materials required for continuity that are on deposit with us (the deposit) to the beneficiary if the software vendor can no longer ensure the continuity of the software application. We do so under strict conditions and on the basis of verifiable facts that must be consistent with issue documents from the escrow agreement.
Thus:
- The escrow agreement protects the beneficiary’s continuity.
- Strict control of the predetermined release plans protect the supplier’s property.
2. The technical verification (control)
We check the material given on deposit so that software vendors and users can be sure that the material is complete and working properly. We call that Technical Verification Service (TVS). We perform these at four levels (TVS Levels), depending on the situation and supplier and user requirements.
TVS Level I - Integrity verification.
This basic verification is standard in our services; we perform it on every submission of material. It is basic verification, including checking for material integrity. It provides assurance that the material deposited is, among other things, virus-free, accessible and of the expected type.
TVS Level 2 - Material audit
This is basic verification, including an audit on the material given on deposit.
- One way we verify is through spot checks (spot checks) on the material.
- We check that specific agreements regarding the material have been met.
- We determine if libraries or files are present.
TVS Level 3 - Complete verification.
With a complete verification, we demonstrate that the material deposited meets the stated continuity purposes of the escrow arrangement. It is similar to a fire drill – our verification consultant simulates the same steps we take when issuing the deposit.
In a source code escrow arrangement, we check whether we can rebuild and maintain the software application.
- We compile the source code based in part on the information contained in the repository.
- We verify that this matches the software application made available to the software user.
We can perform the TVS level 3 at a software vendor location or at Escrow Alliance’s software lab.
TVS Level 4 - Customised verification.
Customised verification is possible, consider:
- Testing components of the software
- check how the software compares in a complex environment
- specific controls applicable to your situation
3. The depot (secure storage).
The deposit (escrow deposit) consists of materials needed to ensure continuity when the supplier goes out of business.
In escrow for source code, the material consists of:
- the source code
- technical documentation that allows an engineer to apply the source code
- any dependencies on third-party libraries
How can you submit?
We like to make submitting material as easy, efficient and manageable as possible. Therefore, we look at the options available to the software vendor.
Submissions can be made, for example, via:
- secure ftp
- various source code management systems such as GitLab, GitHub, Bitbucket
- a mix of delivery methods
Always up-to-date material in storage?
How often you have to deliver the material depends on the arrangements made. In any case, it is possible to file in real time with us. That means we continuously update the materials online. We then process the material into an official registered deposit at pre-arranged times or ad hoc.
Dual storage
Escrow Alliance offers standard dual material storage. That is, we keep a copy of the deposit in a geographically separate location.
Storage takes place in the Netherlands and can:
- physically, in specially equipped data vaults
- electronically, on well-secured servers
- both physical and electronic
The vaults are ISO 9001 and ISO 27001 certified, as is Escrow Alliance itself. Only authorised and screened personnel have access to the vaults.
What if Escrow Alliance falls away?
In the escrow agreement, we make it standard that the deposits will be returned to the supplier or go to a newly designated escrow agent if Escrow Alliance unexpectedly goes out of business. To fulfill this promise, the Continuity and Guarantee Escrow Alliance (SCWEA) Foundation manages the vaults. The foundation has the right to return materials in that case.
What is the most suitable solution
for your situation?
Find out about the possibilities, we are happy to think along with you.
