What Is Software Escrow And Do You Need It?

Escrow usually arrives as a line in a procurement checklist. Someone in legal or risk asks whether the supplier will put the code in escrow, the supplier says yes, and a fee gets paid every year until the day it matters.

The underlying worry is real. If a small software house runs a system your operations depend on, you have a single point of failure sitting outside your own company.

The Insolvency Service recorded 23,938 registered company insolvencies in England and Wales in 2025, a rate of 52.5 per 10,000 companies, or roughly one in 190.

The pressure has eased slightly since. The 12-month rolling rate to July 2026 was 50.3 per 10,000 companies, or one in 199, which is lower than a year earlier but still well above the 2015 to 2019 average.

What escrow does about that is narrower than most buyers assume. This article covers what sits in a deposit, how release works, what it costs in the UK, why verification decides whether any of it was worth paying for, and who should skip it entirely.

What Goes Into a Software Escrow Deposit?

Everything a competent engineer would need to rebuild and run the system on a clean machine without phoning the supplier. Source code alone is not enough, and source code alone is what most deposits contain.

What a Usable Deposit Contains

Escode, part of NCC Group and one of the largest escrow agents operating in the UK, publishes guidance on deposit contents covering source code, build instructions, dependencies, configuration and documentation. This is the practical version of that list.

• Source code for the application and any shared internal libraries, at the exact version running in production.
• Build scripts and pipeline configuration, including the CI definitions that actually produce the artefact.
• Third-party dependencies with versions pinned, plus the licences that govern them.
• Environment configuration: infrastructure definitions, server specifications, database schemas and migration scripts.
• Credentials, encryption keys and the passwords needed to open the deposit itself.
• Technical documentation, architecture notes, API specifications and test suites.
• A roadmap of the deposit, meaning a plain-English index of what is in it and where.
• Named contacts for the engineers who built it, which costs nothing and matters more than it sounds.

What Deposits Are Usually Missing

The gaps follow a pattern: private package registries the supplier hosts, signing certificates, licence keys for commercial components, and environment variables that only ever lived in the supplier’s CI system.

None of that is malice. The person doing the deposit exports the repository and assumes the rest is obvious, because to them it is.

Deposit item	Why it matters on release day	How often it is missing
Production-version source code	Anything else rebuilds the wrong system	Rarely
Build and CI pipeline configuration	Without it you are reverse-engineering the build	Often
Pinned third-party dependencies	Registries move, versions vanish, builds stop reproducing	Often
Private package registry contents	Internal libraries the supplier hosts themselves disappear with them	Almost always
Signing certificates and licence keys	The build completes but the artefact will not install or run	Almost always
Infrastructure and environment definitions	You have an application with nowhere to put it	Often
Database schema and migration scripts	You can run the code but not read your own data	Sometimes
Deposit roadmap and named engineer contacts	Weeks of archaeology, at the worst possible moment	Almost always

Nothing on that list is exotic. Every item is something the supplier uses daily and therefore never thinks to write down.

Who Prepares the Deposit Matters

Ask which named engineer prepares it and how long it takes them. A deposit assembled in twenty minutes by whoever was free is a different artefact from one prepared against a checklist by someone who has built the system from scratch.

It is a fair question to put to a supplier during technical due diligence, and the answer tells you more about the arrangement than the agreement does.

How Does a Source Code Escrow Agreement Work?

Three parties sign it: the software owner who deposits, the licensee who may receive, and the escrow agent who holds the materials and decides whether a release condition has been met. The three-party structure is the whole point, because your right to the code does not depend on the supplier co-operating at the moment they are least able to.

Why Three Parties and Not Two

A two-party promise to hand over code on insolvency is worth what the supplier’s administrator decides it is worth. A three-party agreement puts the materials outside the supplier’s estate before anything goes wrong.

It also removes the negotiation from the worst possible moment. An administrator’s job is to realise value for creditors, not to help you keep a business-critical system running.

What Triggers a Release

Release conditions are negotiated rather than standard, and the wording is where most of the value sits. These are the four that appear in almost every agreement.

Trigger	What it usually covers	Drafting note
Insolvency	Administration, liquidation, receivership or a company voluntary arrangement	Name each procedure. A clause saying only ‘insolvency’ invites argument about which events count
Material breach of support	Failure to meet maintenance or support obligations, unremedied after a defined period	Define the remedy period in days and say who certifies the breach
Ceasing to trade or to support the product	The supplier carries on but abandons your product	The most commonly omitted trigger, and the most likely one to actually happen
Change of control or assignment	An acquirer that has no interest in your product	Tie it to discontinuation of support rather than to the transaction itself

Watch the third row in particular. A supplier who has quietly stopped developing a product but still answers the phone may not have triggered anything at all.

If continued development matters to you, write that into the release conditions rather than assuming it. The same discipline belongs in the underlying development contract, which is where most of these arguments should be settled.

Where UK Insolvency Law Actually Sits

One point is widely misunderstood. Section 233B of the Insolvency Act 1986, inserted by the Corporate Insolvency and Governance Act 2020, stops a supplier terminating a contract purely because their customer has entered an insolvency procedure.

That is a protection for the insolvent customer, not for you as a customer of an insolvent supplier. It has no bearing on escrow release conditions, which are governed entirely by the escrow agreement itself.

So do not rely on statute to get your code. Rely on the agreement, and read it before you sign it.

Keeping the Deposit Current

A deposit made once at signature and never updated protects you against a version of the system you stopped running years ago. This is the quietest way escrow fails.

An agreement that ties deposits to release events, with the agent chasing and reporting missed updates, is worth considerably more than one saying the supplier will deposit periodically. Ask for written confirmation of every deposit.

Supplier gone quiet and you need someone who can pick the system up? SD:UK takes over stalled and orphaned builds

Why Is an Unverified Escrow Deposit Often Useless?

Because a deposit is only a set of files until somebody tries to build it, and builds depend on the machine they were built on in ways that stay invisible until you change the machine. Verification is the difference between a legal arrangement and an operational one.

The Only Published Failure Figures

The most-cited numbers come from an Iron Mountain analysis reported by the Society for Computers and Law, which found 97.4% of deposits submitted for analysis were incomplete and 74% required additional input from the developer before they would compile.

Those figures date from 2007 and the article reporting them was published in 2009. No escrow agent has published anything comparable since, which is itself worth noticing.

Treat them as directional rather than current. Every engineer who has picked up an abandoned codebase will recognise the shape of them.

The Verification Levels and What Each One Proves

Names vary between agents. Escode currently markets four tiers: standard build verification, independent build verification, and standard or independent build with replicate for hosted systems.

Level	What is checked	What it protects against
Deposit review	The agent lists what arrived, confirms the media is readable and records file types	An empty, corrupt or wrong-directory deposit
File and dependency analysis	Declared components and libraries matched against a source inventory	Obviously missing modules and undeclared third-party code
Standard build verification	A full rebuild witnessed and documented in the supplier’s own environment	Source that does not compile at all
Independent build verification	A rebuild in a clean environment the agent constructs itself, using only the deposited instructions	Hidden dependencies on the supplier’s machines, undocumented tooling and missing keys
Build and replicate	Rebuild plus deployment and functional testing, including data restore for hosted systems	Code that compiles but will not run, and environments that cannot be recreated

Only independent build verification and above give you real protection, because only those remove the supplier’s environment from the equation. Everything below tells you that files exist.

What Release Day Actually Looks Like

You notify the agent, the agent notifies the supplier or their officeholder, and a defined objection window opens. Uncontested releases typically complete in working days rather than hours.

Then you receive an archive and a licence, and the real work starts. Somebody has to build it, stand up an environment, restore data and learn a system they have never seen.

That is the phase escrow does not cover and nobody budgets for. In practice it is a system takeover project, and it runs faster when the receiving party was named and briefed before anything went wrong.

Who Pays, and What It Signals

Verification is almost always paid by the beneficiary, which is you, because you are the one who needs the assurance. Agents quote it per engagement rather than publishing fixed tiers.

That cost is the honest test of whether escrow is proportionate here. If the system is not worth verifying, it is probably not worth escrowing, and the money is better spent on a technical assessment of what you actually have.

What Does Software Escrow Actually Cost in the UK?

Published annual fees for a single-licensee source code agreement run from around £595 to £1,835, with setup fees between nothing and £750. Verification is quoted separately and is where the real money sits.

What UK Agents Publish

These are list prices taken from public UK pricing pages and the government’s own Digital Marketplace listings in September 2026. SD:UK sells neither escrow nor verification, so there is no product behind these figures.

Provider	Annual fee	Setup	SaaS or cloud continuity
LE&AS	£595 per year	£750	£950 per year, £1,250 setup
L1 Escrow	£995 per year, all inclusive	None	Included in the annual fee
Escrow London	£1,395 to £1,695 per year	None	£1,995 to £2,995 per year
NCC Group and Escode, via G-Cloud	£1,835 per licence per year	Quoted separately	£1,805 per licence per year

The sources are each agent’s own published pages: LE&AS, L1 Escrow, Escrow London and the NCC Group G-Cloud listing.

The G-Cloud figures are useful because they are filed with a public buying framework rather than quoted in a sales conversation. The escrow as a service listing covers the hosted equivalent at £1,805 per licence per year.

What the Annual Fee Does Not Include

• Verification of any kind, which is quoted per engagement and can run to five figures for a full independent build.
• The release fee itself, which some agents charge separately when you actually need the deposit.
• Additional beneficiaries on a multi-licensee agreement, which are usually priced per joiner.
• Your own cost of taking the system on afterwards, which is the largest number on this page and never appears in a quote.

Budgeting It Honestly

A base agreement plus meaningful verification is a four to five figure annual commitment, not the few hundred pounds a procurement checklist assumes. Price the whole package before you agree to the line item.

Then compare it against what a rebuild would cost. Our breakdown of software development costs gives the range, and if escrow plus verification approaches a meaningful share of that, the escrow is not the efficient control.

What Is SaaS Escrow and Why Is It a Different Problem?

SaaS escrow protects continuity of a running service rather than access to code. If your supplier hosts the product, source code on its own gives you nothing usable, because what you need is the environment, the configuration and your data.

What Disappears When a Hosted Supplier Fails

The cloud accounts, the managed database holding your records, the DNS, the payment and email integrations, and the runbooks describing how any of it is operated. Handing you a repository at that point is close to meaningless.

You would be starting a deployment project during an outage, with no data. That is the scenario SaaS continuity products exist to prevent.

Continuity Options for Hosted Software

• Access-style agreements: the supplier deposits credentials and documentation for their cloud tenancy so you can take control of the live environment rather than rebuild it.
• Replicate-style agreements: a mirrored instance is maintained or can be stood up from deposited infrastructure code, which suits multi-tenant products you cannot simply inherit.
• Contractual continuity without an agent: scheduled data exports in a documented format, a licence to run the software yourself, and a defined transition period.

The third option is cheaper, weaker and better than nothing. It also only works if somebody is ready to operate the thing, which is the part most continuity plans skip and the reason system takeover engagements exist.

Continuity option	What you get on the day	Annual cost shape	Works when
Access-style agreement	Credentials and documentation for the supplier’s cloud tenancy	Mid, £1,800 to £3,000	The product runs in a tenancy that could be handed over intact
Replicate-style agreement	A mirrored instance, maintained or standable from deposited infrastructure code	Highest	Multi-tenant products you could never inherit whole
Contractual continuity, no agent	Data exports, a licence to self-host and a defined transition period	Near zero	Lower-criticality systems, or as a first step while you decide
Code escrow on a hosted product	A repository and nothing to run it on	Low, and misleading	Almost never. This is the most common mismatch in UK procurement

The last row is worth dwelling on. A procurement checklist that says source code escrow gets ticked by a SaaS supplier depositing a repository, and everyone signs off on protection that does not exist.

Your Data Is the Separate and More Urgent Question

Get a regular export of your own data in a format you can read without the supplier’s software, then check that you can actually open it. Do that this month, regardless of what you decide about escrow.

It is also the cheapest control on this page. A scheduled export costs nothing, tests in an afternoon, and covers the failure mode that a security assessment will ask you about anyway.

Which Regulations Now Make Supplier Continuity a Compliance Issue?

Two, and both are recent. DORA has required in-scope EU financial entities to hold documented, tested exit strategies for critical ICT services since 17 January 2025, and the UK’s Cyber Security and Resilience Bill extends supply chain duties to managed service providers.

DORA Article 28 and Exit Strategies

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. Article 28 governs how in-scope financial entities manage ICT third-party risk.

Article 28(8) requires an exit strategy for any ICT service supporting a critical or important function. The plan must allow the entity to leave the provider without disrupting business, breaching regulatory requirements or harming service continuity to clients.

Those plans have to be documented, complete and periodically tested, and the entity must identify alternative providers or an in-house transition route. Escrow is one practical instrument for satisfying that, though it is not the only one and DORA does not name it.

Why This Reaches UK Software Suppliers

DORA is EU law and does not apply to a UK business directly. It reaches UK suppliers contractually, because an EU-regulated bank, insurer or investment firm buying your software must flow those exit and continuity obligations down to you.

If you sell software into EU financial services, expect escrow, verification and exit testing to appear in contract negotiations whether or not you offered them. That belongs in your commercial contract template rather than being negotiated deal by deal.

The UK Cyber Security and Resilience Bill

The Cyber Security and Resilience Bill was introduced on 12 November 2025 and had completed committee stage by February 2026. It extends network and information systems regulation to managed service providers.

It also requires regulated organisations to manage risks arising in their supply chains, including from suppliers critical to delivering the services they are regulated for. Check its current status before relying on it, because it had not received Royal Assent when this article was written.

The direction is clear enough to plan around. Supplier continuity is moving from a commercial preference to a compliance obligation, and that changes who inside your business owns the question.

When Is Software Escrow Worth the Money, and Who Should Not Bother?

Escrow earns its cost when a business-critical system comes from a small supplier you cannot replace quickly and you have a realistic route to picking up the code. Outside that, it is usually an annual fee bought to close a risk-register item.

A Straight Verdict by Situation

Almost every article ranking for this topic is published by a company that sells escrow, so the honest version of this table is hard to find. SD:UK sells neither escrow nor verification.

Your situation	Verdict	Why
Business-critical on-premise system from a supplier with a handful of staff	Worth it, with independent build verification	A genuine single point of failure, and the deposit is the only route to continuity
Hosted product running a core operational process	Worth it as SaaS continuity, not code escrow	You need the environment and the data, not a repository
Bespoke software you commissioned and paid for	Usually unnecessary	IP assignment plus live repository access does the same job continuously and for free
Off-the-shelf product from a large listed vendor	Rarely worth it	Their realistic failure mode is discontinuing the product, not insolvency
Low-value system you could replace in a quarter	Not worth it	Replacement costs less than escrow plus verification plus takeover
No in-house or partner capability to take on the codebase	Not worth it until you name a takeover partner	Released code you cannot build or run is a filing cabinet, not a plan
You sell into EU-regulated financial services	Expect to offer it whether you want to or not	Your customers now carry a documented exit strategy obligation

Who Should Not Bother

If you commissioned the software yourself, escrow is usually solving a problem your contract should have prevented. Proper IP assignment on payment, a repository you own with your own administrator accounts, and infrastructure in your own cloud tenancy give you everything escrow would, and our guide to what belongs in a software development contract sets out the clauses.

Skip it too when the honest answer to what would we do with the code is that nobody knows. Escrow without a named successor, internal or external, buys a legal right you cannot exercise, which is why a code rescue partner identified in advance is worth more than the agreement.

The Question Behind the Question

Escrow is a proxy for a simpler worry: what happens to this system if the people who built it stop. Answering that directly is usually cheaper than insuring against it.

Sometimes the answer is a second party who already knows the codebase. Sometimes it is planning a modernisation programme so the dependency ends rather than being insured, which our Composite Legal Expenses case study is an example of.

A Cheaper Early Warning System

Watch your supplier’s filings at Companies House. Late accounts, a sharp fall in net assets or a change of registered office often appear months before anything triggers an escrow release condition.

Insolvency and strike-off notices are published in The Gazette, which is the official public record and free to search. Setting a reminder to check both twice a year costs nothing.

How Do You Choose an Escrow Agent in the UK?

Compare agents on verification capability, deposit chasing and the cost of an actual release, not on the headline annual fee. The annual fee is the smallest number in the arrangement and the only one most buyers look at.

Seven Questions Worth Asking

Question	What a good answer sounds like	Why it matters
Do you offer independent build verification, or file listing only?	Named tiers with a clean-room build option	File listing proves files exist and nothing more
Will you chase and report missed deposits?	A contractual duty to notify the beneficiary	Silent drift is the most common failure mode
What does a release cost, and how long does it take?	A published release fee and a stated working-day target	This is the fee nobody budgets for
Where are the materials physically held, and under which law?	A named jurisdiction and a UK governing law option	Cross-border releases add weeks
What happens if you as the agent become insolvent?	A documented succession arrangement	Almost nobody asks this, and it is the obvious question
Can the agreement cover a hosted service, not just code?	A replicate or access-style product	Code escrow on a SaaS product protects nothing
Can we add beneficiaries later, and at what price?	A published per-joiner rate	Multi-licensee pricing varies enormously

Judge the Release Process, Not the Brochure

Ask to see the actual release procedure document before signing. It tells you who certifies the trigger, how the supplier can object and how long an uncontested release takes.

That document is the product. Everything else is storage, and the same instinct applies when you are choosing a development partner in the first place.

What Should You Do Instead If You Commissioned the Software?

Own the assets continuously rather than depositing them annually. IP assignment on payment, your own source repository, your own cloud tenancy and a tested build on a machine the supplier does not control give you everything escrow offers, permanently and at no annual cost.

The Clauses That Replace Escrow

• Assignment of intellectual property on payment, not on project completion or final invoice settlement.
• Source hosted in your organisation’s own repository, with your own administrator accounts from day one.
• Infrastructure in your cloud tenancy, with the supplier holding delegated access rather than ownership.
• A documented build that a third party has run at least once, on hardware the supplier does not control.
• A defined exit and handover period, with documentation standards written into the statement of work.

That belongs in the development contract rather than in a separate agreement signed two years later. Our guidance on mitigating outsourcing risk and on running an outsourced project successfully covers how these get negotiated.

Protection	Escrow gives you	Owning the assets gives you
Access to current code	A deposit as fresh as the last update the agent chased	The live repository, continuously
Proof it builds	Only if you pay for independent build verification	Every build your team or supplier runs
Right to modify	Only what the escrow licence permits after release	Full rights from the assignment date
Third-party maintenance	Only if written into the licence explicitly	Anyone you choose to appoint
Infrastructure and data	Only under a SaaS continuity product	Your own tenancy and your own backups
Annual cost	£595 to £1,835, plus verification	Nothing beyond normal hosting
Time to act on supplier failure	Days to weeks, through a release process	Immediate

The right-hand column is available on every project you commission, and it is a drafting decision rather than a budget one. It is also the reason bespoke software rarely needs escrow at all.

Where Escrow Still Helps

Escrow remains the right answer for licensed products you did not commission, where the supplier will never assign the IP and you have no legitimate route to the repository. That is a large share of operational software in UK businesses.

It also helps where a supplier relationship is functional but concentrated, and neither side wants a takeover conversation yet. A fractional CTO is usually the person who should own that judgement.

Test the Plan Before You Need It

Whichever route you pick, run the exercise once while everything is fine. Give the deposit or the repository to somebody outside the supplier and ask them to build and run it, which is exactly what a technical due diligence exercise does in an acquisition.

A day of somebody’s time now tells you whether the whole arrangement is real. Our guide to technical due diligence costs sets out what that scales with.

Related Guides

Related: What Should Be in a Software Development Contract?

Related: Software Technical Due Diligence Costs Explained

Related: How to Mitigate the Risks Involved in Software Outsourcing

Related: What Is Legacy Software Modernisation?

Related: What Is Bespoke Software?

Frequently Asked Questions