What is a source code escrow?

A source code escrow is a three-party legal agreement between the licensee (software supplier), licensor (customer) and an Escrow Agent. The licensor places a copy of their software source code with the Escrow Agent. The agreement specifies release conditions such as the supplier going bankrupt or withdrawing support of the software product. If a release condition occurs, the Escrow Agent (following due legal process) will release the source code to the licensee. With the source code in hand the licensee can arrange an alternative support and maintenance provider for the software.

What is an Escrow Agent?

An Escrow Agent is an independent third party who stores the source code in a safe or vault. There are several dedicated escrow agency companies and quite often law firms act as escrow agents.

How popular is source code escrow?

According to some sources in the legal industry, around 75% of all software license contracts mandate source code escrow.

What are the common problems with source code escrow?

About 95% of source code escrow deposits are unlikely to work. This is mostly due to inadequate preparation of the deposit like omitting build instructions, critical dependency software, development tools and software development environments. In some cases the source code may only be small portion of what you need to build the software application. Another very common problem is that updates and patches to the software source code don’t make it to the escrow agent due to lack of process and escrow management.

Why is APPS Global a better Escrow Agent?

Most escrow agents simply offer storage of source code in safes or vaults and are staffed by non-technical people. APPS Global is a technology-enabled escrow agent. That means we have software engineers and technologists on staff to help create escrow deposits at an acceptable level of release readiness for both parties. APPS Global’s Advanced Escrow Service includes a purpose designed 10 point verification process to raise the basic standard of deposits and an Advanced Escrow Platform that gives a build-on-demand capability for maximum protection. APPS Global can also manage the complete lifecycle of one or a complete portfolio of source code escrows.

What is the Advanced Escrow Platform?

The advanced escrow platform uses disk imaging and new-generation technologies such as virtualisation to capture the complete software development environment including the source code of a supplier’s application. In practice this allows software suppliers to submit their escrow deposit as a complete disk image or virtual machine from almost any virtualisation platform including VMWare, Virtual PC, Parallels etc. Our software engineers make various standardisations then place the VM or disk image into our electronic vault or copy to a separate media for physical storage. This elegant approach to source code escrow provides a build-on-demand capability at a fraction of the build costs offered by traditional software escrow verification services. We like to think this introduces a new-generation of escrow solution to the market.

Licensees

If you are procuring licensed software and using source code escrow, here are some questions that may be useful to pose in your own organisation.

Do we a have a policy regarding source code escrow?

Do we ask for source code escrow in all software licensing contracts?

Is our decision to mandate source code escrow driven by a documented risk analysis?

Who in our organisation is responsible for following up and establishing escrow agreements after licensing contracts are signed?

Do we have specific requirements for the source code release conditions and are they specified in the escrow agreements?

How long would it take to setup and build the escrow source code if a release event occurs?

How do we know that the code sent to the escrow agent is capable of producing the system we have in production? Are our source code escrows verified?

Is the source code in escrow the same version as our production systems? Who in our organisation is responsible for ensuring this remains in lock-step?

 
Licensor (Supplier/Developer)

If you are a software developer and having to provide source code escrow to your customers, here are some questions you may want to pose in your organisation.

How many source code escrow requests do we receive and how much time is spent on them?

Would a single master escrow agreement streamline our escrow requirements and reduce cost?

What are the specified release events and contitions in our escrow aggreements?

Could a source code escrow with regular maintenance be an added selling point for our products?

Would a live escrow be a leveraged advantage by doubling as a hot off-site backup?

Would the APPS Global Advanced Escrow Platform using disk imaging or virtual machines be a more cost effective escrow solution for us?