Software escrow for UK procurement: compare recovery options

Compare software escrow options by recovery outcome

Compare SES Secure, Escrow London and Escode by the recovery outcome, technical verification and post-release rights. Escode publishes general fee ranges, while comparable option-specific quotations and standard cancellation terms still require written confirmation.[1][2][3]

Escode also lists SaaS & Cloud Continuity, covering cloud credentials and database snapshots. Its verification method and specific recovery commitments are not confirmed in the cited source.[3]

Published reference costs versus a project quotation

Escode’s general guide lists setup and integration at £750–£1,250, annual maintenance at £1,400–£1,850, and technical verification at £1,500–£15,000 or more.[3] These are supplier-published reference ranges checked on 23 September 2026, not quotations for each named product or an independently measured market average. Verification scope and application complexity affect the fee. Confirm the selected service, VAT, renewal changes and cancellation terms in the quote.

SES Secure says pricing depends on beneficiary count, application count, protection level and deployment model, without listing amounts.[1] The cited Escrow London article is a vendor-authored contribution published through techUK in 2024; confirm the current product names, inclusions and charges with the provider.[2] Compare an itemised first-year total and ongoing annual costs, including verification and recovery assistance, rather than annual storage fees alone.

Define the required recovery before choosing

Software escrow is generally a three-party arrangement involving a developer or depositor, a customer or beneficiary and an independent agent. The developer deposits source code and other recovery materials, which are released when an agreed event occurs.[1][2][3]

Specify what recovery must deliver:

• Maintain on-premise software: obtain source code that can be modified for fixes, updates and other changes, rather than object code alone.[6]
• Rebuild SaaS: recover the materials needed to recreate and deploy the hosted environment.[2][3]
• Take control of cloud access: assume control of an existing single-tenant environment after supplier failure.[2]
• Continue service: switch to a standby operating environment instead of waiting for a rebuild.[1][2]

Do not rely on product labels. Escode distinguishes code-only “source-code escrow” from broader “software escrow” covering dependencies and build materials, while SES Secure and Escrow London use the terms more interchangeably.[1][2][3]

Distinguish custody from technical verification

Verification can range from checking files to rebuilding and testing the application:

1. Receipt and storage: the agent confirms that a deposit was received and retained.[1][3]
2. File-integrity testing: files are accessible and virus-free, but this does not establish that the software can be rebuilt.[2]
3. Completeness review: the deposit is checked for the materials required for recovery.[3]
4. Build testing: the deposited materials are used to build the software.[3][4]
5. Independent deployment: the application is deployed into a separate environment.[3]
6. Functional comparison: the rebuilt software is compared with the binary used by the licensee.[4]

Frequency and depth are separate. Escrow London says its Verified Software Escrow for SaaS checks deposited components annually, but the cited source does not publish a complete test protocol.[2] Annual verification therefore does not confirm, by itself, that a clean build and independent deployment are attempted.

Request the verification plan, build procedure, dependency inventory, test results, exceptions, remediation process, retest terms and a redacted sample report. Confirm whether testing covers source code, build instructions, compiler settings, architecture and API documentation, Infrastructure as Code, system images, databases, cloud credentials and the Software Bill of Materials.[3]

Check whether release rights support recovery

Potential release triggers include insolvency, cessation of trading or support, breach of a licence or support agreement, software discontinuation, specified SLA failure and failure to update the deposit.[2][3][6]

For each trigger, request contract wording covering:

• the evidence required to establish the event;
• notice and cure periods;
• the supplier’s right to object;
• who authorises release; and
• the dispute process and timetable.

The supplied provider sources do not confirm standard wording or timelines for these points. Review the proposed agreement rather than relying on product descriptions.[1][2][3]

Post-release rights may be restricted to internal support, error correction or continued independent development and may prohibit resale or distribution.[3][4] The agreement should permit the intended maintenance, modification, deployment and recovery plan, including use by a nominated replacement maintainer where required.[3][6]

Also review deposit-update duties, maintenance obligations, fees, liability, termination, expiry and dispute resolution.[3] LexisNexis describes UK escrow as a contractual mechanism rather than a statutory term.[5] A supplied background source also cautions that insolvency may complicate release where creditors claim the licensor’s assets, including escrowed code.[4]

Evidence to request before approval

Obtain the quotation, order form, escrow agreement, verification statement of work, service levels, security documents and sample verification reports. The available sources leave material pricing, cancellation, recovery and performance terms unconfirmed.[1][2][3]

• Commercial schedule: request written charges for setup, annual administration, verification, additional applications or beneficiaries, automated deposits, release assistance, renewal and exit. Confirm VAT treatment, quotation validity and who pays each fee.[1][2][3]
• Cancellation and exit: establish the minimum term, renewal mechanism, notice period, termination fees, refund position, treatment of deposits and transition support. These terms are not confirmed for the compared options.[1][2][3]
• Deposit controls: request an itemised inventory, update frequency, deposit method, exception alerts and named ownership. Automated deposits may use GitHub, GitLab or Bitbucket; Escrow London also identifies SFTP and S3 buckets.[2][3]
• Verification: obtain the procedures, pass criteria, remediation process, retesting fees and a redacted report. Technical verification is intended to assess whether materials are complete, functional and independently deployable, rather than merely stored.[3]
• Recovery: document each recovery step, responsible party and dependency. Request contractual recovery-time and data-freshness commitments, switch-over testing and any provider-managed continuity period; standard commitments are not verified in the cited sources.[1][2][3]
• Provider capability: seek recent test records, release or incident case studies, customer references and independent assurance. Vendor-authored continuity claims are not independent performance evidence.[1][2][3] Assess secure storage, legal support, technical expertise, operating history and administrative usability.[6]

When software escrow is unsuitable

Escrow is generally unnecessary for applications with low operational impact or which can be replaced readily. Assess whether the software is business-critical, difficult to replace, complex or bespoke, then compare the likely recovery effort with migration to an alternative.[3][6]

Identify who could use the released materials: an internal team, replacement supplier or specialist. If no capable maintainer could build, operate and support the software, custody of code alone offers limited practical resilience.[3][6]

For SaaS, continuity may depend on current data, cloud infrastructure, deployment assets, credentials and an operating environment. A code-only arrangement will not cover those components unless they are expressly included in the deposit or continuity service.[2][3]

Apply three approval gates

1. Recoverability: confirm that the arrangement delivers maintainable code, a rebuilt SaaS environment, cloud-account control or a standby service. The named products do not offer equivalent outcomes.[1][2][3]
2. Proof: require a deposit inventory, update process and verification method proportionate to the application’s importance. Evidence should address completeness and deployability, not merely custody.[3][6]
3. Enforceability: confirm release triggers, post-release rights, dispute procedures, renewal terms and cancellation provisions.[2][3][4] Record unresolved fields as unknown; standard cancellation and renewal terms are not confirmed.[1][2][3]

Approval should depend on the completed quotation, contract and technical evidence supporting the required recovery scenario, not the breadth of the product label.

References

1. Software Escrow | Source Code Agreements | SaaS Escrow (ses-escrow.co.uk)
2. What is the difference between Software Escrow and SaaS Escrow? (Guest blog by Escrow London) (techuk.org)
3. What is Software Escrow? – Escode: The #1 Global Software Escrow Agent (escode.com, 2026)
4. Source code escrow – Wikipedia (wikipedia.org)
5. Software Escrow in the UK: Source Code and SaaS, Release Events, Verification, Escrow Agents and Insolvency | Legal Guidance | LexisNexis (lexisnexis.com)
6. The Basics of a Software Escrow Agreements – EM Law | Commercial Lawyers in Central London (emlaw.co.uk)