What is a source code escrow agreement?
Customers who rely on a vendor's software for critical work often ask what happens if the vendor goes out of business or stops supporting the product. A source code escrow answers that: the vendor deposits its source code with an independent escrow agent, who releases it to the customer only if a defined release event happens.
This three-party template sets out what the deposit contains, with a sensible default covering code, build instructions, schemas, configuration, third-party components and documentation, how it's deposited and how often it's updated. It covers secure holding by the agent, a basic check or full build test, and release events including insolvency, end of support after notice, failure to keep the deposit updated, and any you add. It sets a release procedure with a window for the vendor to object, the limited licence the customer gets on release, the agent's annual fee and who pays, the agent's limited role and liability, and what happens at the end.
- Best for
- Software and SaaS vendors with enterprise or public-sector customers
- Signed by
- The vendor, the customer and the escrow agent
- Release events
- Insolvency, end of support, failure to deposit, and your own
- Length
- About 3 pages, initialled on every page
When to use a source code escrow agreement
- A startup winning its first enterprise customer, who asks for escrow
- A bespoke software house protecting a client's investment in custom code
- A SaaS vendor depositing a mirrored repository for a bank customer
- A public-sector procurement that requires escrow for critical systems
- Replacing an informal arrangement with a lawyer holding a USB drive
What you fill in
22 blanks, then the name and email of each person who signs: vendor, customer, escrow agent.
1 The parties
- Effective date*
- Vendor (company)*
- Vendor address
- Customer (company)*
- Customer address
- Escrow agent*
- Escrow agent address
2 The software
- Software covered*
- Customer's licence or subscription agreement*
3 The deposit
- What the deposit contains*
- How the deposit is made* secure upload to the Escrow Agent's system · read-only access to a mirrored code repository · encrypted physical media delivered to the Escrow Agent
- First deposit within (days)*
- Updates* within 30 days after each major release, and at least every six months · every quarter · every month · continuously, through the mirrored repository
4 Release events
- End of support counts if not fixed within (days)*
- Other release event (optional)
- Days the Vendor has to object to a release claim*
5 Verification and fees
- Verification* a basic check of each deposit, with a full build test on the Customer's request · a full build test once a year · a basic check of each deposit only
- Currency*
- Escrow agent's annual fee*
- Annual fee paid by* the Customer · the Vendor · the Vendor and the Customer in equal shares
- Full build test fees paid by* the party that asks for it · the Customer · the Vendor
- Governing law*
6 Who signs
- Vendor signature and date, job title, initials on every page · The software owner who deposits the source code.
- Customer signature and date, job title, initials on every page · The licensee who benefits if a release event happens.
- Escrow agent signature and date, job title, initials on every page · The independent escrow provider, lawyer or trusted third party who holds the deposit. Many escrow agents use their own standard contract; check whether they accept this one.
What the source code escrow agreement covers
- The deposit
- Holding the deposit
- Verification
- Release events
- Release procedure
- Licence on release
- Fees
- The Escrow Agent's role
- Term, disputes and general
Using the source code escrow agreement, step by step
1 Name the three parties and the software
Enter the vendor, customer and escrow agent, the software covered and the licence or subscription agreement it's used under.
2 Define the deposit
Edit the default contents, choose how deposits are made, and set the first deposit deadline and how often updates follow.
3 Set release events and procedure
Choose how long the vendor has to resume support after notice, add any other release event, and set the vendor's objection window.
4 Choose verification and fees, then send
Pick a verification level, enter the agent's annual fee and who pays, choose who pays for build tests, and send to all three signers.
Tips before you send it
- Ask the escrow agent first. Many professional escrow providers have their own standard agreement and may prefer it.
- A deposit without build instructions is often useless. Include everything a capable developer would need to build and run it.
- For SaaS, consider depositing deployment scripts and infrastructure configuration, not just the application code.
- Insolvency law can affect whether a release is effective. Take local advice if this protection is important.
Sign it online in minutes
- Fill in the blanks. Names, dates and amounts go straight into the agreement — the preview shows exactly where.
- Name who signs. Tick “This is me” for your own part. FileIt builds the PDF with every signature, date and initials box on the right line, and you can check or move anything before sending.
- Send it. Each signer gets a secure link and signs from any device — no account needed. The signed PDF, with an audit trail and a Certificate of Completion, is filed in your vault and emailed to everyone.
Source code escrow agreement: frequently asked questions
What can the customer do with the code after release?
Use, copy and modify it, itself or through contractors bound by confidentiality, only to support, maintain and keep using the software as its licence allows. It can't sell or distribute the code or build a competing product, and it keeps the code confidential.
What if the vendor disagrees that a release event has happened?
The vendor has the number of days you set to object in writing. If it does, the agent keeps the deposit until the vendor and customer give joint instructions or a court or arbitrator decides.
Does the escrow agent check the code?
It confirms what it received. A basic check confirms the deposit can be read, is free of known malware and appears complete; a full build test checks the software can actually be built. You choose the level.
Who pays for escrow?
You choose: the customer, the vendor, or both equally. If fees go unpaid after a reminder, either other party may pay them to keep the escrow running.
Is this the same as a money escrow agreement?
No. For a neutral party holding money until conditions are met, use the escrow agreement template.