Source code escrow means a neutral third party holds a copy of a vendor's source code and releases it to you if agreed events happen, such as the vendor going insolvent. If an agency is building your product, you probably don't need it. You need the repository in your own account and a signed IP assignment. Escrow is for the opposite case, where someone else owns code you depend on.
What source code escrow is, and the problem it was built for
Wikipedia's entry on source code escrow describes an arrangement with at least three parties: the licensor, the licensee and the escrow agent. The licensor deposits the source. The agent keeps it. The licensee can get it only when a release condition is met.
Most providers' pages assume the same setup. A vendor owns a piece of software, you license it, and you're worried about what happens to your business if the vendor disappears. Escrow gives you a fallback copy of code you never owned.
That's a different problem from the one a founder has when an agency writes a custom product for them. In that case the code is supposed to be yours from the first commit, and a fallback copy held by a stranger is a weak substitute for simply having it.
Escrow also isn't airtight. Wikipedia notes that bankruptcy laws may interfere with executing an escrow agreement, and insolvency is one of the standard release triggers.
What source code escrow costs
Two providers publish list prices: EscrowTech and Codekeeper. Both are below, as listed on each provider's own page in October 2026, in US dollars. Escrow London's page offers a quote form, and Escode's page points you to sales or a quote form.
EscrowTech lists a one-time setup fee of $995 and an annual fee of $1,595 for a single beneficiary, locked for three years. Multi-beneficiary plans start from $1,390. A release is chargeable, but the page gives no amount.
Codekeeper prices its on-premises plans by the month. The single-beneficiary plan is $139 a month on annual billing or $179 billed monthly. The multi-beneficiary plan is $259 a month on annual billing or $309 monthly. Setup is $249, and release processing is $199 an hour.
On those list prices, the first year of a single-beneficiary deposit comes to $1,917 at Codekeeper (setup plus twelve months at the annual-billing rate) and $2,590 at EscrowTech (setup plus the annual fee). That's our arithmetic from the published figures, not a quote from either company.
The base fee isn't the variable part. Verification is, and it's covered below.
What triggers a release, and what you get
A release happens when a condition in the agreement is met, and the conditions differ by provider and by contract.
Escrow London lists bankruptcy, administration, discontinuing support, and failure to support combined with an uncured material breach within 10 days of notice. It says the conditions may be amended, so the standard list is a starting point for negotiation, not a fixed menu.
Escode's triggers are supplier insolvency or administration, failure to support or maintain the software, material breach, and end-of-life with no viable alternative.
Now the limit. Escode states it plainly: release provides the right to use the materials, not instant continuity. You get files. You don't get the people who understood them, the knowledge of why the build works, or a running system. If nobody on your side can build and operate the software from a deposit, a release is the start of a project, not the end of a problem.
Verification: why a deposit nobody built is not insurance
A deposit that doesn't compile is a folder of text. Verification is how you find out before the day you need it.
Escode describes what a useful deposit looks like in four words: complete, current, buildable, and aligned to the live production environment. In our view, the gaps sit between those four: a deposit made once while the code moves on, build scripts missing, a production configuration that never made it in. That's judgment, not a provider statistic.
The Escrow Company says verification confirms the deposit can be built. That's the part that turns escrow from a paper comfort into a working fallback.
Verification is also where the price climbs. EscrowTech includes a standard inspection and sells five levels on top. Level 1, a file listing, starts from $295. Level 2 is deposit analysis, level 3 is build verification, level 4 is binary comparison and level 5 is test plan verification, and those are quoted individually. Codekeeper includes fundamental verification free and sells higher tiers as add-ons.
If you do buy escrow, the build verification level is the one that matters, and it's the one with no published price.
If you pay for the build, the code is already yours to hold
Escrow answers "what if the vendor fails and I can't get my code." For a bespoke build, you can remove the question by not letting the code sit anywhere but your own account.
Concretely: the agency works in a repository inside your GitHub or GitLab organisation from day one, you hold the admin role, and the contract assigns the IP to you as it's created. We cover the assignment mechanics in who owns contractor code in the EU.
Even the escrow industry recognises this. The Escrow Company sells a variant for bespoke work it calls a data holding agreement, used "when a company is using a developer to create a bespoke application." The client owns the code, and the developer's repository is deposited daily. Its deposits can be automated from GitHub, Bitbucket, GitLab and Azure DevOps over SFTP or S3. That's a reasonable product if you can't get repo access, but if you already hold the repo, you've got the thing it's selling.
| Situation | What escrow adds | What your own repo plus assignment covers |
|---|---|---|
| Agency builds a bespoke product | Little. A second copy of code you should already hold | Everything: you hold the code and the rights from day one |
| Vendor-owned platform you license | The main case. A path to the source if the vendor fails | Nothing. You don't own it |
| Proprietary agency components or frameworks inside your product | A fallback for the parts the agency keeps; the alternative is a perpetual license | Covers the code written for you, if the assignment is valid and signed |
| SaaS dependency | SaaS escrow, aimed at continuity of a vendor-hosted service | Nothing, unless your contract says otherwise |
| Repo inherited from a previous agency | Escrow rarely helps retroactively; what protects you is whatever documents already exist | Whatever your documents prove; see taking over a failed agency's codebase |
The proprietary-component row is the one founders miss. An agency can ship you a product built on its own internal framework and assign you only the glue code. Ask what's in the repo that the agency owns, and get a license for it in writing. If that license is the weak point, escrow on that component is a sensible use of money.
For wider contract terms around the build, see software development agreement clauses. The legal side of working with developers across the EU is laid out in Hiring developers in Europe: legal requirements for 2026. None of this is legal advice for your jurisdiction.
The decision checklist
Work through these in order. Price escrow only when you reach the end.
- Who holds the admin role on the repository? If it's the agency, fix that first.
- Who owns the cloud accounts and domains? A repo you own is little use if production runs in an account you can't log into.
- Is the IP assignment signed and dated, and does it cover code as it's written?
- Are any components excluded or licensed rather than assigned?
- Does anyone besides the vendor know how to build and run it? If not, you have a continuity problem that no deposit solves.
- Only then: is there vendor-owned code you can't do without? That's what escrow is for.
What this means for your build-versus-protect decision
If an agency or contractor is building your product, spend the money on three things before any annual escrow fee: repository ownership, a signed IP assignment, and a build-from-scratch test where someone outside the agency clones the repo and stands up the system. That's our judgment, not a rule, but the published escrow terms back it up. Release gives you rights to files, not continuity, and verification at the level that proves a build is the part providers don't price publicly.
Buy escrow for vendor-owned code you depend on and can't replace: a licensed platform, a proprietary component, a SaaS product your operations run on. For those, ask for build verification in writing and a release trigger that covers support failure, not just insolvency.
The wider set of contracts that sit around this decision is in the EU contracting and GDPR hub. Start there if you're reviewing agency terms this quarter.
FAQ
What does source code in escrow mean?
A third party holds a copy of the source code, and you can get it only if a release event in the agreement happens. Wikipedia describes at least three parties: the licensor, the licensee and the escrow agent. It's a safeguard for software owned by someone else, not a way to own it.
How much does source code escrow cost?
As listed on each provider's page in October 2026, EscrowTech charges a $995 setup fee and $1,595 a year for one beneficiary. Codekeeper's on-premises single plan is $139 a month on annual billing with a $249 setup fee. Escrow London's page offers a quote form, and Escode's points to sales or a quote form. Verification and release processing cost extra.
How do I get the source code from escrow?
You claim a release when a trigger in the agreement is met, such as insolvency, administration, or failure to support the software after notice. Escrow London says an uncured material breach counts after 10 days from notice, and says a disputed release may be moved to arbitration. A release gives you the right to use the materials, and as Escode notes, not instant continuity.
Do I need escrow if the agency builds my product?
Usually not as the primary protection. If the code lives in your own repository and the IP is assigned to you when it's written, you already hold what escrow would deposit. Escrow makes sense for code you don't own, such as an agency's proprietary framework or a vendor platform you license.