A software escrow agreement is an arrangement in which an independent party holds the source code, build instructions and documentation of software in safekeeping, so you can keep using the software if the supplier disappears. Drafting the clause is step one. Monitoring the obligations around it is what makes the arrangement usable. If that does not happen, you have a false sense of security: a contract clause that fails at the moment you need it.
You have escrow in place. The clause sits neatly in the software contract: if the supplier goes bankrupt, you gain access to the source code. Security, you think. Until someone asks when that deposit was last updated. And then it goes quiet.
An escrow clause is not a continuity guarantee
The clause often sits in a contract from 2019. Since then the software has had four major updates. The deposit holds a version no one can run any more. The buyer who once arranged the escrow no longer works there. Nobody notices this, until the supplier goes bankrupt and you request the source code you can no longer compile.
That is the gap most organisations fall into. The legal sources cover how to draft the clause in great detail: release events, IP structure, alignment with the licence. Almost no one writes about what happens afterwards. And that is exactly where the risk lies. A software escrow agreement only works if the obligations around it have an owner, a deadline and a status.
What belongs in a usable deposit and why does it age?
A source code copy is not enough. To actually run the software, the deposit must be complete and current. In its points of attention for escrow, ICTRecht explicitly names the currency of the deposit and the alignment between escrow, licence and SLA.
A working deposit contains at least:
- The current source code, not a version three releases old
- Build and installation instructions that let a third party compile the software
- An overview of dependencies and third-party components
- Valid licence keys and certificates
- Technical documentation and configuration
Each of these components ages. A dependency that disappears from the market, a licence key that expires, a build instruction that lags behind the current version: one by one they render the deposit worthless at the moment of release. An old source code copy that no one can run is not continuity.
The obligations no one monitors
Escrow is not a one-off legal check but a set of recurring actions. These are the obligations that almost always evaporate after signing:
- The annual verification of the deposit by the escrow agent
- A source code update with every new release from the supplier
- A retest with every major version, so the build still holds
- A currency check of dependencies and licence keys
- Reconfirming the exit arrangements at every contract renewal
In a tender, escrow is often an award requirement. PIANOo explicitly advises an escrow arrangement for bespoke software, for cases such as bankruptcy, acquisition or failure to meet maintenance arrangements. But after the award, the follow-up disappears. The box is ticked, the obligation lives nowhere. It sits in a PDF on a network drive, with no reminder and no owner. That is precisely the difference between having a clause and getting a grip on the continuity risk.
SaaS escrow: source code alone is not enough
Most IT contracts today are cloud or SaaS. And that is where it gets more complex. “We have source code escrow” means little if the software runs in the supplier’s cloud and you have no way to run it yourself.
With SaaS escrow you arrange, alongside the source code, the deployment procedure, the configuration, a data export in a usable format and exit assistance from the supplier. Without those components, a bankruptcy leaves you with the code but no running service and no access to your own data. Anyone who signs a SaaS contract and thinks they are covered by classic source code escrow is on the wrong track. For cloud software, first secure the data export and exit assistance, then the source code.
The Cybersecurity Act makes monitoring demonstrable
The Dutch Cybersecurity Act (Cbw), the national implementation of NIS2, comes into force on 15 August 2026, without a general transition period. The act applies directly to roughly 8,000 to 10,000 organisations and requires demonstrable control of cyber risks from the supplier chain (source: Staatsblad 2026, 189).
Escrow is exactly such a measure to control continuity risks from the chain. But the core of the Cbw is demonstrability. An escrow clause without monitoring proves the opposite of control: you have identified a risk and then done nothing about it. You cannot show that the deposit is current, who the owner is or when the last verification took place.
GRIP does not make any organisation Cbw-compliant and is not a cybersecurity or compliance tool. GRIP gives you a grip on the contract side of that duty of care: which suppliers you have, which continuity requirements sit in the outsourced contracts and which arrangements are still open. GRIP operates under ISO 27001, with data processing within Europe. Read how NIS2 and contract management connect.
Recording escrow as a monitored action
GRIP is contract management software for supplier contracts of Dutch organisations in healthcare, education and the public sector. The solution does not start with a stricter clause, but with turning that clause into monitored actions with an owner, a deadline and a status.
The difference between contract administration and contract management captures exactly this distinction. Your ERP records that you have an escrow clause. In the GRIP Contract Dashboard you link to that clause the annual deposit verification as a recurring action, the source code update per release, the retest at major versions and the exit check at renewal. Every action has a responsible owner and a deadline. If a supplier goes bankrupt, you have an objective release event and a deposit you know is correct.
Frequently asked questions
What is a software escrow agreement?
A software escrow agreement arranges for an independent party to hold the source code, build instructions and documentation of software in safekeeping. If the supplier disappears, for example through bankruptcy, you gain access to the deposit so you can keep using or maintaining the software.
When is software escrow mandatory?
Escrow is rarely a legal requirement, but PIANOo explicitly advises it for bespoke software in tenders. In practice it is often included as an award requirement for business-critical software whose continuity is essential.
Why is an escrow clause without monitoring a risk?
A deposit ages. After several releases it holds a version no one can run any more, with expired licence keys or missing dependencies. Without annual verification and updates you have a false sense of security: the clause fails at exactly the moment you need it.
What is the difference between software escrow and SaaS escrow?
With classic escrow you store source code and documentation. With SaaS escrow you also need the deployment procedure, configuration, data export and exit assistance. The software, after all, runs in the supplier’s cloud, so source code alone does not give you a running service.
Which release events belong in an escrow arrangement?
Objective and verifiable events: bankruptcy or suspension of payments by the supplier, the ceasing of maintenance, or failure to fix critical faults within an agreed period. Objective events prevent disputes about when you gain access to the deposit.
How does the Cybersecurity Act help demonstrate continuity?
The Cbw (in force 15 August 2026) requires demonstrable control of continuity risks from the supplier chain. A monitored escrow arrangement with a current deposit and a documented owner supports that demonstrability. An unmonitored clause does the opposite.
How do you record escrow obligations as a monitored action?
Put the recurring obligations, such as annual verification, source code update per release and exit check at renewal, in a contract dashboard with owner, deadline and status. That way escrow becomes a trackable arrangement instead of a forgotten clause in a PDF.
Want to know when your escrow deposit was last verified? See how GRIP solves this or book a demo of the Contract Dashboard.