Software (Source Code) Escrow Recommendations

[48k]

Does anyone have any recommendations for a third-party software source code escrow service? Preferably one that integrates with Azure Devops (so for example anyone used/can recommend one of the Azure MarketPlace offerings?).

[andyb28]

We were in a similar situation a few years ago.

Obviously we own everything we create, but we have one customer that it was agreed from the outset that its their code.
We couldn't find anything that worked for either side. So we just setup a script to dump their code from our repository weekly onto a server in their office.

This everyone seems happy with. However, this is an ongoing long term relationship. It might be different if its a create and hand off type setup with payment pending.

[48k]

andyb28 said:

We were in a similar situation a few years ago.

Obviously we own everything we create, but we have one customer that it was agreed from the outset that its their code.
We couldn't find anything that worked for either side. So we just setup a script to dump their code from our repository weekly onto a server in their office.

This everyone seems happy with. However, this is an ongoing long term relationship. It might be different if its a create and hand off type setup with payment pending.

Interesting, thanks.

It's a situation where a prospective customer wants a bespoke system, we have an application framework that has been developed over a number of years and is used as the basis of what we do, so we can't give them the IP but I'm thinking that an Escrow might satisfy them.

I've actually just got off a video conf with CodeKeeper which seems to be a decent solution and can integrate with our Azure Devops pipeline for a very reasonable monthly fee so hoping that could be an option, was just wondering if anyone had any real world experience.

[ATG]

Is the idea that some trigger event, e.g. you going bust or removing support for your proprietary framework, releases your proprietary source code to the customer so they can still use the bespoke app whose code they already own?

[48k]

They wouldn't own any code or IP from the outset. They'd be using the application (TBC whether we would host it or they would host it on prem). Then on some trigger event all of the source code would be released to them.

[Chris Type R]

We used this lot ( https://www.escrowlondon.co.uk/ ) in a very superficial way. We have software versions and deposit the code with them after each release.

They seem to have reorganised themselves as a company, and seem to be US based. We've not really experienced any issues - but have never had call to 'pull' the deposits.

[ATG]

48k said:

They wouldn't own any code or IP from the outset. They'd be using the application (TBC whether we would host it or they would host it on prem). Then on some trigger event all of the source code would be released to them.

I guess the utility boils down to who gets to decide if an event has occurred and how disputes are resolved. E.g. you're going bust, they decide not to pay a license renewal that's due, they say "you're bust; handover the code". Your receivers say "Pisces off. You've failed to pay your subs. All bets sre off. Make us an offer and we might let you have the code." What does the escrow firm do?

[48k]

ATG said:

48k said:

They wouldn't own any code or IP from the outset. They'd be using the application (TBC whether we would host it or they would host it on prem). Then on some trigger event all of the source code would be released to them.

I guess the utility boils down to who gets to decide if an event has occurred and how disputes are resolved. E.g. you're going bust, they decide not to pay a license renewal that's due, they say "you're bust; handover the code". Your receivers say "Pisces off. You've failed to pay your subs. All bets sre off. Make us an offer and we might let you have the code." What does the escrow firm do?

Yes that's something I discussed on the call earlier. Ultimately the escrow companies' legal team are the arbiter. They have a list of standard trigger events that can be included in a contract plus its possible to define custom ones. They're sending me all the bumph.

[Chris Type R]

With our systems, the source code would be of limited use - should there be a relationship breakdown / developers all hit by the same bus. There's a lot of knowledge (both technical and business) which is needed prior to being able to make use of source in any meaningful way. Escrow is almost a box ticking exercise for auditors/risk assessment.

[andyb28]

Chris Type R said:

With our systems, the source code would be of limited use - should there be a relationship breakdown / developers all hit by the same bus. There's a lot of knowledge (both technical and business) which is needed prior to being able to make use of source in any meaningful way. Escrow is almost a box ticking exercise for auditors/risk assessment.

Exactly this, the system I mentioned earlier where we download the code to the clients server. It's 10+ years of ongoing development. It's become a big and complex system. When we recruit a new dev, it takes them a good 6 months with our help to be able to work on it.

Additionally, we have some of our own libraries included in the system, but they do not get the code for those. Just the compiled versions.
We also have a library which reports back with computer / ip information to a webservice we host that shows when it was compiled and by who / what ip etc.