Source Code Escrow Agreement Template

In plain language: Identifies the licensor, licensee, and escrow agent by their full legal names, and formally appoints the escrow agent to act in that capacity under the terms of the agreement.

Common mistake: Naming a division or brand name instead of the registered legal entity. If the licensor is later acquired, the escrow obligation cannot be cleanly transferred to the successor without the correct legal name.

In plain language: Specifies exactly what the licensor must deposit — source code files, build scripts, compiler and toolchain versions, dependency manifests, and any documentation required to compile and operate the software from scratch.

Common mistake: Defining deposit materials as 'the source code' without listing build dependencies and toolchain versions. A deposit that cannot be compiled without undocumented libraries is worthless at release.

In plain language: Sets the deadline for the first deposit after agreement execution and requires the licensor to deposit updated materials within a defined number of days after each material software release.

Common mistake: Omitting update obligations entirely. A deposit made at signing becomes outdated within months — licensees relying on a two-year-old deposit may receive code that no longer matches the software in production.

In plain language: Defines the process by which the deposited materials are technically audited to confirm they are complete and compilable — either by the escrow agent, a named third-party auditor, or both parties jointly.

Common mistake: Skipping the verification clause or making it optional without specifying who pays. Unverified deposits are frequently found to be incomplete or uncommittable — discovered only at the worst possible moment.

In plain language: Lists the specific events that entitle the licensee to request release of the deposit materials from the escrow agent — typically insolvency, material breach of maintenance obligations, or cessation of operations.

Common mistake: Defining release conditions so narrowly — e.g., only upon formal bankruptcy filing — that the licensor can effectively wind down operations without triggering release. Include cessation of business and failure to maintain as independent triggers.

In plain language: Sets out the mechanics of how a release request is made, how the escrow agent notifies the licensor, the licensor's right to object within a defined window, and how disputes about whether a release condition has been met are resolved.

Common mistake: Giving the licensor an indefinite right to object without specifying a resolution mechanism. An unresolved objection can block release indefinitely, defeating the purpose of the escrow.

In plain language: Grants the licensee a limited, non-transferable license to use the released source code solely to maintain and support the licensed software for its own internal operations — not to sublicense, distribute, or create competing products.

Common mistake: Omitting the use restriction entirely. Without it, a licensee could theoretically use released source code to build and sell competing software — a result no licensor intends and courts may not fill by implication.

In plain language: Binds all three parties — licensor, licensee, and escrow agent — to keep the deposited source code confidential, with the escrow agent prohibited from accessing or disclosing the materials except as required to perform verification or release.

Common mistake: Applying confidentiality only to the licensee post-release and failing to bind the escrow agent. Escrow agents employ staff who handle deposits — without an explicit obligation, internal access is uncontrolled.

In plain language: Specifies who pays the escrow agent's setup, annual storage, and verification fees, and limits the escrow agent's liability to gross negligence or willful misconduct — protecting it from claims that arise solely from following the agreement's release procedures.

Common mistake: Failing to state explicitly who pays which fee. Disputes over fee responsibility cause agreements to lapse unpaid — escrow agents routinely terminate dormant escrow arrangements, destroying the protection both parties intended.

In plain language: Sets the initial term, auto-renewal mechanics, conditions under which any party may terminate, what happens to the deposit materials on termination, and the jurisdiction whose law governs the agreement.

Common mistake: Allowing the licensor to terminate the escrow unilaterally without notice to the licensee. A licensor in financial distress has every incentive to cancel escrow quietly — the agreement should require joint consent or advance notice to the licensee before termination takes effect.

A source code escrow agreement is a three-party contract among a software licensor, a licensee, and a neutral escrow agent. The licensor deposits its proprietary source code with the escrow agent, which holds it under strict confidentiality and releases it to the licensee only if a defined trigger event occurs — such as licensor insolvency or a material breach of maintenance obligations. It protects the licensee's ability to maintain and operate critical software even if the vendor is no longer able to support it.

Source code escrow is most important when the licensed software is mission-critical to the licensee's operations, when the licensor is a small or mid-sized vendor whose long-term viability is uncertain, or when the licensee has no practical alternative to the software and would face significant downtime or cost to replace it. Financial institutions, healthcare providers, and enterprise buyers routinely require escrow as a standard procurement condition for any third-party software running core operational systems.

The licensor is the software developer or vendor that owns and deposits the source code. The licensee is the business that has licensed the software and is the beneficiary of the escrow arrangement. The escrow agent is an independent third party — typically a specialist escrow provider or law firm — that receives, stores, and releases the deposit materials according to the terms of the agreement.

Common release triggers include the licensor filing for bankruptcy or entering receivership, the licensor ceasing its business operations, a material and uncured breach of the licensor's maintenance and support obligations, the licensor's acquisition by a competitor where the successor fails to assume the licensor's obligations, or persistent failure by the licensor to update the escrow deposit following material software releases. Well-drafted agreements list each trigger independently so that one can operate without requiring others to also be satisfied.

A technical verification is an audit of the deposited source code to confirm it is complete, accurate, and sufficient to compile and deploy the software without assistance from the licensor. Industry experience shows that a meaningful percentage of unverified deposits are incomplete or contain files that cannot be built — making them useless at the moment of a crisis. Requiring verification within 90 days of the initial deposit and annually thereafter is considered best practice.

The post-release use license is typically narrow: the licensee may use the source code solely to maintain and support the licensed software for its own internal operations. It generally cannot sublicense the code, distribute it, or use it to build competing products. Some agreements permit the licensee to engage a third-party developer to perform maintenance on its behalf, provided that developer is bound by equivalent confidentiality obligations.

SaaS products present unique escrow challenges because the licensee typically accesses the software via a hosted environment rather than a local installation. In these cases, source code escrow alone may be insufficient — the licensee also needs access to infrastructure configurations, deployment scripts, and database schemas to recreate the hosted environment. Specialist SaaS escrow arrangements, sometimes called technology escrow or continuity escrow, address these additional components alongside the source code.

A source code escrow agreement is generally enforceable in most jurisdictions when properly drafted and executed by all three parties before the underlying license takes effect. Enforceability is strongest when release conditions are specific and objectively verifiable, the escrow agent is a professional independent party, and the agreement is signed as part of the original licensing transaction rather than added retroactively. Consider consulting a lawyer for high-value or cross-border arrangements.

In most commercial arrangements, the licensee pays the escrow agent's annual storage and administration fees, since the licensee is the primary beneficiary of the escrow protection. However, when the escrow arrangement satisfies enterprise procurement requirements that enable the licensor to close a sale it would otherwise lose, the parties sometimes negotiate a fee split or the licensor absorbs the cost as a sales condition. Verification fees are typically paid by the requesting party.