CATEGORY COMPARISON
Four approaches, and how far each one actually goes.
ESCROW VS RECOVERABILITY
Software escrow is a legal arrangement under which source code is deposited with an independent third party. Software recoverability is the independently verified proof that the deposited code can be rebuilt and operated without the vendor. Escrow is the container. Recoverability is the test that proves the container holds what it claims. Most escrow arrangements have never been tested. Castler SRP tests every deposit and seals the result as a signed Proof of Recovery.
THE COMPARISON MATRIX
What is stored
Source and named documents
Is the code ever compiled
No
Is it ever deployed
No
Is the production architecture replicated
No
Who tests it
Nobody
Is there a signed artefact
Deposit receipt
How often is it refreshed
Contract dependent
Typical coverage of the Software Estate
Selected contracts
Who bears discovery work at release
Your incident team
What your auditor receives
Agreement and deposit record
What is stored
Source with arrival record
Is the code ever compiled
No
Is it ever deployed
No
Is the production architecture replicated
No
Who tests it
Custodian checks arrival
Is there a signed artefact
Integrity report
How often is it refreshed
Contract dependent
Typical coverage of the Software Estate
Selected contracts
Who bears discovery work at release
Your incident team
What your auditor receives
Integrity record
What is stored
Source, dependencies and build inputs
Is the code ever compiled
Yes
Is it ever deployed
No
Is the production architecture replicated
No
Who tests it
Build specialist
Is there a signed artefact
Build report
How often is it refreshed
Scheduled engagement
Typical coverage of the Software Estate
One or two codebases
Who bears discovery work at release
Your incident team after build
What your auditor receives
Build evidence
What is stored
Full deposit, recovery inputs and release evidence
Is the code ever compiled
Yes, independently
Is it ever deployed
Yes
Is the production architecture replicated
Yes
Who tests it
Castler agents and a named engineer
Is there a signed artefact
Signed Proof of Recovery
How often is it refreshed
Per verified release
Typical coverage of the Software Estate
Critical-Software Estate programme
Who bears discovery work at release
Procedure already documented
What your auditor receives
Build, deploy, replication and signed evidence
DEPTH OF TESTING
Each arc reaches further into the real recovery problem. Only the outermost operating standard proves the application can be rebuilt and run without the vendor.
THE HONEST CONCESSION
A simple deposit can be proportionate when the operational consequence is genuinely limited.
A non-critical application
A low impact tolerance
An internal tool with no regulatory exposure
A vendor you could replace off the shelf within days
The right control should match the criticality of the application. Recoverability earns its cost where vendor loss would interrupt an important service, breach a regulatory expectation, or force an emergency engineering programme.