SOURCE CODE ESCROW
Storing source code with a third party satisfies the letter of the law. Castler goes further: AI agents rebuild your vendor's codebase in a clean environment, without vendor involvement, and produce a signed Proof of Recovery for every verified release.
ISO 27001 · SOC 2 Type II · CERT-In · PCI DSS · RBI aligned
WHAT IT IS
Source code escrow is a legal and operational arrangement in which a software vendor deposits the source code of a critical application, together with build instructions, configuration files, and dependencies, with an independent third party. The deposit is released to the beneficiary if predefined conditions such as insolvency, discontinued support, or product abandonment are met.
The purpose is continuity. If the vendor can no longer support the software, the beneficiary must be able to maintain, rebuild, and operate the system independently.
Traditional escrow rarely proves that outcome. A stored deposit may be incomplete, stale, or dependent on infrastructure the beneficiary cannot access. Until the software is independently rebuilt and run outside the vendor environment, the agreement is a legal instrument, not a recovery plan.
THE PROBLEM
The standard model stores a code archive. Nobody rebuilds it, confirms that it compiles, checks the dependencies, or verifies that the resulting binary matches the production system. The first real test often happens on the day recovery is required.
Software changes continuously. An annual filing cycle can leave the deposited release many months behind production, disconnected from current infrastructure, APIs, and data formats.
A signed agreement, deposit acknowledgement, or assessment PDF does not demonstrate that the software runs. Regulators and boards need current, examinable recovery evidence.
THE CASTLER APPROACH
Castler replaces the document-centric model with a verification-centric one. Every deposit triggers an agentic verification pipeline, and the output is a signed evidence pack proving the software rebuilt, ran, and replicated outside the vendor environment.
The vendor deposits code, configuration, build scripts, infrastructure-as-code, and dependency manifests through an encrypted, version-controlled intake pipeline.
AI agents rebuild and deploy the deposit in a clean environment with no connection to the vendor's systems.
A named Castler engineer reviews the evidence and signs the result.
The signed evidence pack is linked to the exact release tested and refreshed when a new release is verified.
THE CASTLER APPROACH
A named engineer reviews the build logs, deployment trace, replication evidence, and SBOM. The beneficiary receives a signed Build Report, Deployment Runbook, Replication Report, SBOM, Confidence Score, Engineer’s Seal, and Public Verification Record.
Full application source code
Build and compilation scripts
Infrastructure-as-code
Dependency manifests and lockfiles
Database schema and migration scripts
Environment configuration files
Deployment runbooks
Third-party licence inventory
Castler agents work in a clean, isolated cloud environment. They parse the build manifest, resolve dependencies, execute the build, deploy the result, and replicate the declared architecture without relying on vendor infrastructure.
A named engineer reviews the build logs, deployment trace, replication evidence, and SBOM. The beneficiary receives a signed Build Report, Deployment Runbook, Replication Report, SBOM, Confidence Score, Engineer’s Seal, and Public Verification Record.
AGREEMENT SCOPE
Source code
Build scripts
Infrastructure-as-code
Dependency manifests
Database schema
Environment configuration
Operational runbooks
Licence inventory
Independent clean build
Dependency resolution check
Deployment and replication test
SBOM per release
Confidence Score
Signed Build Report
Executable Deployment Runbook
Named engineer seal
REGULATORY MANDATE
RBI IT Directions 2023 §12(f)
Banks, NBFCs, and AIFIs must maintain an exit strategy for outsourced IT services, including source-code access for critical applications.
Evidence mapRBI PSO Directions 2024 §17(c)
Non-bank payment system operators must escrow source code for critical payment technology.
Evidence mapSEBI CSCRF
Market institutions and qualified regulated entities must protect continuity for critical third-party applications.
Evidence mapIRDAI Cyber Security Guidelines 2023
Insurers must ensure source-code availability through escrow arrangements.
Evidence mapEU DORA
Critical ICT contracts must address access, verification, exit, and recovery rights.
Evidence mapUK PRA SS2/21
Material outsourcing arrangements require documented exit plans and continuity evidence.
Evidence mapCASTLER VS TRADITIONAL ESCROW
| Comparison | Traditional Source Code Escrow | Castler Source Code Escrow |
|---|---|---|
| Deposit scope | Source code archive | Source, IaC, configuration, and runbooks |
| Verification | None or manual review | Agentic rebuild and replication |
| Frequency | One-off or annual | Every release |
| Time to evidence | 14 to 28 days | 6 to 18 hours |
| Output | Agreement and archive | Signed Proof of Recovery |
| SBOM | Not included | Included per release |
| Named engineer | No | Yes, every proof |
| Public verification URL | No | Yes |
FREQUENTLY ASKED
Common triggers include vendor insolvency, acquisition followed by discontinued support, product abandonment, material service breach after a cure period, and regulatory access requirements. The agreement can be extended for sector-specific conditions.
The initial deposit must contain the agreed materials. The verification itself is designed to run without vendor involvement or access to the vendor environment.
Repository and CI/CD integrations can trigger a new deposit and verification cycle on each production release. The beneficiary can see the current verified version and any divergence from production.
The failure is reported immediately with the exact build or deployment stage, severity, logs, and remediation required. Discovering the gap before an incident gives the institution time to act.
GET STARTED
A 15-minute briefing. We walk you through your Software Estate, identify which vendors require source code escrow, and show you a live signed Proof of Recovery.
Book a 15-min briefing