SOFTWARE RECOVERABILITY
Castler independently rebuilds, deploys, and runs your vendor’s software in a clean environment—then a named engineer signs the evidence. Every verified release becomes a current, examinable Proof of Recovery for your board, regulator, insurer, and recovery team.
Coverage can include source code, SaaS, AI models, data, and IP.
LIVE RECOVERY RUN
STREAMINGcore-banking-platform · v9.4
java/spring · postgres · kubernetes
WHAT IS SOFTWARE RECOVERABILITY
Software recoverability is the independently verified ability to rebuild, deploy and operate a vendor's software application without the vendor's involvement. It is distinct from software escrow, which stores code, and from backup, which copies data. Recoverability requires an independent rebuild in a clean environment, a successful deployment, and a signed engineer's confirmation that the system runs. Castler SRP is the only platform that produces this evidence as a standardised, signed artefact.
THE PROBLEM THIS SOLVES
An escrow agreement says that if a trigger event occurs — vendor insolvency, acquisition, or discontinuation — the source code will be released and you will be able to get the software running again.
It does not say the code is complete. It does not say the build environment is documented. It does not say a single person alive knows how to deploy it. It does not say the deposit has been updated since the original filing. It does not say the code has ever compiled in any environment other than the vendor’s own.
The gap between an agreement and a working recovery has historically been measured in months. For complex enterprise applications, that gap is often permanent — not because the will to recover is absent, but because the knowledge required to do it has never been captured.
Castler closes that gap. Not with better contract language. With a repeatable, tested, signed recovery procedure that runs on every release and produces examinable evidence every time. It begins at vendor onboarding, when the first deposit, custody workflow, and verification schedule are established — not as a regulatory retrofit years later.
FAILURE-MODE COVERAGE
Distinct glyphs preserve meaning without relying on colour alone.
Deposit is corrupt, encrypted without keys, or unreadable
Cloud Storage · Partially detectedStandard Verification · Detected before you need itPremium Recoverability · Detected before you need itRepository incomplete, source files or modules missing
Cloud Storage · Partially detectedStandard Verification · Detected before you need itPremium Recoverability · Detected before you need itDependencies undeclared or held in private vendor repositories
Cloud Storage · Discovered during outageStandard Verification · Detected before you need itPremium Recoverability · Detected before you need itSource code does not compile, no usable build can be produced
Cloud Storage · Discovered during outageStandard Verification · Detected before you need itPremium Recoverability · Detected before you need itBuild instructions absent, incomplete or incorrect
Cloud Storage · Discovered during outageStandard Verification · Detected before you need itPremium Recoverability · Detected before you need itUndisclosed third-party or open-source licence exposure
Cloud Storage · Discovered during outageStandard Verification · Detected before you need itPremium Recoverability · Detected before you need itBEFORE AND AFTER
WHAT CASTLER PRODUCES
The Proof of Recovery is a signed record for the exact vendor release Castler tested. Explore the supporting build, deployment and replication evidence, plus the engineer's seal.
Castler · Certificate of Recoverability
Aurora Core · Release 24.11.3
A. Mehta, Verification Engineer
castler.io/verify/POR-2026-04821
HOW IT WORKS
Castler captures the release, rebuilds it without the vendor, replicates the declared environment and has a named engineer review the result.
TECHNICAL COVERAGE
Castler verifies the software your organisation depends on across languages, repository structures, cloud targets, and orchestration systems. Complex or proprietary toolchains are assessed during deposit mapping so scope, dependencies, and exceptions are known before recovery is ever required.
Java, Kotlin, Python, Go, Node.js, TypeScript, .NET, C#, Ruby, PHP, Rust, and Scala. Framework support includes Spring, Django, FastAPI, Express, Next.js, .NET Core, and Rails. Custom build toolchains are assessed during deposit mapping.
Mono-repo, multi-repo, submodule trees, private registries, and Git. Binary and compiled-only deposits are assessed separately, with exceptions and evidence requirements made explicit before verification begins.
AWS, Google Cloud Platform, and Microsoft Azure. Other cloud targets are assessed case by case against the architecture declared by the vendor and the target environment selected by the beneficiary.
Docker and OCI-compliant images, Kubernetes across EKS, GKE, AKS and on-premises clusters, Helm charts, and Terraform.
Hours
Per verification
~90%
Lower verification cost
100%
Critical-Software Estate coverage
Per release
Evidence stays current
PRICING TIERS
All tiers use the same secure cloud-custody foundation. They differ in verification depth and how far the Proof of Recovery cycle goes from build evidence to architecture mirror testing.
Tier 1
$1,000 / application / year
Secure, versioned, access-controlled custody of source code, build inputs, and runtime configuration. Every release is captured automatically with a full audit trail and encryption in transit and at rest.
WHAT YOU PRODUCE
A current, versioned deposit — the foundation for verification.
BEST FOR
Organisations beginning a recoverability programme, or vendors meeting customer escrow requirements.
Tier 2
$2,500 / application / year
Everything in Cloud Storage, plus agentic build verification, SBOM generation, dependency-resolution reporting, a build confidence score, and an Engineer’s Seal on every verified release.
WHAT YOU PRODUCE
A signed Proof of Recovery covering build completeness and SBOM accuracy.
BEST FOR
Institutions meeting baseline RBI, SEBI, IRDAI, DORA, or customer assurance requirements.
Tier 3
$5,000 / application / year
Everything in Standard Verification, plus deployment-runbook authoring, replication on Castler cloud, mirror testing against the declared production architecture, and the highest-confidence engineer seal.
WHAT YOU PRODUCE
A complete Proof of Recovery: build, deploy, replicate, and mirror — signed and numbered.
BEST FOR
Board-level mandates, insurer underwriting evidence, and deep-verification requirements.
Volume ladder: Essential, Silver, Gold, and Platinum coverage levels are available within each product tier for multi-vendor estates.
See full pricing →Book a Demo to discuss which tier fits your Software Estate →WHO THIS IS FOR
CIO or CISO accountable for vendor risk and operational resilience
Head of IT Risk or Third-Party Risk Management
Compliance teams responding to RBI, SEBI, IRDAI, DORA, or FCA requirements
Boards and risk committees requiring current recovery evidence
ISVs and SaaS companies contractually required to establish escrow
Technology companies using recoverability as an enterprise trust signal
Vendors managing multiple customer escrow obligations through one platform
REGULATION MAPPING
Every artefact in the Proof of Recovery pack is designed around a named operational obligation. The mapping below shows which evidence supports each requirement; individual regulation pages explain the official text, scope, status, and compliance timeline.
| Regulation | Article / section | Castler artefact |
|---|---|---|
| RBI IT Directions | §12(f) | Deposit + Build Report + Engineer’s Seal |
| RBI PSO Directions | §17(c) | Deposit + Build Report + Engineer’s Seal |
| SEBI CSCRF | Vendor continuity clause | Full Proof of Recovery pack |
| IRDAI CS Guidelines 2023 | Software escrow clause | Deposit + Build Report |
| EU DORA | Articles 9(2) and 28 | Full Proof of Recovery + Replication Report |
| UK PRA SS2/21 | Operational resilience evidence | Proof of Recovery + Deployment Runbook |
| MAS TRM | Technology risk management | Full Proof of Recovery pack |
| APRA CPS 230 | Operational risk and service providers | Full Proof of Recovery pack |
SOFTWARE RECOVERABILITY
The Proof of Recovery exists before the incident, not after it. Book a 15-min Demo to see how Castler maps to your Software Estate and regulatory obligations.
Book a 15-min Demo