Cloud custody
AWS, Google Cloud or Microsoft Azure, with in-region localisation. Regions include India, the UK, the EU, the US, Singapore and the UAE, subject to service availability and your executed agreement.
[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract
[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract
PHYSICAL VAULT STORAGE
Physical Vault Storage and Secure Source Code Storage
Castler gives you secure source code storage for the software your business runs on. Your vendors' source code, build inputs and release history are held in encrypted custody, in the cloud region you choose or in a physical vault in India. Every release is captured and sealed.
100+ enterprise customersCloud custody in India, the UK, the EU, the US, Singapore and the UAEISO 27001, SOC 2 Type II, CERT-In and PCI DSS assured
New deposit
Vendor release
- CaptureNew release picked up from the repository
- Seal and inspectAES-256 encryption and SHA-256 integrity seal
- StoreHeld across regions, isolated by customer
- RetainVersion kept, tamper-evident and immutable
Cloud custody
In the region you choose
Physical vault
Offline custody in India
Audit trail
- Timestamp
- Commit hash
- Release identifier
- Depositor
- Source repository
Illustrative interface
Choose Where Your Critical Software Storage Lives
Physical vault storage
Offline custody in Delhi, Mumbai or Bangalore for India customers.
Both together
A physical vault can run alongside digital storage as a hybrid.
How Secure Source Code Storage Works
Capture
GitHub, GitLab, Bitbucket, Azure DevOps, private Git or SFTP connect to Castler, so every release is picked up automatically.
Seal and inspect
AES-256 encryption and a SHA-256 integrity seal are applied to each deposit.
Store
Deposits are held across regions and isolated by customer and beneficiary.
Retain
Every version is kept, tamper-evident and immutable.
What Protects Your Deposit
Secure source code storage at Castler rests on five controls:
Encrypted
In transit and at rest.
Isolated
Logically separated by customer.
Role-based access
Named parties get only the permissions your agreement gives them.
Audit trail
Every deposit records the timestamp, commit hash, release identifier, depositor and source repository.
Neutral custody
The vendor, the beneficiary and Castler operate under one executed agreement.
Inside the Physical Vault
Biometric access controls
24/7 surveillance
Environmental controls against fire and flood
Multi-location storage for redundancy
Offline storage, separate from online risks
What Goes Into Storage
Critical software storage covers more than source code:
Source code
Build inputs and scripts
Runtime configuration
Documentation
Deployment scripts
Release history
Release Conditions, Agreed Before You Need Them
Castler defines the trigger events in your agreement: insolvency, acquisition, discontinuation, support failure and other negotiated conditions. When one occurs, Castler manages the declaration, notification, evidence and controlled release.
Trigger events
- Insolvency
- Acquisition
- Discontinuation
- Support failure
- Other negotiated conditions
The tripartite agreement uses standard templates or custom clauses, with digital signing and deposit schedules managed in one record.
Built for Your Regulator
Source code or software escrow for critical applications
Source-code access or escrow for non-bank payment system operators
Escrow and continuity controls for critical third-party applications
Software escrow and source-code availability for critical insurance applications
EU DORA and UK PRA SS2/21
Exit planning and continuity evidence for critical vendors
Start at Vendor Onboarding
Put storage in place when the vendor contract is signed. Castler captures the first complete deposit before the application becomes a live dependency, then keeps it current through every release.
Go Beyond Storage
A current deposit is necessary, but it is not enough. Castler Software Recoverability rebuilds, deploys and replicates the application from the deposit you already hold, then a named engineer signs a Proof of Recovery. The vendor does not start again.
Storage only
"We have software escrow."
Storage plus recoverability
"We have a signed Proof of Recovery."
Pricing
Per application per year, with no setup fee:
Cloud Storage
$2,000
per application per year
With secure custody and a deposit report
Standard Verification
$3,500
per application per year
With build verification, SBOM and CBOM
Premium Recoverability
$7,500
per application per year
With independent rebuild, run and a signed Proof of Recovery
Bundles of up to 10 applications: $7,500, $15,000 and $45,000
Talk to us about the physical vault option.
FAQ
Frequently Asked Questions
Can we choose where our deposit is stored?+
Yes. Choose the cloud region in your agreement, or a physical vault in Delhi, Mumbai or Bangalore if you are an India customer.
Can we use cloud storage and a physical vault together?+
Yes. A physical vault can be used with digital storage as a hybrid.
How does the deposit stay current?+
Repository integrations capture every release automatically, so there is no manual re-filing.
Who can access the deposit?+
Only the named parties in your agreement, with the permissions it sets. The deposit is released only when a defined trigger occurs.
Is the physical vault available outside India?+
Castler lists physical vault storage for India customers. Cloud custody is available in the regions above.
PHYSICAL VAULT STORAGE
Put your critical software in secure custody from day one
Book a 15-min Demo. We will walk your software estate, name the regulation that applies to you and show you how every release is stored.
Book a 15-min DemoISO 27001SOC 2 Type IIPCI DSS