As a procurement or contract manager, sooner or later you hit the question: which escrow fits what we need? The answer isn’t always obvious, because most providers hand you a form or a lead magnet rather than the substance you need to align internally with your legal, IT, and procurement teams.

This page gives you exactly that. We’ve pulled together the available templates and Escrow4all’s sample agreement generator, explained which clauses you need to adapt for each type of escrow, and added a decision aid so you start from the right template. Keep in mind that a sample contract is always a starting point: for business-critical systems, always have the result reviewed by a lawyer or contract manager.

Which escrow do you need: software, SaaS, or data?

Before you pick a template, it helps to know which type of escrow fits your situation. The three variants differ in scope, in what gets deposited, and in which release triggers make sense.

Software escrow (on-premise / traditional). Here, the source code of a software application is deposited with an independent escrow agent. The software runs on the user’s servers or in an environment the user manages. Choose software escrow if you license an application that is installed locally, or where the vendor controls the source code but you depend on maintenance and updates. For more background on how this works, see our page on software escrow solutions.

SaaS escrow (hosted / cloud). With SaaS applications, the software runs at the vendor or at a hosting provider. Alongside the source code, the cloud environment, configurations, data, and migration instructions all become relevant. For SaaS escrow, Escrow4all works with more than 75 hosting providers. Choose SaaS escrow if you consume your application as a service and have no direct access to the underlying infrastructure. See our page on SaaS escrow solutions for the specific approach.

Data escrow. Data escrow covers the data itself, separate from the application code. Think periodic database backups, API data, or structured datasets that are critical to running your business. Choose data escrow if the continuity of your processes depends on access to specific datasets, even in cases where you could replace the application itself. The registry data escrow variant is also mandated by ICANN for domain registrars.

Not sure which variant fits best? Our page on choosing a digital escrow solution walks you through a comparison.

Sample contracts and templates: how to request them

The sample agreement generator

The most practical route is the sample agreement generator in the Knowledge Center. A short intake produces a draft agreement tailored to your situation: type of escrow, parties, and the scope you want. That’s considerably faster than filling in a generic template from scratch, especially if you don’t yet know exactly which clauses matter in your context.

You can access the generator here:

External templates as additional reference

If you also want to review other base templates for comparison, freely available options exist. Escrow London publishes a “Software Escrow Agreement Template” as a PDF (April 2023 version, multi-beneficiary). Business in a Box offers both a “Software Escrow Agreement Template” and a “Source Code Escrow Agreement Template” as free Word files. These are useful as reference material, but bear in mind that they aren’t aligned with the Dutch context or with how an ISO 27001-certified escrow agent works.

Key clauses: what’s in a software escrow agreement?

Once you have a template in hand, you’ll want to understand quickly which sections are critical and what you need to complete or adjust yourself. Here’s an overview by clause category.

Parties and roles

A software escrow agreement involves three parties:

• Depositor / vendor: the software developer that deposits the source code and related materials.
• Beneficiary / licensee: the organization that uses the software and benefits from the protection.
• Escrow agent: the independent third party that manages, safeguards, and releases the deposit. Read more about this role on our page explaining what an escrow agent is.

Make sure all three parties are correctly identified in the contract, including their legal entity and registered address.

Deposit materials

This is one of the most underestimated sections. Specify as precisely as possible what will be deposited:

• Complete source code, including every version running in production
• Build scripts and compilation instructions
• Technical documentation and installation guides
• Configuration files and environment variables
• For SaaS: cloud environment configurations, container files, migration scripts

Inconsistency in what actually gets deposited is a common sticking point during verification. Our verification page explains how Escrow4all assesses the quality and completeness of a deposit.

Release triggers

Explicit release triggers are the heart of the agreement. Vague wording like “if the vendor fails to meet its obligations” is legally fragile. Define concrete events, such as:

• Bankruptcy or a court-approved suspension of payments involving the vendor
• Discontinuation of maintenance and support with no successor in place
• An acquisition in which the new owner does not assume the agreement
• Extended unavailability (for example, more than X consecutive business days)
• Breach of contract that isn’t remedied within an agreed period

For each event, it’s wise to also describe what evidence is required before the escrow agent proceeds to release.

Verification and update obligations

An escrow agreement without verification terms is little more than paperwork. Put in writing:

• How often the vendor updates the deposit (for example, at every production release or at least quarterly)
• Which type of verification takes place (formal, functional, or extended testing)
• Who bears the cost of verification

Escrow4all is ISO 27001-certified and equipped to carry out both formal and in-depth technical verification.

Use after release

Set out clearly what the beneficiary may do with the materials once they’ve been released:

• Internal use for recovery and continuity: yes, always
• Engaging a third party for maintenance: often permitted, but specify it explicitly
• Commercial development or distribution: almost always excluded
• Duration of use after release: set a reasonable term

Escrow agent obligations

The escrow agent is contractually bound to:

• Safeguard the deposit securely (at Escrow4all, in line with ISO 27001)
• Release materials only upon a confirmed and verified trigger event
• Maintain confidentiality of the deposited materials
• Hold a neutral position: the agent doesn’t rule on the substance of a dispute, but assesses whether a release request meets the contractual criteria

Practical tips: which template to choose when

For vendors looking to standardize. Start with Escrow4all’s agreement generator and adjust the suggested deposit frequency and trigger events to your release cycle. If you have multiple customers requiring escrow, it’s more efficient to work from a standard base agreement and add only customer-specific release conditions.

For buyers safeguarding business continuity. As you review the template, focus on the sections covering release events, the evidence mechanism, and the procedure for disputes over whether a trigger applies. In practice, these are the sections that generate the most discussion. Our escrow arrangement page gives you more context on how such an arrangement works as a whole.

For the public sector or multi-country contracts. Choose the language version (Dutch or English) that matches the primary legal context of the contract. Always have jurisdiction-specific elements, such as governing law and choice of forum, reviewed by a lawyer familiar with the countries involved. In public tenders, escrow is sometimes a contractual requirement, as set out in the GIBIT guidance.

Versions and staying current

Templates age. The most common reasons to revise an escrow agreement are:

• New technology on the vendor’s side (migration to cloud or microservices)
• Changes in laws and regulations, such as NIS2 or DORA
• Adjusting trigger events based on lessons learned
• New verification methods that need to be captured in the contract

Escrow4all incorporates relevant updates into the agreement generator as soon as they become available. With every new contract, check that you’re working from the most recent version of the template. Do you have an existing agreement that’s a few years old? Then it’s worth putting it side by side with a current draft.

Escrow4all – To be sure