How to Review a Source-Code Escrow Deposit and Release Trigger

Sales says the on-prem licence already has escrow. That certificate is not a rebuild. The hidden risk is a folder that will not compile. Fill a keep / add-verification / walk log before you sign: what is deposited, cadence vs their release cycle, a clean-room build test, three release events, and a post-release licence that lets a contractor keep the licensed clinic system running.

On 4 September 2026, Isla — Founder of a 10-person UK health-tech — has the board’s yes on an on-prem clinic-ops licence. Schedule 7: deposit “the source code” within 30 days, release on insolvency, internal use only. Sales calls it cover if they go bust. No build script, schema, inventory, keys, per-release update, or test. Go-live is the next sprint. Typical mistake: treating the certificate as a spare parachute.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

What must the deposit include besides “the source code”?

Name the artefact first. This clause is a conditional copy of buildable source, not a right to pull customer data from a cloud tenant. SaaS export and retrieval live on the SaaS data-export and exit-rights checklist — one sentence, then return. Isla’s Schedule 7 is on-prem escrow.

Freeze the packet — the signed file set (licence plus escrow plus any verification statement of work). The freeze ritual is the prepare-packet guide. High sentence: “Vendor shall deposit the source code.” That is not a completeness definition.

A UK agent’s 2026 deposit list is the buyer ask: full source for every licensed module; build scripts; database schemas; a third-party inventory with versions; keys required to build — not the clinic’s live secrets. In practice, a deposit that compiles only on the vendor’s laptops is incomplete.

How do you tie update cadence to their release cycle?

Isla’s paper deposits once within 30 days of the Effective Date, then goes silent. A deposit that never tracks their release cycle is two versions behind the clinic box. Write an update after each material release, and a floor even if they skip a named ship.

A June 2026 market-standard sample updates within 30 days after each release and at least quarterly. Gurpreet Bal (structure-only) adds a 30–60 day window and an audit that deposited version matches Isla’s servers. Annual-only is a walk input — Sora (16 July 2026) says annual deposits rarely keep up with monthly releases. Git sync is cadence colour, not a build test.

How do you verify that the deposit actually builds?

Isla’s Schedule 7 has no test. An agent receipt is not verification. Write the level: inventory, build, or replicate. For a clinic system she cannot replace next week, require a compile from deposited materials only, in a clean environment the agent creates.

SES Secure’s 2026 UK guide lists verification as optional but recommended. Escode (structure-only) splits Deposit Validation from Build Verification. LegalClarity says validation does not tell you whether the code compiles. Standard Build runs in the vendor’s lab. Independent Build is the buyer ask. Duration colour: half a day to five days. Frequency colour: every major update, or at least yearly. Output = a report to Isla plus a re-deposit cure. Who pays: write it now — Escrow London (2022, structure-only) says there is no definitive rule.

Which release events should fire besides insolvency?

Isla’s paper says “Release upon Vendor’s insolvency” only. Formal insolvency misses abandon, a sunset after acquisition, and an unremedied support breach. Write three objective triggers plus a short contrary-instruction window.

For England and Wales, name administration, liquidation, winding-up, and inability to pay debts within Insolvency Act 1986 s.123. Do not write “bankruptcy” alone. US filings treat IP licences differently; that is not Isla’s trigger. An Escrow London sample (structure-only) copies s.123 and allows contrary instructions within 10 Business Days. Add abandon / sunset after acquisition — typically no cure once they announce end-of-life. Add unremedied material support after written notice and a stated cure. Vaquill’s sample uses 30 days; Codekeeper colour is 30–60 days. Walk if release needs vendor consent.

When is a post-release internal-use licence a dead letter?

Release gives possession, not a right to act. Isla’s High sentence is “internal purposes only” with no modify and no contractor. A 10-person health-tech will not rebuild a clinic stack in-house. Without a confidential third-party carve-out, the grant is a dead letter on the day she needs it.

Buyer grant: perpetual, non-exclusive, royalty-free, to use, reproduce, modify, and correct solely to maintain Isla’s licensed use of this product — not to resell. Must include disclosure to a confidential contractor. Grant it in the signed escrow, effective on release. For example, if Schedule 7 dies with the licence, the parachute cuts itself.

Should you keep, add verification, or walk?

You are done when the one-page log is filled and you can point to one sentence that would pause signature. That is the success bar: deposit list, cadence, build-test level, release events, post-release licence plus contractor. Then keep, add verification, or walk.

Workflow: packet → not a SaaS export/exit → deposit list → cadence vs release cycle → build test level → release events + objection window → post-release licence + contractor → keep / add verification / walk. After the log, upload the same PDF to Checkory document analysis for a first-pass — a first machine scan that flags those headings on that file. A human still opens every High flag — a high-severity highlight that must be checked before anyone signs. If the rebuild risk is material, send the file to counsel — a qualified lawyer.