In continuity discussions the escrow agent and the service provider are often confused. They are two different roles with a different position in the chain. The escrow agent is a neutral third party with a legal custodial task. A hosting or cloud service provider is an operational party that delivers the service itself.
That distinction matters, because a service provider cannot cover the continuity risks associated with the supplier. It is part of that very same chain.
The escrow agent: neutral third party with a legal role
The escrow agent is contractually not a party to the licence or service agreement between supplier and customer. Its task is limited, and reliable precisely for that reason: receive material, store it securely, check whether the deposit is complete and usable, and release it only when pre-agreed release conditions have been met.
The escrow agent has no interest in the outcome, acquires no ownership of the source code, and provides no services that depend on the supplier. The role is that of custodian and assessor, not of operator. That is why the assessment of a release request is regarded as objective, including by an insolvency administrator or a court.
The service provider: operational party inside the chain
A hosting or cloud service provider delivers infrastructure, management, backups and availability. It keeps an application running, stores data and resolves incidents. That is operational continuity, and it is indispensable.
What a service provider does not do is form an independent judgement about the relationship between supplier and customer. It acts on the instructions of its client, usually the software supplier. If that supplier stops paying, the provider can terminate the environment. If the supplier becomes insolvent, the provider's contracts fall within the same proceedings.
Backups do not solve this either. A backup contains data, but rarely the source code, the build instructions, the configuration and the right of use required to continue running the application independently elsewhere.
Why you need both, rather than one instead of the other
The service provider covers technical disruptions: hardware failure, network problems, data loss or an incident in the environment. The escrow agent covers relational and legal disruptions: insolvency of the supplier, discontinued maintenance, an acquisition after which the product is phased out, or persistent breach of contract.
Those risks do not overlap. A perfectly configured hosting environment does not help if nobody holds the rights and the material to maintain the software. A solid deposit does not help if there is no environment to run the software in. With SaaS the two are therefore often combined in a continuity arrangement covering source code as well as data export, cloud configuration and recovery procedures.
In practice this means: record in the contract with the service provider what happens to data and environment on termination, and record in the escrow agreement which material is deposited and under which conditions it is released.
Frequently asked questions
Can my cloud provider act as escrow agent?
That is undesirable. The provider has a commercial relationship with the supplier or with you and therefore lacks the independent position a release assessment requires.
Is a backup at the hosting party enough?
No. A backup gives access to data, but usually not to source code, documentation and the right of use needed to continue the software independently.
Who decides whether a release may take place?
The escrow agent, based on the release conditions in the escrow agreement and the evidence submitted.
Do I need escrow if my supplier is a large organisation?
Size reduces the risk but does not remove it. Large organisations also phase out products or are acquired. The decision depends on how critical the software is to your processes.
An escrow agent and a service provider complement each other. The provider keeps the service running, while the escrow agent makes sure there is a way out when the supplier falls away.
