# SOFTWARE SOURCE-CODE ESCROW AGREEMENT
## Important warning
This fictional worked example is not legal advice, a guarantee that deposited material is complete or a replacement for technical due diligence. The parties must check the supplier's intellectual-property ownership, open-source compliance, personal data, export controls, the insolvency position, the Financial Conduct Authority perimeter where relevant, and whether the chosen release events are enforceable. An escrow agent should not release material merely because a beneficiary is dissatisfied. The names, dates, fees, repository details and figures are fictional and all sums are exclusive of VAT unless stated otherwise.
Date: 12 May 2027
Parties
(1) Cobalt Ridge Software Limited, company number 07643128, of 22 Coppergate, Cambridge CB2 3QF (Depositor);
(2) Meridian Archive Services Limited, company number 09182517, of 4 Station Approach, Reading RG1 1LT (Escrow Agent); and
(3) Fenland Logistics Group Limited, company number 06391452, of 80 Dock Road, Peterborough PE1 1AB (Beneficiary).
## 1. Purpose and definitions
The Depositor licenses the logistics platform called RouteLedger to the Beneficiary under a software services agreement dated 1 May 2027. The parties want source material held by an independent Escrow Agent so that the Beneficiary can obtain a limited right to maintain the platform if a specified release event occurs.
Deposit Materials means the source code, build scripts, deployment instructions, database schema, interface specifications, third-party notices, test suite, environment guide and administrator credentials listed in Schedule 1. Verification means the technical examination of the Deposit Materials against the Verification Standard. Release Event means an event in clause 6. Business Day means a day other than Saturday, Sunday or a bank holiday in England. Business Continuity Licence means the limited licence in clause 7. Core Service means RouteLedger version 4.6 and the custom modules listed in Schedule 1.
## 2. Appointment and independence
The Depositor appoints Meridian Archive Services Limited to hold the Deposit Materials as an escrow agent and the Agent accepts that appointment. The Agent is not a trustee, software developer, auditor, guarantor of the Depositor's solvency or party to the software services agreement. It may rely on a document that appears authentic and has no duty to investigate the commercial merits of a release request beyond this Agreement.
The parties must give the Agent accurate contact information and promptly notify it of changes. The Agent may communicate with each party separately, but it must give the other parties copies of a formal release notice and an opportunity to respond. The Agent must hold materials securely, restrict access to authorised personnel and not use them except to perform this Agreement.
## 3. Deposit and verification
The Depositor must make the initial deposit by encrypted transfer to the Agent's repository by 19 May 2027. It must deposit a complete update at least quarterly and within 10 Business Days after a production release, whichever is earlier. Each update must identify the release number and checksum. The Agent must confirm receipt within three Business Days and notify the parties of an unreadable file, failed virus scan or missing manifest.
The first verification will take place in June 2027 and then every six months. The Agent will build the Core Service in an isolated environment using the Verification Standard in Schedule 2. It will not inspect unrelated confidential material. Within 15 Business Days after a verification, it will issue a report stating whether the package was verified, the material defects found and the date for re-submission. A failed verification does not itself trigger release. The Depositor has 20 Business Days to cure a reported defect and the Agent must test the replacement reasonably.
The verification fee is £1,800 per cycle. The Depositor pays the first two cycles and the Beneficiary pays later cycles unless a cycle is required solely because the Depositor failed to cure a notified defect, in which case the Depositor pays the additional cycle. If a party disputes a fee, it must pay the undisputed amount and refer the dispute under clause 10.
## 4. Security and confidentiality
The Agent must use encryption at rest and in transit, multi-factor authentication, role-based access, immutable access logs and daily backups. It must keep one backup in a UK facility separate from the primary repository. It must notify the parties within 24 hours after discovering unauthorised access, corruption or loss, preserve relevant logs and co-operate in reasonable remediation. Routine copies held in backup rotation remain subject to this Agreement.
The parties must keep Deposit Materials, verification reports and commercial information confidential. Disclosure is permitted to professional advisers, insurers, a competent court or regulator, or a replacement service provider strictly needed to operate the Core Service after a valid release. A party must not upload the materials to a public repository or use them to train a machine-learning model. These duties continue for five years after termination, except for trade secrets, which remain protected while secret.
## 5. Fees and liability
The Beneficiary must pay the Agent an annual custody fee of £3,600 in four equal instalments of £900 on 1 June, 1 September, 1 December and 1 March. The first payment is due 1 June 2027. The Agent may suspend non-essential verification work for an overdue undisputed fee after 10 Business Days' written notice, but it must continue to preserve existing materials and process an urgent release notice.
Nothing excludes liability for death or personal injury caused by negligence, fraud, fraudulent misrepresentation or liability that law does not permit to be limited. Subject to that, the Agent's aggregate liability is capped at £50,000 and no party is liable for indirect loss or loss of profit. The Depositor indemnifies the Agent against a third-party claim that depositing the materials infringes rights, except to the extent caused by the Agent's unauthorised use or negligence.
## 6. Release events and notice
A Release Event occurs if: (a) the Depositor enters liquidation, administration or an arrangement with creditors and the Core Service is not maintained; (b) the Depositor ceases to provide material support for 30 consecutive days after a written support request; (c) the Depositor commits a material uncured breach of the software services agreement that prevents the Beneficiary's lawful use; or (d) the Depositor permanently ceases business or announces that it will discontinue the Core Service without providing an agreed successor service.
The Beneficiary may request release by a signed notice identifying the event, the date, the affected service and the requested material. It must attach evidence and confirm that it has given the Depositor at least 15 Business Days to respond, unless the Depositor is insolvent or an urgent safety issue makes that period unreasonable. The Agent must send the notice to the Depositor within two Business Days. The Depositor may oppose release within 10 Business Days with evidence that no event occurred or has been cured.
If opposed, the Agent must not release for 15 Business Days while the parties seek an urgent determination. It may release only on joint written instruction, a final court order, or where the Agent reasonably determines from the documents that the release event is established and no timely cure has occurred. The Agent may obtain legal advice at the parties' joint cost. The parties remain free to seek an injunction from the courts of England and Wales.
## 7. Release and permitted use
After a valid release, the Agent will provide the latest verified Deposit Materials to the Beneficiary by secure transfer and notify the Depositor. The Beneficiary may use the materials only to maintain, repair, secure and migrate the Core Service for its internal logistics operations. It may give them to a replacement maintainer bound by confidentiality, but may not sell, sublicense, publish, compete using the materials or develop a substantially similar product for third parties.
The release does not transfer ownership. The Depositor grants the Beneficiary a non-exclusive, worldwide, royalty-free licence for the permitted continuity purpose for the remaining period of the software services agreement and any reasonable migration period of 12 months. The Beneficiary must continue paying contract fees not dependent on support and must return or destroy copies when the licence ends, subject to one archival copy kept for legal compliance.
## 8. Data protection and third parties
The parties must not intentionally deposit live personal data, production passwords or special-category data. If such material is unavoidable, the Depositor must pseudonymise it and provide a lawful data-sharing basis. Each party is an independent controller for its own processing unless a written data-processing arrangement says otherwise. The Agent must process contact and access-log data only to administer this Agreement and must delete it seven years after termination unless law requires longer retention.
The Depositor must list open-source and third-party components in every manifest and ensure that the licence terms permit the release and permitted use. The Agent gives no warranty that a released package will run on new infrastructure, satisfy a regulator or include a third-party licence.
## 9. Termination and replacement agent
This Agreement begins on 12 May 2027 and ends when the software services agreement ends and all release rights have expired. A party may terminate for an unremedied material breach after 20 Business Days' notice, but termination does not destroy a pending release right. The parties must appoint a replacement agent by written novation if the Agent stops providing escrow services. Until transfer, the Agent must preserve the latest materials.
## 10. Notices, records and dispute resolution
Notices must be sent by signed PDF and pre-paid first-class post to the addresses above, with a copy by email to an email address notified in writing for notices. The Agent must retain deposit receipts, checksums, verification reports, access logs and release correspondence for seven years. A dispute must first be referred to a director meeting within 10 Business Days, then to mediation in Birmingham if not resolved within 20 Business Days. Nothing prevents urgent court relief.
## 11. Governing law
This Agreement and any non-contractual dispute are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.
## Schedule 1 — Deposit inventory
The May 2027 package is RouteLedger 4.6.0, containing 412,800 lines of source code, 86 build scripts, the PostgreSQL schema, 64 API specifications, 238 automated tests, deployment runbook RL-OPS-18, third-party notices and a clean-room administrator account. The March 2027 package is the baseline; each later manifest must state changed files and SHA-256 checksums. No customer data is included.
## Schedule 2 — Verification Standard
The Agent must check that the manifest opens, the source compiles with Node 20 and PostgreSQL 15, the test suite runs with at least 95% of tests passing, a sample tenant can be created, a delivery route can be entered, and a PDF dispatch note can be generated. The Agent records a failed check rather than silently treating it as passed.
## Signatures
Signed for Cobalt Ridge Software Limited: ____________________ Name: Eleanor Watts, Director Date: ____________________
Signed for Meridian Archive Services Limited: ____________________ Name: Joel Mercer, Director Date: ____________________
Signed for Fenland Logistics Group Limited: ____________________ Name: Sana Rahman, Finance Director Date: ____________________