Guy Krige, Director at Escrow Europe, tells the OFM Business Hour that software end users (clients) are at risk should their software developers end up disappearing owing to financial constraints or being acquired by a bigger company. To safeguard one’s business, Krige urges business owners to look into active software escrow agreements which he describes as a “resilience measure or a business continuity measure".

Well, according to Krige, software is built in source code which then gets compiled into binaries before being loaded onto your computer/IT system. The end users a.k.a. the client, only ever receives the compiled product which in this latter binary form cannot be reversed, updated or maintained. According to the Escrow Europe Director, should a need arise for maintenance or an update, the end user needs to return to the software developer, for the change to be made to the software code. 

ALSO READ: OFM Business Hour: 41% of SA businesses lost revenue over ransomware attacks

Without the software developer and consequently the source code, the end user could find themselves in limbo and at risk. Krige makes reference to South African banks that experienced glitches in IT systems of late that left consumers frustrated as one such example.  

What are software escrow agreements exactly? 

Two parties – the end users and the software developer – look for a trusted third party to hold and test the software product, so that in the event that something happened to the developer, the trusted third party could release the source code to the end user for the purposes of protecting “their business continuity” he explains.

Also Read: More protocols needed for operational technologies' security

According to Escrow Europe’s presser on this: “the source code of a business application is deposited with an independent and neutral escrow service provider according to the terms set out in an escrow agreement signed between the software supplier, the business end user and the escrow service provider.

The escrow agreement will specify the exact legal terms upon which:

• the software supplier is obliged to deposit the source code,
• the business end user may call for the release of the source code,
• the testing of the software product required to verify the integrity of the source code deposit.

Is this affordable? 

Krige maintains that should the corporate entity arrange for a backup of the source code, they would need to purchase said software, setting them back anywhere from tens to hundreds of millions of rands. He argues a software escrow agreement on the other hand will end up costing businesses between R 80 000 - R 100 000 per year. 

OFM