When source code escrow is demanded: what to do first
Treat a source code escrow demand as a formal release trigger, not a request for discussion. Open the escrow deed first and read the exact release condition named. A contractual response window is usually already running from the date the demand was served. Verify the trigger, preserve delivery records, and only then instruct the escrow agent.
What the demand actually triggers
Directive 2009/24/EC governs the legal protection of computer programs across the Union. The deposited source code is a protected work under that directive, and release does not itself grant new rights over it. The underlying licence, read together with Directive 2009/24/EC, still sets the boundary of what the recipient may do with the code once it is handed over.
Most escrow deeds tie release to one of a small set of named events: insolvency, sustained non-performance, or discontinued support. The demand you received will point to one of these. That clock rarely pauses while the parties argue about wording. Evidence of the trigger matters as much as the trigger itself, in much the same way a delisting dispute turns on the record a platform kept, as in When a marketplace delists the collection and the evidence.
What to do first
- Locate the escrow deed and read the release condition it actually names. The contract owner should do this before replying to the demand.
- Match the demand against that condition, sentence by sentence. Legal counsel should not accept the counterparty's summary of events in place of the deed's own wording.
- Check whether delivery partners are implicated in the alleged trigger, including any named in Subprocessors, including local delivery partners explained. The delivery lead should confirm which entity actually held the obligation said to have failed.
- Preserve internal records that predate the demand: support tickets, delivery logs, uptime reports, and correspondence. IT and delivery teams should freeze these before any dispute narrows what counts as evidence.
- Notify the escrow agent formally only once the trigger is verified internally, and only through the notice procedure the deed sets out. Legal counsel should own this step.
- Instruct counsel to respond within the contractual window, not after it closes, if the trigger is disputed at all.
Who decides, and on what
| Question | Decided by | Basis |
|---|---|---|
| Whether a release event occurred | The contracting parties, then a court or arbitral tribunal if they disagree | The trigger definition in the escrow deed and the evidence each side produces |
| Whether the deposited code is complete and usable | The escrow agent, where the deed provides for a technical verification | The verification procedure agreed at the time of deposit |
| How long the response window runs | The notice clause in the escrow deed | The date the demand was served, not the date it was read |
If your situation differs
If the escrow deed requires independent technical verification before release, the escrow agent's confirmation is the operative trigger, not the counterparty's demand alone. Wait for that confirmation before treating the release as final.
If the counterparty's demand does not match any condition actually written into the deed, you may treat it as invalid. Respond in writing, quote the deed's own wording, and set out why the named event has not occurred.
If the deposit bundles code under separate third-party licences with your own code, Directive 2009/24/EC still governs your own program, while the third-party terms govern the rest. Separate the two before you agree to any release.
What this page does not cover
This page does not decide whether a specific release event has occurred in your contract, size a dispute, or draft an escrow deed. It sets out the sequence and the decision points, not the outcome of any one demand.
Sources and limits
This material was checked against Directive 2009/24/EC and current escrow deed conventions on 4 March 2025. It does not incorporate every national implementing measure your counterparty might raise, or a full record of how a given escrow agent has behaved in past releases.
Where the dispute needs counterparty-specific evidence rather than deed interpretation, our jurisdiction notes go further, for example Counterparty in Latvia and its limits and its limits.
Where the release concerns a single deliverable rather than the whole counterparty relationship, see Document in Latvia and its limits in practice.
Related situations
A related trigger under the same delivery contract is covered in When open source is found in the delivery, which turns on licence terms rather than an escrow event.
FAQ
What is the first step when source code escrow is demanded?
Read the escrow deed and match the demand to the exact release condition it names. Do not respond to the counterparty's account of events until you have the deed's own wording in front of you.
Which deadline is already running?
The notice period set in the escrow deed starts from the date the demand was served, not from the date you acknowledged it. Treat that date as already running when you begin the review.
Who decides, and on what evidence?
The escrow agent decides only whether the deposit meets any technical verification the deed specifies. Whether the underlying trigger event actually occurred is decided by the parties, and by a court or arbitral tribunal if they cannot agree.