In the days before SaaS, when software companies provided the programs and their customers installed them on their servers on premise, the customers were able to safeguard effectively against software companies’ vulnerability by having the source code placed in escrow – held by a trusted third party, in case the company went out of business. We worked with NCC Escrow on a number of instances where this worked.

However, in a SaaS world, often the data and the programs are held away from the customer, and this creates a perceived greater vulnerability; and an obstacle to the customer procuring those services. There are SaaS escrow services, but working with a client, we have developed a type of “operational” escrow. SaaS escrow depends on triggers and alerts, but the escrow agent still doesn’t hold the data.

Under our operational escrow scheme, a series of agreements with the hosting provider, the customer, the escrow agent and a “shadow” company with rights (and resources) to step in and take over the service provision can be put in place so that service remains uninterrupted. This depends on a trigger, too, but the trigger allows immediate resumption of service.

This does not just satisfy the customer – perhaps a bank – but also their regulators, because the use of small suppliers – possibly innovative, fast-moving – can be de-risked. There is a set-up and running cost to this, because the backup company needs to have the assurance of payment, probably by a retainer. Potentially, though, it can inherit a revenue stream; and the structure allows the corporate to access innovation in a new way.

DISCLAIMER: The information and opinions expressed in this article does not address individual requirements and is for informational purposes only. It does not constitute any form of legal advice and should not be relied on or treated as a substitute for specific advice relevant to your particular circumstances.