We looked into this about three years ago - I think NCC was about the best of the bunch (google.co.uk escrow UK) / nccglobal.com BUT both the customer and ourselves decided that, as the project was for only one customer, it was a lot cheaper and simpler to do it ourselves. The original proposal from the customer was:

1. Supplier takes the source code on e.g. a laptop to the customer's site and compiles this to object code under supervision of customer.

2. A copy of the medium is made (to omit the yearly iteration for data
retention)

3. Supplier seals and secures the media (2 pcs.) containing the source code
and tags it with the name of the customer and the name of the software. The customer is responsible for removing the source code from the computer system in such a way that it cannot be undeleted which can be observed/inspected by the supplier.

3. The customer places the media in a safe.

4. Supplier has the right to, at any time, inspect the media (at location
) to verify that the seal is intact.

5. When a new version is released, the above procedure must be repeated.

However, in practice, we sent two copies of a CD of the source-code to the customer for safe-keeping with each new version.

This is fine if there is just the one customer: if not, or you don't want to trust your customer, you could send to an intermediate (a lawyer, perhaps) or you can use an escrow service, but the latter is very time-consuming and expensive as they require full proof (and often a suite of installation and compilation tools) that they have everything necessary for recompilation. Really, the issue is about what you are using the service for: to protect the source code or protect the customer if you get run over by a bus (or go out of business).

Lastly, you can get badly stung by a large company: the release clauses in use by commercial escrow companies usually favour the company over the supplier: my advice would be to negotiate something with your customer.


>Hi - I have been recommended to use an Escrow service (a third party that holds source code). I wondered whether programmers here advised this and if so if anyone can recommend a service in the UK.
>
>Many thanks