Proving your software can be recovered.
Independent verification of software escrow deposits. We rebuild your supplier's source code in a clean, isolated environment and prove it produces the software your business actually runs.
If your supplier fails tomorrow, the deposit is all you have. Find out now whether it works, not when you need it.
Source deposit
Source code, documentation and build instructions.
→Clean environment
Reconstruct the required environment independently.
Build & deploy
Follow the documented process and test the result.
→Evidence
Record findings, results and any issues discovered.
An escrow deposit is only as good as what's inside it.
Escrow agreements protect you on paper. But a deposit that's incomplete, out of date or undocumented can't be turned back into working software, and you only discover that at the worst possible moment. These are the problems a proper verification catches.
Missing dependencies
Third-party libraries, internal packages or licensed components that exist on the developer's machine but were never deposited.
Undocumented build steps
Knowledge that lives in one engineer's head: environment variables, manual scripts, the order things have to be done in.
Source that doesn't match production
Code from an older release, or a branch that was never shipped, deposited in place of the version you're licensed to use.
Absent databases and configuration
Schemas, reference data, deployment settings and infrastructure definitions needed to actually run the application.
Tools nobody can obtain
Compilers, SDKs or build servers that are no longer available, or require licences the deposit doesn't account for.
Encrypted or unreadable files
Corrupt archives, password-protected content and files that can't be opened by anyone other than the vendor.
Verification matched to how critical the software is.
Every engagement ends with a written report: what was deposited, what was tested, what failed, and exactly what the vendor needs to fix.
| What's checked | Deposit inspectionIs everything there? | Build verificationDoes it compile? | Full verificationDoes it run like production? |
|---|---|---|---|
| Deposit is readable, complete and virus-free | |||
| Contents checked against the escrow agreement | |||
| Build documentation and dependencies reviewed | |||
| Source compiled in a clean, isolated environment | – | ||
| Rebuilt output compared with the production release | – | ||
| Application deployed and functionally tested | – | – | |
| Recovery runbook your team could follow | – | – |
Cloud and SaaS applications are verified the same way, extended to cover infrastructure-as-code, hosting configuration and data recovery. Every engagement is quoted after a short scoping call.
How a verification works.
We work directly with your software supplier's developers, so there's very little for your own team to do beyond agreeing the scope.
Scope
We agree the application, the release and the level of verification with you.
Engage the vendor
We talk to the supplier's developers to understand their build and deployment process.
Rebuild in a clean room
Starting from a blank machine, we rebuild the software using only what's in the deposit.
Report
You get a plain-English report with a clear result and a list of remediation actions.
Re-verify
When the supplier fixes gaps or ships a major release, we verify the updated deposit.
Who we work with.
Businesses relying on critical software
If an application runs your operations, your revenue or your regulatory reporting, you need evidence that you could keep it running without the supplier.
Software vendors
A verified deposit answers the continuity question in procurement before it's asked, and shortens enterprise and public sector sales cycles.
Legal, risk and procurement teams
Independent assurance for operational resilience obligations, third-party risk reviews and contract negotiations.
Specialist verification, done by the person who does the work.
Cleanroom Technical Assurance was founded by Nick, a verification consultant with twelve years spent rebuilding escrow deposits across hundreds of applications, languages and platforms, from legacy desktop systems to modern cloud services.
That background sits alongside earlier work in systems analysis, quality assurance and business analysis, which means reports are written for the people who have to act on them, not just for engineers.
Cleanroom is independent of any escrow agent, so the only thing we're invested in is an honest answer.
- 12 years in escrow verification
- ISTQB certified
- Independent of escrow agents
- Based in Greater Manchester, working UK-wide
Common questions.
Do I need to change my escrow agent?
No. We verify deposits held with any escrow provider, or held directly under your own agreement with the supplier.
Does the software supplier need to be involved?
Yes, and that's a good thing. We talk to their developers to understand how the software is built, and any gaps we find go back to them to fix. Most suppliers welcome a verified deposit because it helps them win and keep customers.
How long does a verification take?
It depends on the size and complexity of the application. A deposit inspection is usually quick; a full verification of a large system takes longer. You'll get a timeline with your quote after the scoping call.
Where does the work happen?
In a secure, isolated environment with no access to the internet or the supplier's systems, either remotely or on site with the supplier if their security policy requires it.
What happens to the source code afterwards?
Build environments are securely wiped when the engagement ends. Source code is never retained, shared or reused.
Find out what's really in your escrow deposit.
Book a 30-minute call. We'll talk through the application, your escrow arrangement and which level of verification makes sense, with no obligation.