Get It Right. Every Time.

Mission-critical technology is everywhere, and you depend on it every day. Failing to protect mission-critical technology puts your business at risk... you can’t afford not to safeguard your reliance on it.

Protect your mission-critical software source code with:

  • Media-management best practices to securely transmit and track your media
  • Verification services to ensure all of the right information will be available
  • Formalized, auditable workflows to help prove compliance throughout the escrow process

Iron Mountain Software Escrow

Business Challenge

You need to protect your investment in technology.

You want to make sure your source code is safe and will be accessible if needed. You’ve decided to use an escrow solution, but what’s the process? How do you know your source code will be well cared for? And if a situation arises where a software application needed to run your business becomes unavailable, will the escrow deposit materials contain everything you need to recreate that software?

What if you could...

  • Be assured of a simple, repeatable process for your software escrow workflow?
  • Gain peace of mind that all parties’ needs are taken into consideration and fairly balanced?
  • Secure your mission-critical technology in unparalleled storage facilities?
  • Protect your vital assets and preserve the integrity of your intellectual property?

At Iron Mountain, we safeguard your interests by protecting and preserving information that can help with your compliance and continuity needs. Our software escrow service provides physical and electronic vaulting of software source code with secure, real-time, online account management.

Here’s how it works. When a software escrow contract is established, the source code for that software is placed within a secure escrow account held by Iron Mountain. If the developer is not able to support its product at some point in the future — whether due to a bankruptcy, an end-of-life announcement, or a merger, acquisition or strategic partnership — the user who has licensed that software contacts us to request a release. We then contact the developer, and if the release conditions are satisfied, the source code is released to the user.

Iron Mountain created the technology escrow industry in 1982 to help companies protect software source code and other intellectual property. Today, more than 90% of Fortune 500 companies turn to Iron Mountain for software escrow protection.

Iron Mountain follows rigorous standards to keep our customers’ data safe, including security-industry best practices coupled with Iron Mountain-developed methodology.

The bottom line: Iron Mountain takes data protection seriously and goes to great lengths to protect customer data from significant credible threats. Iron Mountain’s software escrow solution provides security at every level, from deposit transfer to long-term storage. We safeguard your investment at every stage of the escrow process, streamline escrow administration through easy-to-use deposit processing tools, and provide real-time, online management for all of your escrow accounts.

When you escrow with Iron Mountain, you protect your investments in technology. Optionally, by choosing Escrow Verification Services, you can also ensure deposit materials include all the components necessary to read, recreate, maintain, and support the software applications needed to run your business.

[Diagram removed. Download the PDF for all diagrams, images, and visual aids.]

A Trusted Iron Mountain Workflow


At Iron Mountain, we’ll balance a software user’s need to protect the investment in the technology they’ve licensed with a developer’s need to keep their proprietary intellectual property confidential. With an Iron Mountain software escrow agreement, all parties gain peace of mind.

The developer prepares the data by first assembling all of the required source files, libraries, scripts, and any other tools that are required to recreate the product. Typically, a tarball, zip file, or other compressed format is created from this set of files, and the data may be encrypted if extra security is desired.  A “Deposit Material Description,” known as an Exhibit B can be found in your agreement. This is also prepared by the developer and describes the contents, media, encryption used (if any), as well as contact and account information.


Customer data can be stored on physical media such as hard drive, DVD, tape, or other format. This physical media can then be shipped directly to Iron Mountain. Alternatively, the data can be transmitted using FTP (File Transfer Protocol).

  • If sending physical material, you should package your deposit material (i.e., CD, DVD, drive, tape, etc.) in a secure mailing container from your preferred mailing courier.  Fill out and attach the Exhibit B document (one for each deposit) to the deposit material package, and send both to the Iron Mountain address listed on the Exhibit B document. Trained Iron Mountain professionals will handle the deposit material once it is received.
  • If sending electronically, Iron Mountain will arrange access to our secure FTP site. Once you have access, you should package your deposit material in zip, tarball, or other compressed format; electronically fill out and attach the Exhibit B document (one for each deposit) to the deposit material package; log in to the Iron Mountain secure FTP site; and upload the deposit material package. Iron Mountain will automatically pick up the electronic deposit package and store it in our secure vault.

Visually Inspect

Once the electronic file or physical media arrive at Iron Mountain, we will visually inspect the contents to make sure that they match the description in the deposit description. In the event of any discrepancy, Iron Mountain will promptly notify the developer and work with them to correct any discrepancy so that the deposit can be accepted. Physical media is then barcoded and scanned into the Iron Mountain tracking system and vaulted in a secure Iron Mountain facility. Further verification of the actual contents may be performed at this point if the developer or user selects the optional Escrow Verification Services.

Store and Protect

Once the data has been received and examined, it is transferred to one of our secure locations where it is stored and protected from possible damage or unauthorized access. Iron Mountain stores and protects all deposit materials in physical or electronic vaults under the direct control of Iron Mountain. After the deposit has been stored, notifications are sent out to all the parties identified in the escrow agreement, confirming receipt and vaulting of the deposit, and the Exhibit B document is made available online to the authorized parties listed in the escrow agreement.

Trust, But Verify

The value of an escrow arrangement is heavily dependent on the quality of the deposit materials — a fact increasingly recognized by users and developers. Over 70 percent of all deposits sent in to Iron Mountain for analysis were determined to be incomplete and required additional input from the developer in order to be compiled.

Consequently, we recommend verifying the contents of each escrow deposit with our optional Escrow Verification Services. By verifying the contents of the deposit material, you ensure your investment is protected and that the source code is complete and can be rebuilt if necessary.

Iron Mountain comprehensive verification offerings include:

  • File List Test. Checks that deposited assets are readable, virus free, and — if encrypted — that Iron Mountain has the decryption keys on deposit.
  • Inventory and Analysis Test. Provides a complete audit and inventory of your deposit, including analysis of deposited media to verify the presence of build instructions and identification of materials necessary to recreate the original development environment.
  • Compile Test. Validates whether the development environment can be recreated from the documentation and files supplied in the escrow deposit.
  • Binary Comparison Test. Tests the functionality of the compiled deposit materials by comparing the files built in compile testing to the licensed, executable file running at your site. 
  • Full Usability Test. Confirms that the source code placed in escrow will be fully functional in the event of a release. We run a series of tests to ensure that replicated software runs properly and then create a detailed report of these tests, which includes demonstrations of the functioning software in action.


The Iron Mountain Escrow Management Center is a tool that enables each customer with an escrow account to manage their account online. It lets you view your escrow agreements and deposit material details for each escrow account. You can also make account updates and set up email alerts for events. These alerts can be helpful in notifying users when a deposit has been made by the developer. You may also use the Escrow Management Center to submit the Exhibit B form online, even if you are sending a physical deposit. Reporting is available to let you view detailed escrow account information.

The Results

Iron Mountain has established a simple, repeatable process for its software escrow workflow. This process has been driven by input from more than 57,000 customers and over three decades of experience. We protect more than 180,000 escrow deposits at multiple physical vaults on five continents as well as an electronic vault.

Iron Mountain delivers secure storage of your mission-critical technology. We store all escrow media and documents in vaults at secure offsite facilities. Extensively screened, rigorously trained teams of data protection professionals manage the Iron Mountain vaults. We’ll protect your data as if it were our own.

Extensive electronic safeguards are used for escrow data transfers. Deposits are received via FTP, which ensures transfer integrity, allows for content encryption, and validates authenticity. Once data is sent to an Iron Mountain secure facility, it is placed in an inbound directory specific to each depositor. The files are then automatically picked up by a background process and moved electronically onto the secure Iron Mountain network.

All electronic escrow deposits first go to the Iron Mountain Underground in Western Pennsylvania, USA. This facility is 60 meters below ground and is a self-sufficient city featuring full backup power for up to seven days. It has its own fire department and water treatment plant, 24-hour armed security, and 24x7 service operations. In addition, a copy of every deposit is made as a failsafe and is backed up to a second secure data bunker for redundancy.

With physical deposits, Iron Mountain protects your source code in a controlled vault that is accessible only by authorized personnel. Unique barcode identification numbers are given to each deposit, and then stored in the next available media container within the vault.

Why Iron Mountain?

What you gain...

  • Your data will be handled by personnel who are subjected to rigorous background checks and receive formalized training.
  • You’ll be able to identify the location of your escrowed software source code through a verifiable audit trail and can get reports when you need to prove it.
  • Your proprietary information will be stored securely.
  • You’ll have replication and daily backup of electronic deposits.

By partnering with Iron Mountain you’ll get the infrastructure, resources, and expertise you need to protect your vital assets and preserve the integrity of your intellectual property.