There are two sides to every coin…

When software is licensed, there are two parties – the developer of the software and the user, who licenses it for use in their organization.

They both have a lot at stake.

Developers create software applications by using human-readable source code. This is the “secret sauce” or the company’s intellectual property (IP). This source code is compiled into binary machine code (0s and 1s) that a computer can read and execute, which in turn is transformed into executable code to be licensed. One of the reasons for this transformation is so that the intellectual property behind the software stays intact and cannot be easily copied.

As a developer of software, in addition to protecting your IP, you are concerned about closing the deal with the potential buyer, and wherever possible, offering that buyer an advantage over your competitors.

One way to do all of these things is through software escrow. When a software escrow contract is established, the software source code is placed within a secure escrow account with a neutral, trusted third party, such as Iron Mountain. This protects the developer’s IP, while at the same time, minimizes risks for the buyer in case something happens to the developer.

RedPrairie, one of our developer escrow customers, had this to say: “The ability to offer a technology escrow agreement to our customers gives us an extra layer of competitive advantage over any competitor that does not offer these services.”

On the other side of the coin is the user of software, also known as the licensee.

The user is looking for developer support, long term viability and reliability. As a user of software, you want to make sure the company that developed your software is going to stick around. When you need support, it’s important that the developer will be there long term and is a reliable, trustworthy company.

That’s why many software users insist on establishing a software escrow agreement at the same time as their licensing agreement. It helps equip users to manage unforeseen technical or operational risks.

QBE the Americas, one of our escrow customers licensing software stated, “This particular application drives our business end-to-end…  So, it was critical to the mission and stability of the company that we could rely on the source code being deposited, and being available, if something ever happened to our software vendor.”

As the escrow service provider, Iron Mountain bonds the two sides by protecting the valuable source code in a secure, neutral location, until that time when it may be needed. When Iron Mountain establishes an escrow agreement with both the developer and user of software, everyone is protected. Developers know their IP is protected and they can assure potential buyers of their viability. At the same time, software users know that their risks are minimized and they can get back up and run if something happens to their developer.

In essence, no matter which side of the coin you are on, security and peace of mind are essential.

——————————————————————————————————

RELATED CONTENT:

• Learn more about the advantages of software escrow for developers at: Software Escrow: The Developer’s Edge
• Learn more about the advantages of software escrow for users at: Software Escrow: A Best Practice Against Business Interruptions
• Protect Your Intellectual Property
• Software Escrow: What Lawyers Need to Know
• RedPrairie and Software Escrow: Partners in Sales Success

Last week, Iron Mountain attended the ICANN43 Conference in San Jose, Costa Rica. The conference was abuzz with activity as many within the Internet community get ready to finalize their new gTLD applications by the April 12, 2012 deadline set up by ICANN, or the Internet Corporation of Assigned Names and Numbers.

The new gTLD program, managed by ICANN, the governing body of the Internet, could revolutionize the Internet and allow for an expansion of domain names not seen since the Internet first galvanized our world in the 1990s. Nearly 1,500 members of the Internet community attended the event, and the Iron Mountain Escrow services team met with several existing, new and potential customers, highlighting our readiness to support the hundreds of new gTLDs that are expected to roll out later this year and in 2013.

Iron Mountain’s Vice President of Sales, John Boruvka, and Vice President of Operations, Mary English, spent some time talking with ICANN Wiki founder Ray King about our thoughts on the new gTLD program and how Iron Mountain can help support the Internet community.

A long term partner of ICANN, Iron Mountain emphasized to new gTLD applicants that we understand data escrow, a requirement of the new gTLD program, and are uniquely positioned to handle the expected volume since we manage most of the data escrow applicable to the Internet today (over 1,100 registrar and registry customers and counting).

Simply put, Iron Mountain can offer peace of mind like no other escrow service provider in the market today. In addition to our own escrow services, we also have several strategic alliances with key registry providers in the Internet community, making it easy for customers to set up an escrow and send data on a regular basis – either on their own or through their registry provider.

To learn more about data escrow and how Iron Mountain can help you with your data escrow requirements, read more here.

Also available, is a white paper Data Escrow for the New gTLDs that discusses how Iron Mountain can assist with new gTLD data escrow requirements.

Related Content:

• Registrar Data Escrow Compliance: Safeguarding Domains Large and Small
• Registry Data Escrow Success Kit
• It’s the Whole Web in Your Hands: Registry Data Escrow Compliance

ICANN, or the Internet Corporation for Assigned Names and Numbers, is a not-for-profit partnership of people from all over the world dedicated to keeping the Internet secure, stable and interoperable, and is managing the new gTLD program.

The program aims to encourage greater domain name choice and innovation by creating a range of new names as an alternative to the 21 gTLDs currently in existence. Organizations can apply for a new gTLD specifically for their company or brand (such as .canon or .deloitte) or for almost any generic term as a gTLD (such as .music, .bank or .shop), as well as geographical gTLDs (such as .nyc or .london).

Hundreds of the world’s largest brands, as well as community-based and non-profit organizations, have begun to submit applications for a new gTLD during the three month application window that opened on January 12 and will close on April 12, 2012 (see timeline of what to expect in 2012 here.) The first new gTLDs are expected to go live on the Internet in 2013. A variety of industry sources estimate that between 1,000 and 1,500 applications will be submitted for new gTLDs in the first round this year.

Registry Data Escrow is one of the essential stakeholder protection mechanisms for gTLDs. It ensures that the data associated with registered domain names is never at risk of being lost or inaccessible, because the names are held in escrow by a trusted, neutral third party, such as Iron Mountain.

Data escrow is one of the five critical registry functions and is a requirement for all new gTLDs. It is covered in question #38 of the application, and all new gTLD applicants need to articulate that a plan is in place to escrow gTLD data.

This week, the new gTLDs will be a hot topic of discussion at the ICANN 43 meeting in Costa Rica.  So, if you know all about ICANN, gTLDs and Registry Data Escrow, maybe we’ll see you in Costa Rica! If not, but if you’d like to learn more, download our free Registry Data Escrow Success kit at: www.ironmountain.com/gtld.

Related Content:

• Data Escrow for the new gTLDs
• Registry Data Escrow Success Kit
• The Many Faces of Technology Escrow

Today many companies are embracing cloud computing and its’ Software as a Service (SaaS) model. According to an InformationWeek study, 33% of companies are currently using the cloud and 40% are planning to adopt or are evaluating cloud technology.

Cloud computing providers offer three fundamental models – Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and SaaS. With SaaS, cloud providers install and operate application software in the cloud, and users access the software via cloud clients (typically, via the Internet). This eliminates the need to install and run the application on the user’s own computers simplifying maintenance and support, and reducing costs.

Sure, it all sounds great, but SaaS does not come without risks. Adequate protections need to be built into the subscription agreements to ensure that the user’s application and data is protected if something happens to the SaaS provider. Considering that a SaaS solution may be hosted by unknown third parties or reliant on small, unproven vendors, it is imperative that SaaS subscribers beware and be prepared.

That’s why Softletter Research believes that both SaaS application providers and subscribers need to take a closer look at their strategies in regards to software escrow as the adoption of SaaS applications continues to grow.

Want to learn more?

Iron Mountain is presenting at Virtual LegalTech on March 15 at 2:00 ET / 11:00 PT:
Please note that Virtual LegalTech offers free CLE credit for attorneys.

Living in the Cloud? How Escrow Protects SaaS Investments for Application Continuity

Attend this session to discover how to:

• Engender trust between SaaS buyers and sellers
• Create a contingency plan for subscribers
• “Trust but verify” when engaging in a SaaS relationship
• Optimize the subscriber-provider relationship
• Recognize the different risks between SaaS and on-premises software deployments
• For attorneys, this session will help you guide your client through the maze of previously unanswered cloud computing questions

Virtual LegalTech sessions are presented online, so you don’t have to leave your office and it’s free!

So, make sure you register and learn how escrow can help protect your investments, or your client’s investments, in SaaS.

• Learn more about safeguarding your SaaS applications and data
• Chevy Chase and Software Escrow
• Is There a Hole in Your Disaster Recovery Plan?
• Case Study: How Iron Mountain Technology Escrow Services Gives RedPrairie’s Customers a Sense of Security and Safety
• Escrow Protection for Developers: Accelerate Sales Cycles While Safeguarding Your Intellectual Property

View the presentation

Statistics show that over 70% of all software escrow deposits sent in for analysis are incomplete and required additional input from the developer in order to be compiled.

A software escrow arrangement is an excellent vehicle for protecting all parties involved in licensing technology, but the value of the escrow arrangement is heavily dependent on the quality of the escrow deposit materials.

So, why is verification so important?

Let’s start with a quick review of the escrow process. A developer creates a new application and licenses it to a company that wants to use it. The user is concerned about relying on software from a developer with an unproven track record.

What if the developer goes out of business?  How will the user get bugs fixed or new features added? What if something unexpected happens that affects the users’ ability to run the software?

To solve this problem, in addition to the application itself, the user wants to be able to get access to the source code so that they (or someone they contract with) can maintain the application if the developer is no longer around to do so. They want leverage to control their future and investment.

Naturally, the developer doesn’t want to give the user the actual source code, because that is their valuable intellectual property. Giving away the source code is like giving away their business.

So the user and developer agree to give the code to an escrow services provider (a trusted third party), like Iron Mountain, who will keep the code safe and only release it to the user if certain conditions are met, like the developer going out of business or discontinuing support.

An escrow deposit can consist of many things – source code files, scripts, libraries, data files, etc.  – whatever is needed to reproduce and maintain the actual application.

However, while the developer gives a box full of code, so to speak, to the escrow services provider, until that box is actually opened and the contents analyzed, we don’t really know what is inside it.

People make mistakes – even if the developer is completely diligent in their escrow deposits – there may be files, libraries, or scripts that they simply forgot to include. And when some disaster strikes and the source code is released from escrow, that is not the time to find out files are missing and the code won’t compile.

If requested, verification services can be done on any escrow deposit by the escrow services provider. Verification is the process of making sure that the correct code needed to compile the application has been deposited, that all of the code needed to compile the application has been deposited, and that the instructions and processes are included.

Any errors that are discovered are reported back to the developer, who will then correct the problems and issue another release to the escrow services provider. This process I repeated until all errors have been fixed.

There are several different levels of verification that can be performed and it may not be necessary to always perform extensive verification for each escrow deposit. Let’s first take a look at the major levels of verification that can be performed.

The first level of verification is to simply make sure that all of the correct files have been included in the deposit including build instructions and third party tools.

This may sound simple, but there can be hundreds or even thousands of files associated with a complete set of the source code and they can be distributed across a complex directory structure. Verifying that the right files are included in the right places is the first step towards making sure that the developer didn’t simply make a simple mistake in collecting all the files that are needed. In this stage we make sure that the developer actually deposited what they said they would deposit.

The next step is to actually compile the code. This is a major step towards making sure that a complete set of the source code has been deposited. If any file, script or library is missing that will show up during compile as an error. This step tells us that what the developer meant to deposit included everything that they needed to deposit.

Of course, just compiling the code doesn’t tell us that it works correctly. A file could be present but might include the wrong revision that had some bug or incompatibility in functionality. There are two steps that can be done to make sure that not only are all the files included in the escrow deposit, but that they are the correct files. The first option is binary comparisons, and the second is functionality testing.

Binary comparisons can be done when a release of the application has been made to the user at the same time that a deposit of the source code has been made with the escrow services provider. The escrow services provider can compile the source code and then do a binary comparison between the compiled application and the version of the application that was released to the user.

This guarantees that the source code that resides with the escrow services provider is the same source code that was used to compile the application release at the user since the binary applications compare.

The last method of verification is actual functionality testing. Even if we can be sure that the source code that was deposited is the correct and complete source code, does it meet all the user’s functional requirements?

The user may receive a new release but not actually deploy it for some time. In this case, the user does not want to find out later that while the correct code has been escrowed, that code has some major functionality that is broken or not included.

In this final verification step the escrow services provider will actually set-up, configure and install the user’s production environment and run test cases to verify that all the functionality is working correctly.

This may sound like a lot of worrying about something that surely doesn’t happen often. Forgetting to include key components? Depositing the wrong ones? That doesn’t really happen, does it?

Sadly, it has proven to be the rule, not the exception.

Missing files, wrong files, incomplete lists of files…what if these problems were not discovered until it was too late to fix them?  It would be like finding out your insurance didn’t really cover you after your house had burned down.

And verification is a common practice in other industries as well. Mortgage companies insist on a home inspection, life insurance companies require physicals, etc. As Ronald Reagan said during the arms reduction treaties, “Trust, but verify!”

Analysts like Gartner agree: If you don’t plan to do regular audits or verification that the version of the software you are using is in escrow, the agreement may be worthless…If the vendor fails behind the source code deposits, and has incomplete or unusable deposits, the escrow agreement could be worthless.

Escrow is a key insurance plan for any business that wants to reduce the risk from critical software that they rely on.  But performing escrow without verification is like buying insurance without knowing what is being covered.

When a problem arises, you might be okay – or you might not. If you don’t want to gamble with your company’s future, verification needs to be a key component in your escrow program. Trust your business partner, but verify that no one has made any mistakes

For more information on escrow and escrow verification, part of our intellectual property management solution, please visit our website. You can also sign up to receive your free copy of our popular publication, “Escrow for Dummies” – it’s the smart thing to do!

Related Links:

• Escrow Verification Services
• Chevy Chase and Software Escrow
• Is There a Hole in Your Disaster Recovery Plan?
• Case Study: How Iron Mountain Technology Escrow Services Gives RedPrairie’s Customers a Sense of Security and Safety
• Escrow Protection for Developers: Accelerate Sales Cycles While Safeguarding Your Intellectual Property

You’ve heard the stats:

• On average, enterprises lose between $84,000 and $108,000 for every hour of IT system downtime
• Up to 40 percent of businesses affected by a natural or man-made disaster never re-open

You need to be prepared. How can you ensure that all of your important applications are recoverable, and can continue to drive your operations after a disaster?

It is important to think about the software applications you use, as well as the software created by your IT department, that supports your business or government agency whenever you review your business continuity and disaster recovery plans.  

Protecting the source code for your important applications via a software escrow agreement is a simple, cost-effective way to ensure application continuity. This way, the software that you’ve licensed is protected in a secure environment and available when needed.

It’s important to think beyond those super critical top few applications covered by managed recovery services. If an application is not easily replaced with off-the-shelf software packages, it should be protected with a software escrow agreement and verification testing. With a software escrow and verification solution supporting your existing business continuity/disaster recovery (BC/DR) plan, you can extend the number and type of applications that can be protected in a cost-effective manner.

My colleague, Dennis Bruce, recently wrote an article for Government Security News with more details on this topic. I hope you’ll take a look and share your thoughts.

Do you have questions about software escrow? Read additional Knowledge Center stories on this subject, or contact Iron Mountain’s Intellectual Property Management team. You’ll be connected with a knowledgeable product and services specialist who can address your specific challenges.

Related Links:

• Ensuring Application Continuity Outside of the “Classic” DR Scenarios
• Chevy Chase and Software Escrow
• How Verification Services Fortify Your Software Escrow Solution