For nearly 25 years, Iron Mountain was one of the biggest names in software escrow. But if you are looking for their software escrow or source code escrow services today, all you'll see is a 404 page. Iron Mountain sold that business in 2021 and no longer offers escrow in any form.
This article covers why the business left, who runs it today, and what to look for when you choose an escrow provider now.
If you have been clicking through their site looking for the page you remember, you have not missed it. Their former escrow service pages return errors, a search for "escrow" on their own website returns no results, and escrow does not appear anywhere in their current service listings in the United States, the United Kingdom, Singapore, or India.
In May 2021, Iron Mountain signed an agreement to sell its Intellectual Property Management business, the unit holding its technology escrow and software verification services, to NCC Group for $220 million in gross proceeds (Iron Mountain investor release).
The transaction closed the following month. NCC folded the unit into its software resilience business, which trades today as Escode.
Ownership moved again this year. On May 29, 2026, NCC Group completed the sale of Escode to investment funds managed by TDR Capital, at a total enterprise value of £275 million (NCC Group, TDR Capital).
For anyone whose escrow originated with Iron Mountain, that is three owners since 2021: Iron Mountain until June 2021, NCC Group until May 2026, and TDR Capital now.
Acquisitions are ordinary in a market this consolidated, and none of this reflects poorly on the service itself. But it pays to keep in mind that an escrow agreement is one of the longest commitments in your vendor stack, because you sign it once and then rely on it for as long as you run the software it protects.
Choosing an escrow agent means choosing an organization to hold your recovery position for years at a time. That makes the stability behind a provider a fair thing to establish before you sign.
Iron Mountain's site does not currently reroute you anywhere. There is no redirect from the retired escrow pages, no notice explaining where the service went, and no reference to the company that took it over.
The company itself is still operational though. It runs records storage and management, secure shredding, IT asset life cycle management and disposition, data centers and colocation, and its Iron Cloud range covering cyber recovery, backup, and long-term storage.
It also holds ISO/IEC 27001, ISO/IEC 27701, SOC 2 Type 2, SOC 3, HITRUST, PCI-DSS, and FedRAMP certifications, and publishes a 99.999% uptime guarantee across its data center portfolio.
What none of those services does is hold access to a third party's source code, so you can recover and keep your business running when something happens to a provider.
It depends on what you need protecting, and what your budget is. Like many other traditional escrow providers, Iron Mountain never published escrow prices. Escode, which holds the business today, publishes one indicative figure in a support FAQ, where basic services start at around £1,600 per year with pricing adjusted for verification or SaaS features (Escode pricing FAQs).
Many providers work this way, so these are the conventions to look out for when you compare your options:
Quote-only pricing: Most providers scope and price every arrangement individually, so comparing two of them means running two sales processes before you see a single number you can put in a budget.
Annual commitment: Escrow is commonly sold on annual agreements with automatic renewal, which asks you to commit for a full year before you have seen how the arrangement performs.
Manual deposits: Many providers still rely on you uploading material by hand, and the few that include automated deposits typically limit support to a few named repositories, so anything outside that list reverts to manual uploads and starts drifting behind your live environment.
Verification priced separately: Verification is usually scoped as a professional services engagement priced on application, so proving your deposit works can cost more than storing it, and there is rarely a free tier to start from.
Unpublished release terms: The cost, hours, and turnaround for an actual release are frequently absent from provider sites, even though a release is the one event the agreement exists for.
Codekeeper takes a more transparent approach to software escrow pricing. Products are offered on fixed tiers, with both monthly and annual subscription options available. Each of the five products targets a specific type of software protection and can be stacked together for complete software resilience:
Software Backup (from $99/month): Connects directly to your repositories and infrastructure to hold versioned backups of source code, application data, and deployment assets, so your team can roll back or recover quickly when something internal fails.
Software Escrow (from $139/month): Wraps installed and on-premises third-party software in a formal agreement with defined release triggers, holding source code, documentation, and software data so you can maintain the product yourself if the vendor can no longer support it.
SaaS Escrow (from $199/month): Extends that protection to cloud applications by capturing the full operational environment, including source code, databases, deployment infrastructure, third-party dependencies, and credentials, so the service can be stood back up rather than only inspected.
AI Escrow (from $549/month): Protects the AI stack you have built on a vendor, including models, model deployment assets, prompts and agents, and workflows, across platforms including OpenAI, Anthropic, Google Gemini, AWS Bedrock, and Azure OpenAI.
Continuity Escrow (from $459/month): Keeps your application online when a hosting or third-party service payment lapses. You flag the missed payment, and we cover it directly with the vendor to prevent suspension, holding continuity for three months by default and up to 12 with the Coverage Length SLA.
Setup is a one-time $249 fee, and it covers the agreement drafting that our in-house legal team does for you. Plus, if you choose annual billing over monthly, you get up to 12% off any plan.
Learn more about Codekeeper's software resilience solutions in this video:
If you need specialized protection beyond that, our add-on services extend the plans above to meet specific operational and regulatory needs, without reopening your agreement:
Advanced Deposits (from $59/month): Choose your storage region, set IP whitelisting for specialized security and residency requirements, and keep your complete deposit history instead of routine cleanups.
Advanced Integrations (from $59/month): Custom-built connections for proprietary or non-standard platforms, with automated deposit syncing.
Advanced Continuity Integrations (from $89/month): Connects legacy or non-standard hosting and credential systems to Continuity Escrow.
Compliance Support SLA (from $99/month): Hands-on help with compliance documentation, audit preparation, vendor screening, and GDPR and HIPAA data processing.
Coverage Length SLA (from $99/month): Extends Continuity Escrow beyond its default three-month window, up to 12 months, for a longer transition.
Assured Recovery (from $199/month): A standby technical team and a prepared recovery profile, with response under four hours.
Liability SLA (priced per agreement): Raises liability limits to meet enterprise procurement requirements and align coverage with your contractual risk.
Escrow agreements can be more nuanced than most service descriptions make them sound. So, whoever ends up on your shortlist, evaluate them on these five things in writing first:
Who drafts the agreement, and whether that cost is included. Legal time is where escrow budgets overrun, so confirm whether drafting sits inside the fee you were quoted or arrives separately from external counsel.
Which party structures they support. A bipartite agreement between you and your counterpart behaves differently from a tripartite one with the agent named as a party, and a multi-beneficiary agreement is what you need when several entities in a group rely on the same software.
Who executes a release, how quickly, and at what cost. Ask for all three answers now, so you'll know what to expect in a crisis.
How often deposits update. Press for a number, not a policy.
Whether a source code deposit is enough. If the software reaches you as a hosted service, source code alone will not get you running without the deployment configuration, databases, dependencies, and credentials around it.
With Codekeeper, you can initiate bipartite, tripartite, and multi-beneficiary agreements from proven templates directly in your dashboard, or have our in-house legal team draft custom terms for a specific jurisdiction, an unusual release trigger, or a liability position your procurement team requires.
Custom drafting typically takes one to three days, often inside 24 hours, and it is included in your setup fee rather than billed as external counsel. You can also read what you are signing before you commit, since we publish sample agreements for common use cases alongside an annotated version explaining what each clause does.
» Take a look at Codekeeper's sample software escrow agreements.
Holding a deposit and proving that deposit will work when you need to recover are two separate issues. Make sure you choose a provider that offers verification services:
| Verification tier | Price | What it proves |
| Validated | Free | An automated inventory confirms the expected source code, deployment configurations, credentials, and provider details are present, encrypted, and accessible in the vault. |
| Verified | From $29/month | Everything in Validated, plus continuous monitoring of deposit integrity and development activity, file integrity checks, and login verification, with monthly reports in your dashboard. |
| Certified | From $329/month | Everything in Verified, plus technical experts running a complete build and deployment in a clean environment to prove the software can be rebuilt, with an annual expert review. |
Every tier issues a Software Resilience Certificate, a dated record you can put in front of an auditor, a regulator, or a client as evidence toward ISO 27001, DORA, NIS2, and CPS 230 requirements.
Be sure to ask anyone on your shortlist what documentation you receive when a verification finishes. An internal report addressed to you is different from a certificate you can hand to somebody else.
» Find the verification option that matches your compliance requirements.
Choosing an escrow provider comes down to how much you want to see and control before you commit. Traditional providers run one way: you contact the team, they scope the arrangement, and the price follows. That suits buyers who want to be walked through it.
Codekeeper gives you the alternative. You can:
Connect your escrow to the platforms your team already builds in with more than 50 supported integrations, including GitHub, GitLab, Bitbucket, Azure DevOps, AWS, Azure, and Google Cloud, and let daily syncs keep your deposits in step with production.
Start verification free, then move up to monitored integrity checks or full expert build testing when a regulator or client asks for more.
Give both the depositor and the beneficiary the same dashboard, with the same agreement overview, verification status, and certificates.
Set up standard agreements yourself in minutes, or have our in-house legal team draft bespoke terms inside your setup fee.
See your total cost before you speak to anyone, and adjust it later with add-ons instead of a new negotiation.
If you are mid-contract elsewhere, we run a switching offer and can handle the technical and legal side of the move for you.
» See how Codekeeper compares with Escode, the provider administering the former Iron Mountain escrow agreements today.
Whoever you choose to sign with will hold the keys to your recovery ability in times of crisis. Make sure you choose a transparent partner that allows you the control you need for peace of mind.
Codekeeper was built on that principle. Your software escrow deposit grows with you through the years, offering greater protection extensions if and when you need them.
That's modern software resilience.
» Ready to protect your critical software? Explore the Codekeeper platform or schedule a call with our escrow specialists.