European Union
Global standards
US
UK
Australia
Netherlands
Exit Exercise. Your exit plan, tested in practice.
Working only from the deposit, with no vendor or original developers involved, our specialists recover your software, restore its data, deploy it, and test the business functions you choose. An Exit Exercise Report and Certificate then go on your file.
An add-on to any Codekeeper plan, from $12,000. Quoted at scoping. The customer or the vendor can request one.
- Securing software for 10+ years
- ISO/IEC 27001:2022 certified
Relied on by 3 500+ teams across more than 150 countries, from regulated enterprises to software vendors growing at pace
Why an Exit Exercise
Without the vendor. Without the original developers.
An exit plan only stands up if it works without the people you'd lose. An Exit Exercise tests exactly that, with our specialists working from the deposit alone and checking every business function you choose.
Left out on purpose
- The vendor's engineersNot used
- The original developersNot used
- Know-how that was never written downNot used
What the exercise uses
- The depositThe only source
- Your data, brought backRestored
- Codekeeper specialistsRun the exercise
Claims Portal · deployed to scope
Every business function you chose, tested
Why test the exit
A written plan isn't a tested one.
An exit plan sets out what you'd do should a critical supplier fail, yet each step remains an assumption until someone tries it. Regulators now expect exit plans to be tested, and an Exit Exercise puts yours through a real test.
“Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically.”
For your fileAn Exit Exercise Report with an annex mapped to Article 28(8). DORA and Codekeeper
“Firms should take reasonable steps to test exit plans; in particular, those relating to stressed exits.”
For your fileAn Exit Exercise Report with a framework annex, from an exit tested as if your vendor were gone. PRA SS2/21 and Codekeeper
An Exit Exercise provides evidence that your exit plan has been tested, though it won't make you compliant by itself, and you and your assessor decide whether it meets a given requirement.
What we test
The deposit rebuilt, then made to do real work.
An Exit Exercise does more than show the software builds. It tries out every step your exit plan assumes, for real, and records the outcome.
| Area | What the plan says | What the Exit Exercise does |
|---|---|---|
| The software | “We'd rebuild it from the escrow deposit.” | Rebuilt solely from the deposit's contents, with anything missing logged as a gap. |
| The people | “We wouldn't need the vendor.” | Carried out by Codekeeper specialists, with no vendor and none of the people who wrote the software. |
| The data | “Our data comes back with it.” | The data is restored together with the software, since your teams can't carry on working without it. |
| The deployment | “We'd have it running for our users.” | Deployed and running just as a real exit would require, sized for your application during scoping. |
| The business | “The business would keep working.” | Every function you choose is tested and marked as a pass or fail. |
| The gaps | Unknown until the day you need it. | Each gap is recorded, so the vendor can close it ahead of a real exit. |
How it works
Scoping call first, report on file last.
- 1
Scope Both parties and Codekeeper
Tell us about the application, its data, and how it runs today. We confirm your technology stack is supported, agree with both parties which functions to test and what the exercise needs to prove, and set the timeline.
- 2
Groundwork Codekeeper's AI agents
Within hours, the agents examine the deposit and figure out how the software is built.
- 3
Clean-room rebuild Codekeeper specialists
Working by hand in a clean room, our specialists rebuild the software from the deposit's contents alone.
- 4
Data and deployment Codekeeper specialists
Next, they restore the data and deploy the software just as a real exit would require.
- 5
Function tests Codekeeper specialists
Each function you nominated is tested and marked pass or fail. Anything that stops the software working is recorded as a gap.
- 6
Report and certificate For your file
The Exit Exercise Report and Exit Exercise Certificate come to you, setting out the result, the gaps, and the date, along with an annex mapped to your framework.
The Exit Exercise film, 1 min 35 s. Captions appear while the sound is off.
How Agentic Verification works →
Request an Exit Exercise
Your first step is a scoping call.
Tell us about the application and the framework you report against. We'll agree with you what the exercise needs to prove, which functions to test, and the timeline.
Prefer to discuss it first? Book a demo
Request a scoping call
Request received.
We'll be in touch to arrange your scoping call.
What you put on file
The outcome, each gap, and the date.
You come away from every Exit Exercise with its Report and Certificate, plus an SBOM of the software in its rebuilt form.
The outcome and the date
A single dated answer at the top, showing a reviewer when your exit plan was last put into practice.
How it was carried out
The specialists' starting point and who did the work, leaving no method to take on trust.
A pass or fail for each function
Each function you chose during scoping, with its own result.
Every gap
What was missing or stopped the software working, so the vendor can fix it and you can run the exercise again.
A framework annex
Results mapped to the framework you report against, such as PRA SS2/21, DORA Article 28(8), or CPS 230.
Also on your file
Exit Exercise Certificate
A dated record of the exercise and its outcome, to keep alongside your exit plan.
SBOM of the rebuilt software
A software bill of materials covering the software as the specialists rebuilt it, which also serves Cyber Resilience Act requests.
Pricing
Add it to whichever plan you have.
You can keep your current plan, since the Exit Exercise sits on top as an add-on.
Add-on
Exit Exercise
From$12,000Quoted during scoping
Either the customer or the vendor can request one.
Request a scoping call| Plan | From | Agentic Verification | Exit Exercise |
|---|---|---|---|
| Escrow | $189 | Not included | Add-on |
| Escrow Pro | $419 | Included | Add-on |
| Resilience | $369 | Not included | Add-on |
| Resilience Pro | $599 | Included | Add-on |
| Continuity | $1,339 | Not included | Add-on |
| Continuity Pro | $1,569 | Included | Add-on |
From prices are for software applications. Agentic Verification runs up to four times a year, on supported technology stacks. See all prices
Frequently asked questions
What to know ahead of your scoping call.
We cover timing, independence, evidence, and the fit with your plan.
More answers in the FAQ →The exercise
What's the timeline for an Exit Exercise?
An Exit Exercise takes as long as the application and its data need. We agree the timeline with you at scoping, before any work starts. If you have an audit or review date, tell us when you request the exercise and we'll plan around it.
Do the original developers take part?
No, the original developers don't take part at any stage. Our specialists work only from the deposit, without the people who wrote the software, the way a real exit might force them to.
What technology stacks do you support for an Exit Exercise?
The technology stacks we support for an Exit Exercise are confirmed for your application during scoping, so let us know what it's built with when you request one.
Does an Exit Exercise recover anything?
No, an Exit Exercise doesn't recover anything. It tests your exit plan without releasing the deposit or keeping anything running, and if a release condition ever applies, your plan takes care of the recovery. Under Escrow, the deposit is released to you and your team handles the recovery; under Resilience, it's released to Codekeeper and our engineers handle it. Continuity also pays for the live environment and keeps it running for an agreed period, recharging the bills at cost.
The evidence
What does the Exit Exercise Report include?
The Exit Exercise Report includes the exercise's outcome, a pass or fail for every function tested, each gap found, and the date. It arrives with an Exit Exercise Certificate, an SBOM of the rebuilt software, and an annex mapping the results to your framework, such as PRA SS2/21, DORA Article 28(8), or CPS 230.
What if the Exit Exercise doesn't pass?
If the Exit Exercise fails, you still receive the full report, showing what stopped the software working and why. Every gap is recorded so the software vendor can fix it, and you can run the exercise again once the gaps are closed.
Is an Exit Exercise enough for compliance?
No, an Exit Exercise isn't enough for compliance by itself. It provides a dated record that your exit plan has been tested, which you can use as evidence towards PRA SS2/21 and DORA Article 28(8), and you and your assessor decide whether it meets a particular requirement.
Plans and pricing
Which parties can arrange an Exit Exercise?
The parties who can arrange an Exit Exercise are the customer relying on the software and the vendor supplying it.
Is a Pro plan required?
No, a Pro plan isn't required to add an Exit Exercise, which can be added to any Codekeeper plan from Escrow up to Continuity Pro.
What does an Exit Exercise cost?
An Exit Exercise costs from $12,000, with each one quoted during scoping, and as an add-on it leaves your plan unchanged.
What separates it from Agentic Verification?
What separates an Exit Exercise from Agentic Verification is what each tests. Agentic Verification shows the deposit builds, with Codekeeper's AI agents rebuilding it in the sealed Codekeeper AI Verification Lab as many as four times a year on Pro plans, on supported technology stacks. An Exit Exercise shows the entire exit works, with our specialists rebuilding the software by hand, restoring the data, deploying it, and testing every function you choose. See how Agentic Verification works, or compare them side by side.
Your exit plan, tested in practice.
Book a scoping call, and our specialists will plan an exercise around the business functions you can't do without.