European Union
Global standards
US
UK
Australia
Netherlands
Exit Exercise. Your exit plan, tested in practice.
Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and test the business functions you nominate. You get an Exit Exercise Report and Certificate for your file.
An add-on to any Codekeeper plan, from $12,000. Quoted at scoping. The customer or the vendor can request one.
- 10+ years securing software
- ISO/IEC 27001:2022 certified
Trusted by 3 500+ teams in over 150 countries, from regulated enterprises to fast-growing software vendors
Why an Exit Exercise
Without the vendor. Without the original developers.
An exit plan only holds if it works without the people you'd lose. An Exit Exercise puts that to the test: our specialists work from the deposit alone and check each business function you nominate.
Left out on purpose
- The vendor's engineersNot used
- The original developersNot used
- Know-how that was never written downNot used
What the exercise uses
- The depositThe only source
- Your data, brought backRestored
- Codekeeper specialistsRun the exercise
Claims Portal · deployed as scoped
Each business function you nominated, tested
Why test the exit
Written isn't the same as tested.
An exit plan says what you'd do if a critical supplier failed. Until someone tries it, every step in it is an assumption. Regulators now expect exit plans to be tested, and an Exit Exercise tests yours in practice.
"Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically."
For your fileAn Exit Exercise Report with an annex mapped to Article 28(8). DORA and Codekeeper
"Firms should take reasonable steps to test exit plans; in particular, those relating to stressed exits."
For your fileAn Exit Exercise Report with a framework annex, from an exit tested as if your vendor were gone. PRA SS2/21 and Codekeeper
An Exit Exercise gives you evidence that your exit plan has been tested. It doesn't make you compliant on its own: whether it meets a specific requirement is for you and your assessor to decide.
What we test
Rebuilt from your deposit, then put to work.
An Exit Exercise goes further than proving the software builds. Every step your exit plan takes for granted is tried for real, and the result is written down.
| Area | What the plan says | What the Exit Exercise does |
|---|---|---|
| The software | "We'd rebuild it from the escrow deposit." | Rebuilt using only what's in the deposit. Anything missing is recorded as a gap. |
| The people | "We wouldn't need the vendor." | Done by Codekeeper specialists, without the vendor or the people who wrote the software. |
| The data | "Our data comes back with it." | The data is brought back alongside the software, because without it your teams can't keep working. |
| The deployment | "We'd have it running for our users." | Deployed and running the way you'd need it in a real exit, sized for your application at scoping. |
| The business | "The business would keep working." | Each function you nominate is tested and recorded as pass or fail. |
| The gaps | Not known until the day you need it. | Every gap is written down, so the vendor can close it before a real exit. |
How it works
From scoping call to report on file.
- 1
Scope Both parties and Codekeeper
Tell us about the application, its data, and how it runs today. We confirm your technology stack is supported, agree with both parties on which functions to test and what the exercise needs to prove, and set the timeline.
- 2
Groundwork Codekeeper's AI agents
The agents study the deposit and work out how the software is built, in hours.
- 3
Clean-room rebuild Codekeeper specialists
Our specialists rebuild the software by hand in a clean room, using only what was deposited.
- 4
Data and deployment Codekeeper specialists
They bring back the data and deploy the software the way you'd need it in a real exit.
- 5
Function tests Codekeeper specialists
Each function you nominated is tested and marked pass or fail. Anything that stops the software from working is recorded as a gap.
- 6
Report and certificate For your file
You receive the Exit Exercise Report and the Exit Exercise Certificate: the result, the gaps, and the date, with an annex mapped to your framework.
The Exit Exercise film, 1 min 35 s. Captions show while the sound is off.
How Agentic Verification works →
Request an Exit Exercise
Start with a scoping call.
Tell us about the application and the framework you report against. We'll agree with you on what the exercise needs to prove, which functions to test, and the timeline.
Rather talk it through first? Book a demo
Request a scoping call
Request received.
We'll be in touch to arrange your scoping call.
What you put on file
The result, every gap, and the date.
Each Exit Exercise ends with an Exit Exercise Report and an Exit Exercise Certificate, plus an SBOM of the software as it was rebuilt.
The result and the date
One answer up front, dated, so a reviewer can see when your exit plan was last exercised.
How it was run
What the specialists started from and who did the work, so nobody has to take the method on trust.
Pass or fail, function by function
Every function you nominated at scoping, each with its own result.
Every gap
What was missing or stopped the software from working, so the vendor can fix it and you can run the exercise again.
An annex for your framework
The results mapped to the framework you report against, such as DORA Article 28(8), PRA SS2/21, or CPS 230.
Also in your file
Exit Exercise Certificate
A dated record of the exercise and its result, to keep next to your exit plan.
SBOM of the rebuilt software
A software bill of materials for the software as the specialists rebuilt it, also used for Cyber Resilience Act requests.
Pricing
Add it to any plan.
The Exit Exercise is an add-on, so you don't need to change plans to get one.
Add-on
Exit Exercise
From$12,000Quoted at scoping
The customer or the vendor can request one.
Request a scoping call| Plan | From | Agentic Verification | Exit Exercise |
|---|---|---|---|
| Escrow | $199 | Not included | Add-on |
| Escrow Pro | $449 | Included | Add-on |
| Resilience | $399 | Not included | Add-on |
| Resilience Pro | $649 | Included | Add-on |
| Continuity | $1,449 | Not included | Add-on |
| Continuity Pro | $1,699 | Included | Add-on |
Starting prices are for software applications. Agentic Verification runs up to four times a year, on supported technology stacks. See all prices
Frequently asked questions
Before you book the scoping call.
Timing, independence, the evidence, and how it fits your plan.
More answers in the FAQ →The exercise
How long does an Exit Exercise take?
An Exit Exercise takes as long as the application and its data need. We agree on the timeline with you at scoping, before any work starts. If you have an audit or review date, tell us when you request the exercise and we'll plan around it.
Are the original developers involved?
No, the original developers aren't involved at any point. Codekeeper specialists rebuild and test the software from what was deposited, without the people who wrote it, as a real exit might require.
Which technology stacks can you rebuild?
We confirm which technology stacks we can rebuild for your application at scoping. Tell us what the application is built with when you request the exercise.
Is an Exit Exercise a recovery?
No, an Exit Exercise isn't a recovery. It tests your exit plan; it doesn't release the deposit or keep anything running. If a release condition is ever met, your plan handles the recovery. With Escrow, the deposit is released to you, and your team runs the recovery. With Resilience, the deposit comes to Codekeeper, and Codekeeper's engineers run it. Continuity also keeps the live environment paid and switched on for an agreed period, bills recharged at cost.
The evidence
What's in the Exit Exercise Report?
The Exit Exercise Report contains the result of the exercise, a pass or fail for each function tested, every gap found, and the date. It comes with an Exit Exercise Certificate, an SBOM of the rebuilt software, and an annex mapping the results to the framework you report against, such as DORA Article 28(8), PRA SS2/21, or CPS 230.
What happens if the Exit Exercise fails?
If the Exit Exercise fails, you still receive the full report, showing what stopped the software from working and why. Every gap is recorded so the software vendor can fix it, and you can run the exercise again once the gaps are closed.
Does an Exit Exercise make us compliant?
An Exit Exercise doesn't make you compliant on its own. It gives you a dated record that your exit plan has been tested, which you can use as evidence toward DORA Article 28(8) and PRA SS2/21. Whether it meets a specific requirement is for you and your assessor to decide.
Plans and pricing
Who can request an Exit Exercise?
The customer who relies on the software or the vendor who supplies it can request an Exit Exercise.
Do we need a Pro plan?
No, you don't need a Pro plan to add an Exit Exercise. You can add one to any Codekeeper plan, from Escrow through to Continuity Pro.
How is an Exit Exercise priced?
Each Exit Exercise is quoted at scoping, from $12,000. It's an add-on, so your plan stays as it is.
How is it different from Agentic Verification?
An Exit Exercise and Agentic Verification test different things. Agentic Verification shows the deposit builds: Codekeeper's AI agents rebuild it in the sealed Codekeeper AI Verification Lab, up to four times a year on Pro plans, on supported technology stacks. An Exit Exercise shows the whole exit works: our specialists rebuild the software by hand, bring back the data, deploy it, and test each function you nominate. See how Agentic Verification works, or compare them side by side.
Your exit plan, tested in practice.
Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and test the business functions you nominate.