European Union
Global standards
US
UK
Australia
Netherlands
Software verification. Three levels of proof you could recover.
Someone will ask what happens if this software stops. Software verification gets the answer ready at three levels: a deposit checked every month, a rebuild that passed, and an exit tested in practice.
- ISO/IEC 27001:2022 certified
- 10+ years securing software
Trusted by 3 500+ teams in over 150 countries, from regulated enterprises to fast-growing software vendors
Start with your question
Could you recover? Now you can prove it.
Storing the code is step one. Knowing it builds is step two. Each level goes further than the last.
-
Level 1 · Deposit checks
Is our deposit there and current?
An automated check documents each month which agreed materials are in the vault, and a daily sync keeps the deposit current.
What you get
- A Vault Certificate
- A Vault Report every month
- An Escrow, Resilience, or Continuity Certificate
- Daily sync through 50+ integrations
Comes with
Every plan
All eight, Software Backup included.
-
Level 2 · Agentic Verification
Does our deposit build?
Codekeeper's AI agents rebuild your deposit in the sealed Codekeeper AI Verification Lab and flag anything missing. You start each run whenever you choose.
What you get
- A Recoverability Certificate for every passed run
- A Rebuild Report for every run
- A software bill of materials (SBOM) in CycloneDX
- An exit workbook and a tested isolated compile
Comes with
Pro plans
Escrow Pro, Resilience Pro, Continuity Pro, and Software Backup Pro. Up to four runs a year, on supported technology stacks.
-
Level 3 · Exit Exercise
Could we exit and keep working?
Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and then test the business functions you nominate.
What you get
- An Exit Exercise Certificate
- An Exit Exercise Report, with a pass or fail per function and every gap
- An annex mapped to your framework, such as DORA
- An SBOM of the rebuilt software
Comes with
Add to any plan
An add-on to any of the eight plans. The customer or the vendor can request one.
Sample evidence pack
See what a passed rebuild puts on file.
An illustrative pack for one application, with example values, laid out the way a client receives it.
- Recoverability Certificate
- Rebuild Report
- Framework references
Regulation
Regulators expect your plans to be tested.
For firms that rely on third-party software, regulators expect exit plans to be tested, not just written. For manufacturers, the Cyber Resilience Act asks for the components in their products to be documented, including in an SBOM.
DORA
More on DORA"Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically."
Related evidence
Level 3: Exit Exercise Report, with a DORA annex
Level 2: Recoverability Certificate
PRA SS2/21
More on PRA SS2/21"Firms should take reasonable steps to test exit plans; in particular, those relating to stressed exits."
Related evidence
- Level 3: Exit Exercise Report, with a framework annex
- Level 2: Recoverability Certificate
Cyber Resilience Act
More on CRA and SBOMs"… market surveillance authorities may request manufacturers of such categories of products with digital elements to provide the relevant software bills of materials as referred to in Part II, point (1), of Annex I."
Related evidence
- Level 2: An SBOM from every passed rebuild
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Read more on ISO 27001, ISO 22301, SOC 2, and CPS 230, or see all compliance solutions.
Side by side
Different questions, different evidence.
| 1Deposit checksIs our deposit there and current? | 2Agentic VerificationDoes our deposit build? | 3Exit ExerciseCould we exit and keep working? | |
|---|---|---|---|
| What's tested | Which agreed materials are in the vault, and that they're current | That the software builds from the deposit, with anything missing flagged | That it can be rebuilt from the deposit alone and runs the business functions you nominate |
| Who does it | An automated check | Codekeeper's AI agents, in the Codekeeper AI Verification Lab. The vendor steps in only if the deposit falls short. | Codekeeper specialists, in a clean room |
| Who starts it | It runs automatically | You, from your account, whenever you choose | The customer or the vendor, on request |
| How often | Every month | Up to four times a year, on supported technology stacks | Typically once a year, or whenever your exit plan needs testing |
| Time to evidence | A Vault Report each month | Hours from the start of a run | A timeline agreed with you at scoping |
| Evidence | Vault Report, Vault Certificate, and your plan's certificate | Recoverability Certificate, Rebuild Report, and SBOM | Exit Exercise Certificate, Exit Exercise Report, and SBOM, with an annex mapped to your framework |
| Comes with | Every plan | Escrow Pro, Resilience Pro, Continuity Pro, and Software Backup Pro | Any plan, as an add-on |
Not sure your stack is supported? Take the free technical assessment: tell us how your application is built, and our escrow engineers will recommend what to deposit and which verification level you need.
Know you could recover before you need to.
See how verification runs on your own applications, or start with the evidence in the sample pack.
Frequently asked questions
Choosing between the three levels.
What is software escrow verification?
Software escrow verification is a check of whether the source code and other materials held in escrow are complete and can be rebuilt into working software. Codekeeper runs it at three levels: a monthly automated check on every plan, Agentic Verification on Pro plans, and the Exit Exercise as an add-on, which shows you could recover the software and keep working.
Which verification solution do we need?
The verification solution you need depends on your question. To know the deposit is there and current, every plan checks it each month. To know it builds, choose a Pro plan with Agentic Verification. To show your exit plan works in practice, for example for DORA or PRA SS2/21, add an Exit Exercise.
What verification comes with every plan?
Every plan comes with a monthly automated check of the deposit, with a Vault Report and a Vault Certificate, plus an Escrow, Resilience, or Continuity Certificate that shows the agreement is in place. A daily sync keeps the deposit current between checks.
Can we combine the verification solutions?
Yes, you can combine the verification solutions. Every plan includes the deposit checks, Pro plans add Agentic Verification, and you can add an Exit Exercise to any plan, Pro plans included. On a Pro plan, the Exit Exercise then starts from a deposit you already know builds.
Does Agentic Verification replace an Exit Exercise?
No, Agentic Verification doesn't replace an Exit Exercise. A rebuild shows the deposit builds. In an Exit Exercise, our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and also test the business functions you nominate. The two give you different evidence.
Do we need a Pro plan for an Exit Exercise?
No, you don't need a Pro plan for an Exit Exercise. You can add one to any Codekeeper plan: Escrow, Escrow Pro, Resilience, Resilience Pro, Continuity, Continuity Pro, Software Backup, or Software Backup Pro.
Which verification do we need for DORA or PRA SS2/21?
The verification to start with for DORA or PRA SS2/21 is an Exit Exercise: both expect exit plans to be tested, and an Exit Exercise tests yours in practice. Its report comes with an annex mapped to the framework you report against. A Recoverability Certificate from Agentic Verification adds a record that the deposit builds. Whether the evidence meets a specific requirement is for you and your assessor to decide.
Which verification gives us an SBOM?
Agentic Verification and the Exit Exercise both give you an SBOM. Every passed rebuild comes with a fresh SBOM in CycloneDX, so your list of components keeps pace with your releases, and each Exit Exercise adds an SBOM of the software as our specialists rebuilt it. More on the software bill of materials.
What is a Recoverability Certificate?
A Recoverability Certificate is a record that a rebuild of your deposit passed in the Codekeeper AI Verification Lab, issued with that run's Rebuild Report, SBOM, exit workbook, and tested isolated compile. It documents the rebuild and its result. It doesn't grant release rights; those come from your agreement.