CloudSecure®

With Software Escrow and SaaS Escrow it is about safeguarding source code and data. With CloudSecure it is about something fundamentally different: the continuity of the entire cloud service. Through a legal structure, that service keeps running, also if the supplier goes bankrupt, as long as beneficiaries pay their licence. How CloudSecure compares to traditional cloud escrow is set out in the comparison.

Why source code alone is no longer enough

As more applications become deeply intertwined with cloud platform services that are not interchangeable with other environments, think of platform-specific managed databases, container orchestration or serverless functions, source code as the sole artefact loses its value for continuity. The application no longer runs on its own: it is inseparably tied to the infrastructure on which it is built. In such situations SaaS Escrow falls short. CloudSecure is designed for exactly that reality.

CloudSecure from Softcrow is more than a storage deposit. Within the arrangement there is indeed an underlying source code deposit. Around it, Softcrow puts a legal structure that secures the entire cloud service. The intellectual property, the hosting contracts and the user licences are placed in separate legal entities. This way, the damage in a bankruptcy stays limited to the entity that goes bankrupt. With this structure the service keeps running as long as beneficiaries pay their licence. Not a temporary bridge, but structural continuity. This calls for changes in the supplier’s business. Softcrow guides this process from start to finish.

Suited to large data volumes and vendor dependency

The structure secures the entire operational cloud service itself: the software stays operational and falls, together with the data it contains, fully within the coverage. The customer data therefore does not have to be placed in a separate deposit, but it can be. That makes CloudSecure efficient for large, complex applications with a lot of data, where a full data deposit would be costly or impractical.

CloudSecure is well suited precisely to applications that are not built with universal techniques, but lean heavily on vendor-specific cloud services and SaaS components. Think of solutions that are deeply intertwined with the proprietary services of a cloud vendor such as Azure, AWS or Google Cloud. Because the entire running service falls within the coverage, that dependency poses no risk to continuity.

Why other approaches fall short

Competitors mostly offer a temporary solution under the name ‘Cloud Escrow’, based on prepayment. The escrow agent then takes over the contracts with the hosting provider itself, for a limited period. In a bankruptcy it is moreover not up to the parties involved but solely up to the trustee to decide on those contracts. These shortcomings are genuinely solved by the CloudSecure structure.

An approach that is sometimes presented as an alternative is storing login credentials for a cloud account in a deposit. On release the beneficiary then gets access to the supplier’s cloud infrastructure. This seems practical, but lacks a legal basis. A cloud account is an asset of the supplier. In a bankruptcy that account falls into the bankruptcy estate. The trustee is not obliged to honour the ongoing obligations of the estate. Whether the beneficiary gets access, and under which conditions, then depends on the cooperation of the trustee. The beneficiary has no entitlement to that.

With CloudSecure that does not arise: the intellectual property, the hosting contracts and the user agreements already sit outside the bankruptcy estate from the outset, so in a bankruptcy it is immediately clear to the trustee what does and does not belong to the estate.

Softcrow applies CloudSecure to itself

The entire operational environment of Softcrow Trusted Electronic Services B.V. is placed in a CloudSecure arrangement with Stichting Softcrow Continuïteit Services as holder. Should the company ever fall away, the Foundation continues the service uninterrupted.

Need coverage for a cloud service quickly? CloudSecure requires a corporate structure that takes time to set up, depending on your current company structure. If assurance is needed quickly, in practice we often start with a SaaS Escrow. That is operational within days to weeks. Once the CloudSecure agreement and the legal structure are ready, the CloudSecure agreement is signed, retaining the deposits already built up.

For the beneficiary: the user of the cloud service

The cloud service you rely on stays available. Also if the supplier goes bankrupt.

CloudSecure ensures that a bankruptcy of the supplier has no impact on the continuity of the service you use. Not arranged after the fact, but legally anchored before it is needed.

Key features

  • The cloud service keeps running, also if the supplier goes bankrupt
  • The intellectual property, the hosting contracts and your user agreement are legally protected outside the bankruptcy estate
  • Based on Dutch law, an existing legal structure that Softcrow applies in a unique way and that is offered nowhere else in this form
  • Underlying source code and data deposits run on Softcrow’s sovereign storage: hosted entirely within the EU, free from the CLOUD and USA PATRIOT Act
  • A demonstrable part of IT risk management, relevant for compliance frameworks such as DORA, NIS2 and ISO 22301
  • Insight via the Softcrow Dashboard, including the status of the deposits and agreements

For the supplier: the SaaS or cloud provider

Show that your service keeps running, whatever happens. That is a competitive advantage.

CloudSecure guides you as a supplier in setting up a legal structure that offers your customers maximum continuity assurance. That requires an investment in time and structure, but yields demonstrable trust.

CloudSecure calls for full commitment from the supplier. It is a strategic choice, not an administrative task. Raise it early in the conversation with your customer, well before contracts are signed and architecture choices are fixed.

Key features

  • Softcrow guides the entire implementation: from legal structure to technical set-up
  • Implementation in two phases: SaaS Escrow as the starting point, CloudSecure as the end result; Softcrow guides every step
  • Dedicated legal and technical expertise, every conversation with the right specialist
  • Available solely as a collective scheme; the whole organisation of the supplier is set up for it
  • A demonstrable part of IT risk management, usable as a compliance measure for DORA, NIS2, ISO 22301 and more

Curious which steps are needed to make the legal structure of your company suitable for CloudSecure? Get in touch, and we will go over it with you by phone.

Get in touch →