A Sydney B2B SaaS founder — 22 people, Series A closed in April, ARR clearing $6 million — receives a redlined master services agreement back from the procurement team at a top-four Australian bank. Buried in schedule 4 is an instruction to execute a tri-partite source code escrow deed with Escode, verification tier “compile and run,” fees at the depositor’s cost, deposit updated quarterly, release on any insolvency event affecting the licensor. The founder’s CTO forwards the schedule with a one-line note: “Isn’t this a 90s thing?” The founder signs it on the assumption that it is a $2,000-a-year annuity paid to an escrow agent, unread by anyone, released only in a bankruptcy that will never happen. What is actually being signed is a Corporations Act instrument that turns on the escrow carve-out in regulation 5.3A.50 of the Corporations Regulations 2001 (Cth), a PPSA question about who has a security interest in the deposited materials, a Copyright Act 1968 licensing question about what the bank can actually do with the code on release day, and — for a cloud-native product — a continuity commitment that the source tree alone will never deliver.
That is the ordinary shape of the software escrow conversation for an Australian startup selling into enterprise, financial services or government in 2026. Founders treat escrow as a procurement checkbox. Procurement treats it as a genuine risk control. Both sides tend to be wrong about what the deed actually does. Here is what it is, how the Treasury Laws Amendment (2017 Enterprise Incentives No. 2) Act 2017 changed the analysis in 2018, and how founders should think about the ask.
The Framework — What a Software Escrow Deed Actually Is
A software escrow deed is a tri-partite deed between three parties: the depositor (the licensor, i.e. the startup), the beneficiary (the enterprise licensee), and the escrow agent — in Australia now dominated by Escode (the NCC Group business created out of the 2021 acquisition of Iron Mountain’s IPM division), with Harbinger Escrow, The Escrow Company, Praxis Technology Escrow, Codekeeper and a handful of specialists competing beneath. The depositor lodges deposit materials — source code, build scripts, documentation, third-party dependency lists, keys — with the agent, updated on a schedule. The agent verifies integrity, and in higher-tier engagements actually compiles and runs the code. The materials are released to the beneficiary only on the occurrence of a defined release event.
Fees vary sharply by tier. Single-beneficiary annual retainers run A$1,400 to A$6,000 across the Australian market. Setup is a further A$500–A$2,000. Verification tests range from a basic file-existence audit at A$2,750 up to A$25,000-plus for a full build-and-deploy. SaaS-continuity packages — deposit of infrastructure-as-code, container images, deployment credentials and data snapshots — sit materially higher. Fee allocation is negotiable; the enterprise beneficiary should pay, and the well-advised startup insists on it.
The Ipso Facto Stay — Why the 1 July 2018 Reforms Matter
The single most important legal development for escrow deeds is one most founders have never heard of. The Treasury Laws Amendment (2017 Enterprise Incentives No. 2) Act 2017 (Cth) inserted three parallel ipso facto stays into the Corporations Act 2001 (Cth) — section 415D (schemes of arrangement under Part 5.1), section 434J (receivership under Part 5.2) and section 451E (voluntary administration under Part 5.3A). Each stays the enforcement of contractual rights the enforcement of which is triggered by reason of the counterparty entering the relevant procedure, or by the counterparty’s financial condition while under it. The reforms commenced 1 July 2018 and apply to contracts entered on or after that date.
The startup implication is direct. A release trigger in an escrow deed tied to “the appointment of an administrator” looks — on its face — exactly like the sort of ipso facto right the stay is designed to catch. If the stay applied, the beneficiary could not enforce the release against the depositor’s administrators, and the escrow would be neutered at the precise moment it exists to operate.
Parliament pre-empted the problem. The Corporations Amendment (Stay on Enforcing Certain Rights) Regulations 2018 (Cth) (F2018L00835), also commencing 1 July 2018, inserted regulation 5.3A.50 into the Corporations Regulations 2001, prescribing classes of rights to which the section 451E stay does not apply. Sub-paragraph (2) expressly carves out “an arrangement for the keeping of code or passwords for computer software, or material directly associated with such things, in escrow” — with “code” defined to include source and object code. Parallel provisions apply for sections 415D and 434J via the Corporations (Stay on Enforcing Certain Rights) Declaration 2018 (F2018L00919). The Explanatory Statement to the Regulations frames the carve-out on the basis that applying the stay would defeat the entire commercial purpose of an escrow. The Federal Court’s first decision on section 451E — Rathner, in the matter of Citius Property Pty Ltd (Administrator Appointed) [2023] FCA 26 — confirmed the general scope of the stay but did not disturb the carve-out.
The practical points for the depositor startup are two. First, an insolvency-triggered release in a stand-alone escrow deed is enforceable through voluntary administration. Second, an insolvency-triggered termination right in the underlying master licence — which is what founders often reach for as a substitute — remains caught by the stay. The escrow is the mechanism that survives the administration; the licence itself does not.
The Copyright and PPSA Layers Founders Forget
On release, the beneficiary needs an actual licence to reproduce, adapt and communicate the code — the escrow deed must grant it expressly, and it should be non-exclusive, non-transferable, internal-use-only, no right to sub-licence or distribute. Where drafting is thin, sections 47B and 47C of the Copyright Act 1968 (Cth) fill the smallest gaps — reproductions incidentally made in normal use of a lawfully acquired program (s 47B) and back-up copies (s 47C) — but neither underwrites the modification, redeployment or commercial exploitation the beneficiary will actually need to run the released code. Post-release licence terms are one of the two most negotiated clauses in the deed.
The second is the Personal Property Securities Act 2009 (Cth) treatment. A bailment of source code held by an escrow agent for contingent release to a beneficiary can, on the in-substance test, look like a security interest in intangible personal property. Belt-and-braces PPSR registration by the beneficiary is common in materially valuable escrows. Founders should expect the ask and negotiate the scope of the collateral description.
Release Triggers — The Standard Set, and Where to Push Back
Standard release triggers in Australian escrow deeds cover: insolvency (voluntary administration under Part 5.3A, receivership under Part 5.2, liquidation under Chapter 5, deregistration under section 601AA, schemes under Part 5.1); material breach of the master licence unremedied after written notice, typically 20 Business Days; cessation of maintenance or support for a defined period; discontinuation of the product or removal from general availability; and change of control to a competitor of the beneficiary. Change-of-control triggers are the ones founders should resist hardest — they convert the escrow from an insolvency-continuity tool into an M&A veto, and are the most likely to bite in a friendly acquisition scenario.
Ambiguity is the depositor’s enemy. Every trigger should be objectively verifiable by the escrow agent from a short list of documents — an ASIC search, a s 436A notice, a written termination or cure-period notice, a public product-retirement announcement. Triggers dependent on the beneficiary’s subjective assessment of “adequate support” invite disputes; well-advised Australian escrow agents will not administer them.
The SaaS Reality — Why Source Code Is the Least Useful Artefact
For a cloud-native SaaS, raw source code is rarely the artefact that keeps the beneficiary running. Real continuity requires infrastructure-as-code (Terraform, Pulumi, CloudFormation), CI/CD pipelines and secrets, runtime credentials for the production cloud accounts, container images and Kubernetes manifests, data schemas and snapshots, and workable substitutes for third-party API dependencies (Stripe, Auth0, OpenAI, Twilio) that will not transfer on release. Providers now sell tiered “SaaS Escrow” or “Managed Continuity” packages that attempt to cover this surface, at materially higher fees and with materially harder verification.
The honest answer to a procurement team asking for classical source code escrow on a SaaS product is often that it is closer to due-diligence theatre than a real disaster-recovery plan. Data portability commitments — regular customer-side export in a documented format, a committed migration-assistance obligation on termination, an agreed RTO and RPO — solve more of the actual business risk. Founders can and should propose the alternative. Sophisticated enterprise counterparties will accept the trade; box-ticking procurement teams will not, in which case the escrow is signed and the fees are budgeted.
What Founders Should Do
The negotiation sequence is discrete. First, ask what business risk the escrow is solving, and offer graduated alternatives before agreeing to a full tri-partite deed — architecture and runbook lodgment under NDA, data-portability commitments in the MSA, supervised on-site source-code viewing rights. Second, if a full deed is unavoidable, insist the beneficiary pays the escrow fees and negotiate a modest, capped verification tier. Third, draft release triggers as objectively verifiable events — Corporations Act notices, cure-period letters, product-retirement announcements — and resist change-of-control triggers. Fourth, negotiate a tight post-release licence — internal use only, no distribution, no sub-licence, no competition with the depositor. Fifth, quarantine the escrow deed from the master licence’s termination clauses so the ipso facto carve-out in regulation 5.3A.50 operates cleanly on an insolvency release. Sixth, for SaaS products, be candid about what the deposit actually delivers — and price the operational cost of keeping a genuine build-and-deploy artefact current, not just a Git snapshot.
The Bottom Line
Software escrow is not a 1990s vestige and it is not a paperwork exercise. It is a Corporations Act instrument enforceable against a depositor’s administrators only because Parliament carved it out of the ipso facto stay in 2018. It is a Copyright Act licence that will fail its purpose if the release grant is thin. It is a PPSA question the beneficiary should be registering. And for the modern SaaS startup, it is a continuity commitment the deposit will almost never fulfil on its own. Founders who treat the escrow deed as procurement paperwork sign into obligations they do not price, disclose materials they should not lodge, and give beneficiaries release rights broader than the risk warrants. Founders who treat it as one part of a business-continuity conversation — with data-portability, migration assistance and honest disaster-recovery commitments as the substance, and the escrow deed as the paper — close enterprise deals without spending their equity on a filing cabinet in Clarence Street.
Viridian Lawyers advises Australian startups on enterprise contracting, source code and SaaS escrow deeds, business-continuity negotiations with financial-services and government beneficiaries, and the Corporations Act ipso facto framework. If your startup is negotiating an escrow deed into an enterprise MSA — or being asked to accept one buried in a procurement schedule — get in touch.
