Your retention period is longer than your vendor's life expectancy
By Dylan Wolpe
The short version
- A seven-year retention obligation will outlive many of the vendors contracted to serve it. If verifying your archive requires their console, the guarantee expires with the contract.
- Escrow is the traditional answer and is weaker than it appears: it delivers source code, not a working build, a maintainer, or a dependency set that still resolves.
- The durable arrangement is a published format plus an independent verifier under a permissive licence, so verification works offline with no relationship to the vendor.
- The test is simple: ask whether verification works with the vendor's servers switched off. Anything else is a guarantee with a commercial dependency.
Financial records: seven years. Medical records: often decades. Some regulatory archives are effectively permanent. Now consider how many of the software vendors you contracted with a decade ago still exist under the same name, with the same product, honouring the same terms.
This mismatch is structural and almost never appears in an evaluation. Buyers assess features, price, security posture and support. Very few ask what the archive is worth after the supplier is gone, which is the state it will spend a large fraction of its required life in.
Three ways it ends, none of them dramatic
- Acquisition. The product is absorbed, the old format is deprecated, and migration is offered on a timetable that is not yours.
- Pivot. The company still exists and no longer sells this. The service runs in maintenance mode until it quietly does not.
- Closure.Ninety days’ notice to export. You get your files. Whether you can still prove anything about them is a separate question, and it is the one that matters.
In all three you usually keep the bytes. What you lose is the ability to demonstrate they are the original bytes, because that capability lived in the vendor’s system.
Getting your data back is not the hard part. Getting back the ability to prove things about it is.
Why escrow is weaker than it sounds
Source escrow is the conventional mitigation and it addresses the wrong layer. On release you receive a source tree. To turn that into verification you need a build environment that still works, dependencies that still resolve, a platform the code still targets, and an engineer willing to learn an abandoned codebase, several years after anyone last touched it.
It is not worthless. It is a contractual comfort that requires a project to convert into a capability, at exactly the moment nobody has budget for that project.
| Arrangement | What you hold | What it costs later |
|---|---|---|
| Vendor-only verification | Files | Verification is simply gone |
| Source escrow | A source tree | A build-and-maintain project |
| Published format + open verifier | A working verifier and a spec | Nothing |
What actually survives
Two properties, and they are unglamorous:
A published format. Written down in enough detail that a competent engineer could implement a reader without asking anyone. Not a marketing overview, a specification.
An independently licensed verifier. A tool under a permissive licence that runs offline, checks an archive, and reports what it finds. If it requires an account, a licence key, or a call home, it does not survive the vendor and neither does your guarantee.
Together these mean the archive’s value is a property of the archive rather than of a commercial relationship. It is the same reasoning that makes long-lived records worth keeping in documented formats generally, applied to verification instead of readability.
The one-question test
“Does verification work with your servers switched off?”
Then ask for a demonstration. Disconnect, verify an archive, show the output. A vendor whose format is genuinely open does this in minutes and rather enjoys it. A vendor who needs to schedule a follow-up call has told you the answer.
Questions people ask about this
What happens to my archives if the vendor goes out of business?
It depends entirely on whether reading and verifying the archive requires their systems. If the format is published and the verifier is independently licensed, nothing happens, the archives keep working. If verification runs through their API or console, you retain files you can no longer prove anything about.
Is source code escrow enough protection?
Rarely. Escrow releases source, which is not a running system: you still need a build environment, resolvable dependencies, and someone able to maintain it, often years later. It is better than nothing and considerably weaker than a published format with an already-working open verifier.
What should I ask a vendor about long-term access?
Whether verification works with their servers switched off. Then ask them to demonstrate it, disconnect, verify an archive, show the result. A vendor whose format is genuinely open can do this in minutes, and the demonstration is far more informative than any contractual clause.