UJ Leads with Software Escrow

A leading South African university, with over 50,000 enrolled students, operates in a digitally driven learning environment, requiring continuous uptime of its learning management systems. The university selected Moodle as its new LMS platform in 2023 and deployed it via AWS cloud infrastructure using Terraform automation, through a third-party service provider.

The institution is widely recognised for its innovation in blended learning and digital teaching strategy, and strongly emphasises risk mitigation and legal compliance.

Soon after appointing the external service provider, the university’s Office of General Counsel raised a red flag: What happens if the provider fails or disappears? Despite using open-source software, the risk was not the product, but the infrastructure code (Terraform), AWS configuration, and lack of internal cloud skills to take over hosting.

In early 2024, the risk materialised. The service provider faced financial distress and entered business rescue. This left the university at risk of losing access to the team running their AWS-hosted Moodle platform. Adding to the challenge, the internal IT team had limited experience with AWS and Terraform, as the university was primarily a Microsoft Azure environment.

The university needed a fast, legally robust, and technically verified solution to protect access to its digital teaching platform.

The university partnered with ESCROWSURE to establish a tripartite software escrow agreement between the institution, the service provider, and ESCROWSURE. The escrow deposit included:

• • Full Terraform provisioning scripts

  • AWS deployment configurations

  • Data environment setup details

ESCROWSURE executed a full verification of the deposit, uncovering a critical gap: the code had been submitted without technical documentation. This would have made it difficult to use in a disaster recovery scenario.

ESCROWSURE alerted the university and the vendor, intervening to secure the necessary materials and complete the deposit. This step was essential in converting a basic deposit into a business continuity asset.

Although the university did not have to trigger a release, the presence of a fully verified escrow arrangement gave them the confidence to:

• Take over the AWS contract directly to avoid service suspension

• Contract an independent Moodle specialist to support operations

• Terminate the vendor relationship safely by June 2024

The institution has since committed to expanding its use of software escrow with Escrowsure across other strategic systems, including SAPPS and internal academic management software, guided by a security-conscious new CIO.

The case also highlighted a broader risk awareness: without documentation and verification, source code in escrow is not enough. Escrowsure’s role was pivotal in identifying this and correcting it in time.