Business continuity policy

The position, stated first

Bracton Ltd has one director and no employees. It has no trading history and no live customers. A firm that puts its caseload into Bracton takes a supplier covenant risk that a firm on an established platform does not take, and no document changes that.

What this policy does is set out what the risk is, what the company has put in place against it, what it has not yet put in place, and what a firm should ask for before it signs. A policy that answered the question with reassurance would be worth nothing to the compliance officer reading it.

The test the plan is written against

The director is run over on a Monday evening. A firm has a hearing on Thursday and a limitation date the following week. What is true on Tuesday morning?

The first honest finding is that the system does not stop on Tuesday. Bracton is specified as a hosted service on managed infrastructure, with immutable backups, automated renewals and restores tested on a schedule. Nothing built to that specification needs a human hand on an ordinary day, and on Tuesday the platform serves requests as it did on Monday.

What ends the service is slower and duller. The bank learns of the death and freezes the account. The payment behind the hosting fails. An incident goes unanswered. The window in which the service degrades is measured in weeks rather than hours, which is the fact the whole plan is built on, because weeks are enough time for a named person to act.

So the question separates into two, and they have different answers. Can a firm lose its files? That is answerable now, in full. Can a firm lose the working system? That cannot be fully answered by a one person company telling the truth, so this policy bounds the damage instead and shows the working.

The protection with the most weight in it

A firm's matters, documents, correspondence and ledgers belong to the firm. Under the software agreement a firm takes a complete export of all of it at any time, without asking, at no charge, without giving a reason and without limit of number, in a usable and documented format, and the right survives any dispute, any suspension for non payment and termination for any reason. It runs throughout the agreement and for ninety days after it ends, and the firm's own administrator takes it without a support request.

That right has one structural weakness, and being straight about it is the point of this section. As drafted it is a right to pull. A right a firm has to remember to exercise produces, in most firms, a copy taken once during onboarding and never again. On the Tuesday morning that firm holds an export eleven months old and a contractual right against a company with nobody left to answer it. The right is real and the system will honour it for as long as it runs, and a right is not a copy.

So the platform is specified to deliver the export rather than wait to be asked for it. Every night it assembles each firm's complete export and delivers it to a destination the firm controls, its own server or its own cloud storage, switched on during onboarding as a default the firm has to turn off rather than a right it has to remember. Success or failure shows on the administrator's screen. A firm then holds, on its own hardware, at all times, a copy of every matter, document, letter, key date and ledger entry, current to the night before, in formats that open without Bracton. Word documents open in Word. Documents in portable format open anywhere. The ledgers travel with their schema.

Two qualifications keep this honest. An export nobody has ever opened is no protection at all, so the design asks a firm to confirm each quarter that somebody opened the latest delivery and found it readable, and records that confirmation where a compliance officer can point at it. And the copy protects the files, not the practice. A firm still loses its working system, its diary automation and its workflow, and moving to another supplier takes weeks and costs a migration. The nightly copy turns a catastrophe into an expensive inconvenience. It does not turn it into nothing, and the sales conversation will not pretend otherwise.

The nightly delivered export is specified and not yet built, because the platform is not yet live. The contractual right to take the export at any time is already in the software agreement and is not conditional on the delivery being built.

Authority on the day

On the Tuesday nobody needs to write software. Somebody needs authority. Authority to deal with the bank, to keep the hosting account paid, to instruct a contractor, to give firms the notice the agreement requires, to hold the ninety day export window open, and to run an orderly wind down or a sale of the product. A directorship is the wrapper that authority arrives in.

The company was incorporated on the model articles, under which recovery falls to personal representatives, whose authority derives from a grant of probate. A grant takes months, and a bank shown a sole signatory mandate and a death certificate will freeze the account while it waits. Left alone, that turns weeks of headroom into months of paralysis.

The plan closes that gap with four things. A bespoke article allowing a person named in advance to appoint a director immediately on the director's death or incapacity, so that recovery does not wait on probate. A will dealing with the share. A lasting power of attorney covering business affairs, because incapacity is the case the model articles handle worst. And a sealed continuity pack holding the credentials to hosting, code repository, domain and banking, together with a written runbook saying in plain words which bills to keep paying, what notice to send firms, how the export window is held open and where everything lives.

Behind those sits a ring fenced cash reserve, because a person with authority and no money is a spectator. The right size is the sum that runs the hosting and a contractor for six months. That figure cannot be fixed until the hosting provider is chosen, so the method is recorded now and the number is recorded when the provider is known.

The named person does not need to be able to operate the system. Their job is to keep the service up, write to every firm within the week, and hold the door open for ninety days while each firm moves somewhere else in good order. The runbook names the kind of help to engage.

These steps are in hand and not complete at the date of this policy. A firm carrying out due diligence should ask for the current position on each of them, and will be given it in writing. A second standing director has been considered and declined for now, because it would raise the quorum for every board decision to two in order to cover a rare event, and a second director without credentials, instructions and money attached solves nothing in any case.

Source code escrow, and why it is declined

Escrow is the answer this question expects, and for this product at this stage it is a ceremony. The reasoning is set out here because a firm's solicitor will raise it and declining it needs better words than too expensive.

A release event is not a switch. The beneficiary claims one, the agreement gives the supplier a window to dispute it, and on a death or an insolvency the claim runs against personal representatives or an insolvency practitioner with every reason to take their time. Release is measured in weeks at best. At the end of it a firm receives a copy of source code. Not a running service, not its data, not the infrastructure, not the keys, and not a person who knows how to build any of it. Verification, the exercise that proves a deposit can be turned back into working software, is what makes a deposit real, and on published rates it starts in five figures a year, which is not proportionate to a company with no revenue.

Escrow of the data is a better proposition, because data is what a firm needs and data does not have to compile. It is also strictly worse than the nightly delivery above, which puts the same copy in the firm's own hands with no release event, no dispute window, no annual fee and no third party whose own solvency matters. Where a firm wants a copy sitting outside both parties, that is offered at the requesting firm's cost rather than bought speculatively.

Depositing hosting credentials with a third party for release to a nominated operator comes closer to continuity of the running service than code escrow ever does, and it is the version worth revisiting. The trigger for buying it is a firm making it a condition of signature, which the agreement anticipates and which is priced into that deal, or first revenue making the fee small. Buying it today would insure a service nobody yet depends on.

No escrow arrangement and no third party continuity undertaking exists at the date of this policy, and none is described in the agreement. Where a firm requires one as a condition of purchase, it is negotiated and written in before signature.

What insurance answers and what it does not

The software agreement requires technology errors and omissions cover and cyber cover, and provides that nothing is signed until that cover is in place. Those policies answer the money half of the risk, being a claim after a breach, a failure of the service, and the costs of an incident.

No part of that cover answers the scenario in this policy. The death of a director is not an insured peril under either policy, and a firm's problem on the Tuesday is access to its files, which no policy restores. A compliance officer offered insurance as the continuity answer would conclude that the supplier has not understood the question, and would be right.

One policy touches the scenario, and it pays the company rather than the firm. Key person cover on the director's life, owned by Bracton Ltd, would fund the continuity plan, being the reserve the named person spends, the hosting bills through a wind down, the contractor who keeps the service running and the ninety days of export access. It is priced on age, health and term, no figure appears here because none exists without underwriting, and until a policy is in force the reserve has to exist in cash.

Cover is being placed and is not yet bound at the date of this policy. No firm will be asked to sign before it is, because the agreement itself forbids it.

What the build changes, and what it cannot

Nothing about how the product is built removes the objection. Three things about it change what a firm is being asked to accept.

The specification commits to a service that runs without hands, on managed infrastructure with immutable backups in a second United Kingdom facility, restores tested on a schedule and renewals automated. The consequence is that the dangerous period after a death is long rather than short, and the continuity plan has weeks to work with instead of days. The agreement forbids Bracton Ltd from accepting a term from a hosting or storage supplier that would let that supplier deny access to firm data or delete it without notice and an opportunity to export, which closes the quiet route to loss. And the rule that no connector supplier is chosen and every connection is a setting means the platform's own suppliers are replaceable by whoever operates a wind down, which lowers what the named person has to know.

Two build choices are made deliberately for continuity rather than for security. The operation is kept independent of any one person, with the infrastructure defined in code and no step that lives in a single head, because a runbook is only as good as the automation underneath it. And the billing relationship sits on a footing that survives a frozen card, with a company account, the reserve behind it and the named person recorded as a contact, because the most likely first failure after a death is a payment rather than a server.

What cannot be removed

Said plainly. A firm that puts its caseload into Bracton takes a supplier covenant risk it would not take with a larger vendor. What the steps above change is the shape of that risk. The worst case moves from your files sit in a dead company's server to you hold last night's copy and a named person is winding the service down in good order.

The risk a firm is left with is that it would have to choose a new system sooner than it wanted and pay for a migration it had not planned. That risk cannot be removed while the company is one person. What can be made certain is that it never costs a firm a file, a date or a ledger entry, and that is what the nightly copy is for.

A firm is entitled to see the current state of every item in this policy before it signs, including which of the legal steps are complete, whether the reserve exists and at what level, and whether the insurance is bound. Ask, and the answer is given in writing.

Ownership and review

This policy is owned by the director of Bracton Ltd. It is reviewed at least once a year, whenever a step described in it is completed, and on the appointment of any further director, at which point several sections of it stop being true and will be rewritten rather than left standing.