The backup is fine. The passphrase is the single point of failure

You did the hard part: the backups are encrypted, tested, and sitting in two locations. Then the founder who set the archive passphrase goes on holiday, gets sick, or resigns, and the entire encrypted backup estate becomes a pile of unreadable bytes. Escrow is the antidote, and for a team of five it fits on one card. This page is that card: what to escrow, where it may and may not live, the drill that proves it works, and the offboarding step everyone forgets.

1. What escrow actually means for a team your size

Escrow is a second, independent way to open the backup. Not a copy of the password taped under the keyboard — an intentionally stored, findable, dated secret whose only reader is a documented emergency. If your backup encryption checklist says "two-path key storage," escrow is the paperwork that makes the second path real instead of theoretical.
The test is brutal and simple: can a second person restore the backup while the first person is unreachable? Not "can they eventually," and not "do we think so." The restore test answers for data; the escrow drill answers for the key. One without the other is half a plan.
You already run escrow somewhere. The break-glass admin account is escrow for identity. The printed TOTP backup codes are escrow for MFA. Backup keys deserve the same treatment: deliberately stored, deliberately restricted, deliberately tested.

2. The three escrow patterns that actually work at small scale

Pattern A — the sealed offline kit (the default for most teams). The passphrase and the key-file hash, printed, inside a sealed envelope in a safe or with the trusted third party. Two envelopes in two locations. Cheap, offline, impossible to phish. The failure mode is honest: an envelope is a point-in-time copy, so it must be re-sealed every time the key rotates — which the rotation schedule should trigger, not a person's memory.
Pattern B — the shared vault item (for teams already living in a password manager). A restricted shared item in the manager the team already uses, visible to two named people plus an emergency recovery path — mirroring the password manager rollout rules rather than fighting them. The failure mode is also honest: whoever can see the vault item can see the backup. That is why the item's access list is two people, not "admins."
Pattern C — split knowledge (for the paranoid or the regulated). The passphrase is split into two halves, each half escrowed separately, so no single person can reconstruct it alone. This is the pattern auditors and cyber-insurance questionnaires love. The failure mode: reconstruction needs two people, so the drill must rehearse the handoff, and the reconstruction step must be written down or the split becomes a riddle.
What does not work: the key in the same cloud account as the backup (one compromised credential opens both), the key in the founder's head only, the key in a chat message from 2023, or the key in the runbook itself. If the escrow location is reachable by whoever stole the first breached laptop, it is not escrow — it is storage.

3. The escrow card template

Header: backup job name, archive format + encryption tool + version, the passphrase or a pointer to it (escrow means few copies, zero copies in logs and tickets).
Paths line: the two escrow locations, the two people allowed to open them, and the date the card was last re-sealed.
Drill line: the date of the last restore performed using only the escrowed key, the machine it was run on, and who witnessed it.
Rotation line: when the key last rotated, when it rotates next, and the rule that a rotation re-seals every envelope — the same review that checks who still has access.
Breach line: one sentence: "if this card is exposed, treat the archive as exposed" and the link to the key-leak runbook.

4. The quarterly escrow drill (fifteen minutes, saves the company)

The drill: restore one file from the encrypted backup using only the escrowed key — without asking the key-holder. Pick the person least likely to know the passphrase by heart. If the restore works, the escrow is real; log the result next to the archive, the same ledger the restore test uses. If it does not, you have found the flaw while it is still cheap.
Drill the handoff, not just the typing. Pattern C teams: the two halves meet for the first time during the drill. New hires on their on-call onboarding path: the escrow walkthrough belongs next to the break-glass walkthrough — both are "the thing you hope never to run, rehearsed until it is boring."
Rotate the driller, keep the date. A drill always run by the same person drifts into ritual. Rotate who runs it each quarter; the calendar slot itself can piggyback the quarterly restore test so it is one meeting, not two.

5. Offboarding the key-holder without burning the archive

Offboarding day has a key step, not just an account step. When the person who held the key leaves: rotate the backup key first, re-encrypt or verify the archives under the new key, re-seal every envelope, then walk the leaver through the deletion checklist for any personal copies they made. The decommissioning discipline applies to people's heads too: wipe, then verify the wipe.
Nobody resigns with the only key. The escrow card exists precisely so no single exit — graceful or angry — can hold production history hostage. If today that is not true for your team, the fastest fix in this entire page is: pick a second person, open the escrow, run the drill this week.
The exit that already happened is not the risk; the next one is. Put "escrow verified post-exit" as a line in the offboarding checklist, so the rotation and re-seal cannot be skipped in the rush of someone's last day.

6. When escrow goes wrong, and how it ends

Lost key + encrypted archive = gone. Not "recoverable with effort." Brute-forcing a modern passphrase is a rounding error against eternity; the only realistic recovery is the escrowed copy. This is why the ransomware runbook asks for encryption status early: an encrypted backup you cannot open converts a bad week into a permanent loss.
Exposed escrow = rotate, don't argue. The moment an escrowed secret is suspected leaked — the laptop with the vault session, the mis-sent email, the photograph of the whiteboard — rotate the key and re-seal, then run the lost-laptop math on what the exposure touched. Rotation is hours; hope is not a control.
Escrow that is never tested is a story you tell yourself. The fifteen-minute quarterly drill is the difference between a plan and a decoration. The first-30-minutes runbook logic applies: rehearsals are cheap, the real 2AM version is not.

Small-team honesty note: if you are a team of two, this is one envelope in a safe and one shared vault item, re-sealed whenever the key rotates, proven by a one-file restore every quarter. Fifteen minutes a quarter is the entire price of never being locked out of your own history. That is the best deal in this whole site.