Suffice to say, they seem a bit nervous about betting the house on a young company and are asking for guarantees that the service will still be around in future.
Possible suggestions from them include 1. financial disclosures, and 2. access to the code
Has anyone been in a situation like this? If so, how did you handle it?
If you don't want to go through that route, and your software can run in a private cloud, then I suggest you offer them a non-hosted version. Giving them your source code is a no no unless you are planning to open-source everything.
In addition, let them know that they'll have to pay for upgrades. Having said that, make sure you price it properly to make the extra hassle worth it.
Regarding running the service in a private cloud, my only fear is that it could turn out to be a can of worms i.e. a support nightmare. Are there any SaaS services that currently provide that sort of service?
You want to put your code in escrow, and have an agreement that if your company folds, the customer gets full access (not necessarily ownership) of the code, and has the right to the engineers' time necessary to get it and keep it working.
These sorts of things are standard in some industries. Get an hour of free consultancy with an appropriate lawyer, and it will work easily. Talk to your customer and say that you are sufficiently confident to give them full access to the code in the event that you can't deliver. They get the full blast of your confidence, as well as the assurance that it will all work.
The hassle of getting engineers to manage the code and keep it up to date isn't worth it (with all the legal gray areas surrounding IP). That's what I was trying to avoid by going the SaaS route in the first place.
YMMV - it will clearly depend on your industry, customer, and likelihood that there'll be a problem anyway.
An agreed escrow company comes in, and we prepare a clean build system. We follow the documentation to build the system and run basic system checks. We show that the binaries just built are identical to those on the customer's running system. Then we power down, remove the disk, and hand it over to the agent who seals it in a labelled bag. We sign, they sign. If the customer wants to be present, they sign as well.
There are many places where the whole thing can be faked, but we don't do that, and the agent does have some skills and abilities to detect such things.