Mastering Cloud-Based Computing Service Contracts: Expert Tips

Understanding the Service Models: SaaS, PaaS, and IaaS

• Software as a Service (SaaS)

SaaS (e.g. Google Workspace) is a cloud computing model where software applications are hosted and maintained by a third-party provider and delivered to users over the Internet. Users can access these applications without the need for installation, updates, or maintenance on their local devices. SaaS is particularly advantageous for its ease of use and cost-effectiveness, making it a popular choice for businesses seeking to streamline operations.

• Platform as a Service (PaaS)

PaaS (e.g. Google App Engine) provides a platform and environment for developers to build, deploy, and manage applications without the complexity of managing the underlying infrastructure. PaaS offerings include development tools, middleware, and runtime environments. This model accelerates application development and allows developers to focus on coding rather than managing hardware and software infrastructure.

• Infrastructure as a Service (IaaS)

IaaS (e.g. Google Compute Engine) delivers virtualised computing resources over the Internet. It provides organisations with virtual machines, storage, and networking components, enabling them to build and manage their IT infrastructure without the need for physical hardware. IaaS offers the highest level of control and flexibility, making it suitable for businesses with specific hardware and software requirements.

Contract Negotiation Challenges and Tips for Cloud Services Agreements

Service-Specific Requirements

Each service model has distinct features and focus. SaaS contracts should address data security, access control, and user data ownership. PaaS contracts should focus on development tools, APIs, and integration capabilities. IaaS agreements need to account for infrastructure, scalability, and resource allocation.

• Approach each agreement based on its specific context and service type, avoiding a one-size-fits-all approach.
• Consider potential pitfalls regardless of the contract value.
• Seek legal expertise and consult with your CTO and CIO.

Governing and Applicable Law

In cloud services agreements, it is important to differentiate between the governing law and applicable laws. The governing law dictates the jurisdiction whose laws will govern the overall agreement, addressing issues like interpretation and performance. However, applicable laws, such as data protection regulations, may still apply regardless of the governing law chosen. For example, if personal data is being processed, relevant data protection laws might apply irrespective of the governing law chosen in the contract.

• Recognise that even if a different governing law is chosen, certain laws may apply due to the nature of the services or data location.
• Clearly outline in the agreement how both parties will adhere to their respective legal obligations, ensuring alignment with the governing law and any applicable laws.

Data Security and Privacy

Data security and privacy are paramount, especially when personal or sensitive data is involved. Contract negotiations should outline how data is protected, who is responsible for security measures, and the protocols for responding to security incidents or breaches.

• Allocate data processing roles and responsibilities.
• Consider whether a specific data processing agreement is needed.
• Ensure that the contract contains provisions addressing security measures, data breach handling, audit and cooperation, and mandatory provisions under applicable laws.

Data Ownership and Portability

Contracts should clearly state who owns the data generated or processed within the cloud service. Additionally, to avoid becoming overly dependent on a single provider, negotiations should focus on exit strategies and data migration plans that allow a seamless transition to an alternative service provider.

• Ensure your contracts clearly outline the ownership of data generated or processed within the cloud service.
• Incorporate clauses that cover data extraction, transfer, and portability.
• Specify how data will be provided to you in a usable format upon contract termination.

Service Level Agreements (SLAs)

SLAs define the level of service a provider commits to deliver, including uptime guarantees, performance metrics, and support response times. It’s crucial to ensure that SLAs align with the specific needs of the business and that the consequences of failing to meet SLA commitments are clearly outlined. In cloud agreements, one of the common aspects to consider is the availability of the cloud solution. However, it’s important to note that no cloud solution can be available 100% of the time. In cases where the company can’t fulfil the promised availability, they might offer service credits. These credits are usually a percentage of the monthly fees and are provided as compensation.

• Clearly define the metrics that matter most to your business, such as response times, uptime percentages, and performance benchmarks.
• Establish procedures for monitoring and reporting SLA performance.
• Specify what happens if the provider fails to meet SLA commitments.