As an experienced Business Contracts Solicitor, Sue Mann of Cousins Business Law has helped dozens of IT companies navigate contract law. Sue’s last guest post for this blog “Your MSP contract – what is in and what is not?” received very warm feedback from all who read it. When Sue and I last sat down to chat about the questions that Managed Service Providers (MSP’s) typically ask me about Cloud Computing contracts, I asked Sue if she’d consider putting her answers into another guest blog post – to which I’m grateful that she kindly agreed. Here, Sue answers the top 5 questions asked by MSP’s about Cloud Computing.
The Top 5 Questions Asked by MSP’s about Cloud Computing
Cloud computing is far from a new idea, but the difference now is that it’s becoming more widely accepted and used in businesses of all sizes. That means that those MSPs who haven’t already
started moving their clients to cloud solutions are looking at this much more seriously. Clearly as IT specialists MSPs are in a much stronger position than I am to assess the technical and financial pros
and cons, but from discussions with Richard I am aware that a number of questions tend to be raised by MSPs around some of the legal issues, so I’d like to try and help here.
1. Who is the cloud customer?
Not so long ago, MSPs’ clients using cloud services would probably have done so by buying those services direct from the cloud vendor. The market is now changing. With more cloud vendors coming
into the sector with a broader range of offerings, it is becoming less usual for the small business client to buy direct from the cloud vendor and for MSPs to become the reseller.
To that extent the MSP becomes the ‘middle man’ in the supply chain. From a legal point of view the MSP is then the customer of the cloud vendor. The MSP will be selling the cloud services on to
its clients. Keeping this relationship in mind will help in answering a number of the other common questions which arise.
2. My MSP client hasn’t paid me. Do I still have to pay the cloud vendor?
Following on from the previous point, you will be the customer so far as the cloud vendor is concerned, so the short answer is yes, the cloud vendor will want payment even if your client doesn’t pay you. Each business contract depends on its own particular terms, but the majority of cloud vendors will expect to use their standard terms which will generally be heavily in their favour, including as to payment, and I expect they will have little sympathy if your client hasn’t paid you.
I can suggest two ways that you can protect your MSP business in this situation. Firstly – and this is a general rule which applies to all arrangements with your MSP clients – make sure you don’t agree to more than you can deliver. What I mean by this is, where you take on arrangements which require you to do something, make sure that you will be in a position to meet your obligations – in this case make a payment at a specific time to the cloud vendor. So, the contract with your client should require your client to pay you in advance of the date you have to pay the cloud vendor. Include protective measures as well such as a right to suspend your service, charge interest and so on if your client doesn’t pay you on time.
Secondly, to cover a situation where your client’s failure to pay might be part of a wider dispute or the end of your relationship with that client, if possible negotiate an option with the cloud vendor allowing you to terminate the cloud service in respect of that client. This is more likely to be possible where your contract with the cloud vendor covers multiple clients, so that what you will need is the ability to reduce the number of users under the contract. Your negotiating position is also likely to depend on factors such as the length of the term of the contract between you and the cloud vendor and whether the fee is a monthly or other periodic fixed charge or variable according to usage, but keep in mind the principle of not exposing your business to the cloud vendor more than you can definitely cover with your client.
3. My MSP client’s data stored in the cloud has been lost or corrupted. Am I liable?
As the reseller of the cloud service to your client, your client has no direct contract with the cloud vendor. What you should do is to check what assurances the cloud vendor offers as regards the safety and security of the data and whether it provides any indemnity for loss or corruption and mirror those in the contract with your clients, so that you are not promising more than you can provide. On a client relations point, you are their advisor and the expert as far as your client is concerned, so make sure they understand what is and is not covered to try and avoid any dispute over liability arising in the first place. Before you engage a cloud vendor, it is important that your preliminary due diligence checks cover the physical and technical security of the cloud vendor’s service including their back up and testing procedures to ensure that the possibility of a loss or corruption of your client’s data is minimised and that, should it occur, prompt restoration should be feasible.
4. My MSP client isn’t happy with the cloud vendor’s service. Whose responsibility is it?
I realise that I’m starting to get repetitive now, but as far as your client is concerned you are providing the service to them so you should take responsibility for sorting it out. To do that you will need to follow the procedures you have agreed with the cloud vendor. My suggestion here is to make sure your contract with the cloud vendor includes a comprehensive description of the service the cloud vendor is to provide backed up by service levels for key areas and, if possible, some form of ‘incentive’ in the form of service credits. The obligations you undertake with your client should then not exceed what the cloud vendor undertakes with you. Think of it as a back to back arrangement with your client where what you offer is no more than you receive from the cloud vendor.
5. My contract with the cloud vendor is coming to an end. What will happen to my client’s data?
This time I won’t repeat myself, but will launch straight in – make sure your contract with the cloud vendor covers what will happen to data stored in the cloud when the contract ends for whatever reason. In any event the contract should include provisions for an orderly transfer of the data either to you (so you can pass it on to your client) or to a new cloud vendor. Without appropriate cover there will be a danger of lock in to an unsatisfactory cloud vendor. Such provisions will also be critical if anything happens to the cloud vendor such as insolvency.
To sum up, my advice is to carry out thorough preliminary checks, weigh up the potential benefits, risks and legal obligations and make sure that whatever terms are finally agreed in relation to the cloud service are recorded in written contracts with both cloud vendor and your client .
About Sue Mann
Sue Mann is an experienced Business Contracts Solicitor.