Yesterday’s outage of Amazon’s Elastic Compute Cloud - ironically, as I was giving a talk on cloud’s contractual perils - highlights the need to scrutinize the small print. Just as more organizations explore cloud opportunities, cloud risks may outweigh benefits.
Cloud contract terms, and crucially, service level agreements (SLAs) fail my tests for contractual risk. In my upcoming report, ‘Cloud 99.99,’ I’ll detail problems with specific contracts, suggest tools to mitigate risk and discuss how leading innovators are finding remedies. Here’s a taster:
- What SLA? SLAs are not uniformly available, even from well-known brands, according to my vendor analysis, from Amazon to Zoho. Self-certification of ‘best efforts’ is common, but legally toothless.
- Uptime is mediocre. Good luck finding 4, let alone 5 ‘9’s (99.999% uptime). And even if you do, unlimited maintenance events won’t be in the calculations.
- It’s not their problem. Besides demanding full indemnity for any damages (which is typically not reciprocal), get out clauses for liability include physical service demarcation points (eg: not beyond the server farm) and network congestion.
- They won’t pay up. Forget liquidated damages. Penalties for non-performance are usually limited to contract termination or at best service credits. These are gated in value, and usually, it’s up to you to argue the claim (within a specific timeframe).
- Prolonged complaints aren’t welcome. Arbitration clauses are usually missing.
- Foreigners beware. It’s not unusual for the contract’s governing law to reflect where a vendor is incorporated. That might be thousands of kilometers away from you (eg: California when you are in the U.K.), and alien to you in legal practices. But some contracts also specifically exclude the possibility of invoking the United Nations Convention on Contracts for the International Sale of Goods. This was purposefully designed to provide a common legal lingua franca in case of disputes involving parties in different jurisdictions.
- Terminate at your peril. So, to hell with them. But how much time have you got to extract your data from the vendor? Miss the deadline and your valuable data will be expunged.
The good news? These issues only strengthen the case for a closer relationship between cloud vendors and communication service providers (CSPs). What’s been described as a parasitic dynamic fraught with rivalry is actually symbiotic. CSPs have the know-how that many cloud vendors lack, particularly in dealing with enterprises. Cloud vendors - particularly in the SaaS realm - are creating innovative productivity tools. As I’ll argue, each needs the other badly to monetize the cloud on a volume basis.
Not least, there is an urgent need for intermediaries to broker, aggregate, secure and monitor disparate cloud services - particularly as standards, service levels and interworking remain in flux (see Deutsche Telekom’s Zimory for a compelling example). In future, I believe that enterprises will pay trusted intermediaries to act as operational integrators and SLA managers across private, public and hybrid cloud contexts. Bottom line: The view’s great from the cloud, but don’t ignore today’s earthbound concerns.



