Read the fine print. Cloud services are deceptively simple in the ads. "In many cases, that simplicity is masking underlying complexity that has been considered and resolved against the customer," says Hansen of Baker & McKenzie. "Read the contract, not the website," adds Church. "There are terms that directly contradict the advertising, and these need to be ferreted out before any data is moved." It's not unusual to see "get out of jail free" provisions disclaiming vendor liability if confidential information is published. Never, ever, sign the cloud provider's online contract, advises Todd Fisher, partner in the outsourcing practice of K&L Gates, who's reviewed agreements giving the service provider could use of client data for purposes other than for the provision of the services or ownership of derivative works based on that data.
Add some fine print of your own. If your cloud computing deal involves IP-related data, strong contractual protections are critical. Eisner of Mayer Brown suggests includingrequirements that the provider follow stated and approved security and other industry standards, rights to audit or to receive regular audit or certification reports, rights to name the locations where data and applications will be processed and stored, rights to approve subcontractors, a change control process that provides for advance notice and opportunities to work around or mitigate pending changes, and reasonable liability for nonperformance by the provider. Make sure the protections and controls are explicit and measurable, adds Slaby.
Expect to pay more. Standard terms keep cloud computing cheap. "Their traditional business model is to replicate data automatically based on usage patterns," says KPMG's Bell. "When you remove that capability to do something special for your environment, you create additional costs."
Consider IP creation. It's less likely that new IP will be created in the course of a cloud computing deal than an outsourcing contract, but it happens. "Some customers hire a cloud provider to run a private cloud, where there might be the opportunity for the development of intellectual property," says Fisher of K&L Gates. "Another exception is if the customer needs the cloud provider to develop certain interfaces to access the cloud services." In such cases, the cloud buyer may want to retain ownership of the interfaces or prevent the cloud provider from reusing them for competitors. Geography becomes an issue as well. "If IP is going to be created in a cloud environment, the laws of the location where the IP sits should be checked to ensure that unexpected rights or hindrances don't arise," says Baker & McKenzie's Church.