IT contracts for cloud computing are starting to evolve as organisations start moving into the cloud.

One of the buzzwords in IT at the moment is “cloud computing”. Many consider it to be  the next great wave in the IT industry.

There are many definitions of “cloud computing” but the most commonly cited is the one used by Gartner:

“A style of Computing where scalable and elastic IT capabilities are provided as a service to multiple customers using Internet technologies”.

Although not perfect (it does not encompass so-called “private clouds”, where the relevant infrastructure is owned by or operated for the benefit of a single customer), the definition does encapsulate the key attributes of cloud computing”:

  • Scalability – computing capacity (whether processing or storage) can be varied to meet a customer’s specific requirements;
  • Elastic – scaling can happen quickly in response to demand;
  • Shared – it is often shared by many customers;
  • Internet delivery – this translates into location independence for both customers and service providers: customers can access the services anywhere with suitable communications links and service providers can build their data centres wherever it is most convenient. This also means that a customer’s data can be processed in more than one location that are in another country (hence the cross border data privacy provisions in our proposed data privacy law, POPI).

The term “Cloud” can be interpreted as a reference to the cloud symbol frequently used in network diagrams to represent the Internet. In the context of cloud computing, the data centre hardware and software is what is often meant by the Cloud.

In our experience, “cloud computing” means one thing to the IT user, and another thing to service providers and the IT department.

For IT users, the cloud provides a central location to upload and download documents (for example Dropbox).

For IT departments and service providers, cloud computing is all about two approaches to serving applications or infrastructure to an end user.

It may be “software as a service” (SaaS) which delivers the entire application to the end user relieving the user (or company) of all hardware or software maintenance.

It may be “infrastructure as a service” (IaaS) or “utility computing” where customers can deploy their own applications on the hardware. The hardware can be quickly configured to handle increased usage. Here IaaS service providers charge for actual usage (for example Amazon Web Services and Opsource).

It may also be “platform as a service” (PaaS), a web based environment for developing applications (for example Microsoft Azure or which provide a set of tools and applications for customising the applications).

Cloud computing uses “virtualisation”, the  technology that more than anything else has facilitated the development of cloud computing. With virtualisation a computer is able to emulate another computer: it emulates a complete virtual instance of a computer, complete with processor, storage, operating system and potentially even an application loaded and ready to run. Virtualisation converts “physical” resources into “logical” resources. There are different ‘types’ of virtualisation which have resulted in different service offering from services providers:

  • Hardware virtualisation – where the computer’s memory is partitioned into separate “virtual” machines that simulate multiple machines within one computer. This is what permits the rapid scalability of cloud computing; as the customer‟s demand varies, the number of virtual instances can be changed accordingly.
  • Storage virtualisation – where multiple storage devices are consolidated into a logical view so that they can be accessed the same way no where they are.
  • Application virtualisation – a technique that makes running applications more flexible and easier to manage.

Cloud deployment models

There are 3 Cloud deployment models: Public, Private and Hybrid.

  1. When a Cloud is made available in a pay-as-you-go manner to the general public, we call it a Public Cloud.
  2. A Private Cloud to refer to internal data centres of a business or other organisation, not made available to the general public”. They use the same technology and techniques as public clouds, but with complete privacy.
  3. A hybrid cloud is both public and private. For enterprise customers, if the private cloud is overloaded, the public cloud is used. Service providers give their hybrid customers the ability to manage both venues from a central console.

The difference is important from a lawyer’s perspective as the contracts are very different. Private cloud agreements are often more detailed and are customised to suit the needs of the customer. Public cloud agreements are less complicated and in the form of website terms of use published on a website. Where companies offer both, it is important to harmonise the two sets of agreements with one another.  

One of the interesting things about Cloud Computing from a lawyer’s perspective is the way of contracting ‘in the Cloud’ is very different to the traditional way of IT contracting.

Traditional model

The traditional approach up until fairly recently has involved software being licensed and users signing licence and support agreements.  Where the software needs to be modified to meet the needs of the customer, a development agreement (for new software) or customisation agreement (of existing software) is needed to cover the required development or customisation activity. The cost model usually provides for the payment of licence fees, development/customisation fees and integration fees up front with support fees being paid on an annual basis.

Under the traditional model the software is usually deployed at the customer’s computer systems.

The software is either proprietary (owned by the developer) or is “open source”, namely, is provided on the basis that it is freely available to use and share, and therefore to modify.

New Cloud Computing business model

The cloud computing business model for public clouds involves paying for the SaaS, PaaS or IaaS on a subscription basis, with the payment stream based on use by way of micro payments or periodic per user payments, and with no upfront payments required.  These new payment models are attractive to users from a cash flow perspective. Therefore, instead of paying a licence fee for the software and paying for periodic upgrades, all upgrades are provided during the term of the subscription.  When the subscription period expires, the use of the service is no longer permitted.  In this model, the applications are maintained in the service provider’s data centre and every time users launch their browsers and logon, they get the latest version.

Cloud Computing v ASP

Cloud Computing differs to services offered by an Application Service Provider (ASP).

An ASP, like a cloud computing service provider, is an organisation that hosts software applications on its own servers within its own facilities.  Customers pay a licence fee for the use of the application and access it over the Internet.

With an ASP, the services tend to be provided on a  one-to-one basis whereas with Cloud Computing, they are provided on a one-on-many basis.

It is therefore important for organisations to understand whether or not their services are being offered on an ASP or Cloud Computing or traditional computing basis as this affects the type of contract involved.  If a Cloud Computing basis, it is important to understand whether it is a SaaS, PaaS or IaaS as the terms and conditions of use relating to each will differ substantially.

It is necessary to “look under the bonnet” and understand the nature of the technical and business model in play.  Then armed with this knowledge, it becomes necessary to understand what level of contractual protection is necessary, as low levels of contractual protection might not matter for some users of cloud computing, particularly where, for example, the user keeps separate copies or backups of all content used in the Cloud Computing environment for separate access where needed and where the use is not business critical.  However, where use is central to the user’s business model, and involves significant investments of time and money, or where there are particular risk factors, there may be a need to engage with the cloud computing provider in a more traditional form of negotiation before the transition to a Cloud Computing model is made.