Cloud Computing Requires Comprehensive Contracts

Cloud computing continues to grow in popularity as a plausible alternative to traditional methods of controlling information technology.

Cloud computing is essentially the practice of using a network of remote servers hosted on the internet to store, manage and process data rather than on a local server or personal computer. In using cloud computing, end users, including many businesses, are able to access software programs over the internet through a web browser, and the data is stored by a third-party. While this concept may sound foreign and highly technical, it is actually very common. For example, most email providers, such as gmail, hotmail and yahoomail, utilize cloud computing for their services. The software and email storage do not exist on a specific computer. Rather, it is stored on the servicer’s computer cloud; users can check their email from any computer.           

One of the huge benefits of cloud computing is that it eliminates many complex constraints that generally accompany traditional computing services. For example, people are not limited to one computer to access their information. Users can access their applications and data from anywhere at any time because the data is no longer confined to a hard drive on one user’s computer. The ability to access one’s data from anywhere creates a great deal of flexibility and promotes greater control over IT costs, making cloud computing an attractive service individuals and businesses alike. 

While cloud computing offers many advantages, the service is not without flaws. When using cloud computing services, one becomes dependent on a third party for the storage and maintenance of data. As such, the data is vulnerable to the third party’s business decisions. For example, Amazon and Google keep most of their information in a cloud. Last year, Amazon’s EC2 Cloud crashed and resulted in an outage that lasted 6½ hours.  Six weeks later, Amazon’s Elastic Compute Cloud crashed due to inclement weather in Virginia where the cloud services are hosted. Netflix, Instagram and Pinterest, companies that operate using the same cloud, temporarily stalled as well.    

Over time, cloud computing technology likely will improve so that it is less susceptible to such environmental disruptions. What business and individuals can control now, however, is the contract that governs the cloud computing relationship. Cloud computing, while beneficial in many regards, poses several significant risks, some of which include disagreements over the ownership and access to data as it is no longer stored in one location. Privacy, security and confidentiality of the stored data also pose significant potential points of contention given the nature of the service being accessible at anytime from anywhere and maintained by a third party. Users of cloud computing must first determine the sensitivity of their data and, depending on this sensitivity, conduct a risk assessment. Low-sensitivity data can be considered for cloud computing services, whereas a potential user should be more reluctant for data of high-sensitivity. 

If a one determines that the benefits of this service outweigh the inherent risks and decides to pursue such use, a well-drafted contract is essential to mitigating potential risks involved in utilizing cloud computing. Here are just a few aspects to be considered: (i) clearly defined ownership of data, access, privacy and security; (ii) allocation of risk and what will happen if the provider ever goes out of business or the technology unexpectedly fails; and (iii) limitations on liability that set forth a fair maximum monetary value should something go wrong, and indemnification for any third-party liability arising from the mishap. 

Cloud-computing offers many potential advantages to its users. However, the process also poses significant risks that can be extremely problematic to a cloud-computing consumer. A purchaser of a cloud computing service has the responsibility to perform due diligence and make sure the company is legitimate, meaning that they are adequately secured and have back-up capabilities. Such due diligence would be best be enhanced by consulting with a business law attorney to address potential points of conflict in any cloud-computing contract. 

For more information please contact Justine Moreau at 410-583-2400 or


210 W. Pennsylvania Avenue, Suite 400
Towson, Maryland 21204