A cloud agreement is the service contract between you and a hosting provider, and the clauses that actually determine your rights are narrower than the document’s length suggests. The key terms in a cloud agreement cluster around a handful of questions: how reliable the service must be, who owns the data you upload, who is responsible for security, how much the provider will pay you when something goes wrong, how the contract renews and changes, where disputes get resolved, and what happens to your data when the relationship ends. Everything else is packaging.1Securities and Exchange Commission. QAD Inc. Cloud Services Agreement
Uptime Guarantees and Service Credits
The service level agreement puts a number on reliability. Major providers typically guarantee between 99.9% and 99.99% uptime in a monthly billing cycle, depending on tier and deployment.2Google Cloud. Compute Engine Service Level Agreement The two numbers sound almost identical. They aren’t. 99.9% allows about 43 minutes of downtime per month; 99.99% allows about four. For real-time transactions that gap is the difference between a service you can build on and one you can’t.
When the provider misses its target, the remedy is a service credit against a future bill. Google Cloud’s compute SLA, for example, issues a 10% credit when monthly uptime falls below the guarantee but stays above 99%, a 25% credit below 99%, and a 100% credit below 95%.2Google Cloud. Compute Engine Service Level Agreement Credits are not refunds, and they rarely cover the actual business cost of an outage. That is a deliberate design and it is why the liability section later in the contract matters so much.
Credits are also not automatic. You have to request them, on time, with documentation. AWS requires credit requests by the end of the second billing cycle after the incident, with specific dates, times, and availability data for each affected interval.3Amazon Web Services. AWS Deadline Cloud Service Level Agreement Miss the window or fail to log the outage in near-real time and you get nothing, regardless of how badly the service performed.
What Doesn’t Count as Downtime
Every SLA carves out categories of downtime that don’t count against the uptime percentage. Scheduled maintenance windows are the standard exclusion. Force majeure events like natural disasters, wars, and widespread infrastructure failures are also excluded. Some providers go further and exclude outages caused by third-party services or internet backbone failures, even where the provider chose the third party. Read the exclusion list closely. A broad enough set of carve-outs can hollow out a 99.99% guarantee.
Data Ownership and Confidentiality
A well-drafted cloud agreement states plainly that you keep all intellectual property rights in the data you upload. Google Cloud’s terms provide exactly that, with the provider retaining rights only in its own services and software.4Google Cloud. Google Cloud Platform Terms of Service The complication sits one layer down.
Most providers claim ownership of “derived” or “aggregated” data drawn from your usage: performance metrics, behavioral patterns, anonymized statistics. Your sales spreadsheet stays yours; the analytics the provider builds by watching how you use the platform often don’t. If your business depends on proprietary usage patterns, this carve-out is worth negotiating.
Confidentiality clauses typically bar the provider from sharing your data with third parties except under court order or subpoena. Better contracts require the provider to notify you before responding to a legal request so you can seek a protective order. Not every contract includes that notice requirement, and some that do carve out national security orders where notice is legally prohibited.
Where Your Data Physically Lives
Data residency creates legal obligations people don’t always anticipate. Some countries and industries require certain categories of data, particularly health records, financial information, and government data, to stay within national borders. The EU’s General Data Protection Regulation restricts transfers of personal data to countries without adequate privacy protections unless safeguards like Standard Contractual Clauses are in place, and violations can trigger fines up to €20 million or 4% of global annual revenue, whichever is higher. If your agreement doesn’t specify storage regions, or if the provider reserves the right to move data between regions without notice, you may be absorbing compliance risk you didn’t sign up for. Region-locking is often available but frequently optional and sometimes priced separately.
Security: Who Is Responsible for What
Cloud security runs on a shared responsibility model, and understanding the split is the single most important security concept in the contract. AWS frames it as “security of the cloud” versus “security in the cloud”: the provider handles the physical infrastructure, hardware, networking, and facilities, and the customer handles everything configured and deployed on top of it.5Amazon Web Services. Shared Responsibility Model On raw infrastructure, the customer’s share includes the operating system, patches, applications, and firewall rules. On more managed services, the provider takes more layers and the customer’s share narrows toward data and access permissions.
Encryption standards have largely consolidated around AES-256 for data at rest, the same algorithm used for government-classified information.6Amazon Web Services. The Importance of Encryption and How AWS Can Help For data in transit, TLS 1.3 is the current recommended standard. TLS 1.2 remains acceptable when properly configured, but if your contract references only TLS 1.2, confirm the provider actually supports the newer version.7National Cyber Security Centre. Using TLS to Protect Data
Providers verify their security practices through independent audits. The most widely recognized is the SOC 2 Type II report, which evaluates internal controls over an extended period, typically six to twelve months, rather than at a single point in time. A Type I report is a snapshot; a Type II shows sustained performance. Ask for the current report before signing, not after a breach.
Breach Notification Deadlines
Most cloud contracts commit the provider to notifying customers within a set window after a breach. Contractual timelines typically run from 48 to 72 hours, tracking regulatory expectations. GDPR requires controllers to notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach.8GDPR Info. Notification of a Personal Data Breach to the Supervisory Authority U.S. state breach laws vary, but the contractual clause is often your only enforceable timeline against the provider itself. If the agreement doesn’t specify a notification deadline, you have no guaranteed right to prompt notice.
Licensing and Open-Source Exposure
The provider keeps all intellectual property rights in its software, platform, and underlying technology. What you receive is a non-exclusive, non-transferable license to use the service. You can’t resell access or hand your subscription to another party.4Google Cloud. Google Cloud Platform Terms of Service Reverse engineering, decompiling, or attempting to extract source code is prohibited in almost every cloud contract and is treated as a material breach.
Open-source components embedded in the platform can catch businesses off guard. Some open-source licenses are “copyleft” and require derivative works to be released under the same open terms. If you’re building products on top of a cloud platform, the provider’s use of copyleft-licensed code could in theory affect your proprietary work. A thorough agreement includes a representation that no embedded open-source component requires disclosure of your source code or restricts commercialization of what you build. If that language is missing, ask for a software bill of materials.
Liability Caps and Excluded Damages
This is where cloud contracts shift the most risk onto the customer, and it is the section most people underestimate. Nearly every cloud agreement caps the provider’s total liability at the fees you paid over the preceding 12 months. Pay $5,000 a month, suffer a failure that costs your business $2 million, and the most you can typically recover is $60,000. The gap is yours.
On top of the cap, providers exclude consequential and indirect damages entirely. Lost profits, lost business opportunities, reputational harm, and the cost of procuring a replacement service are all off the table, even where the provider’s negligence caused the loss. These exclusions typically apply “even if the provider was informed of the possibility in advance,” standard language designed to survive foreseeability arguments. Some contracts carve out exceptions for willful misconduct, gross negligence, or breaches of confidentiality, but those carve-outs are products of negotiation and don’t appear in every standard form.
Indemnification usually runs both ways but not symmetrically. The provider agrees to defend you against third-party claims that the platform infringes intellectual property, but that coverage often excludes infringement arising from combining the service with your own data or applications, which is how most infringement claims actually arise. You, in turn, indemnify the provider for anything stemming from the data you upload or how you use the service.
Auto-Renewal, Price Increases, and the FTC Rule
Roughly 85% of cloud service agreements include automatic renewal, and about one in five build in an automatic price increase upon renewal, most commonly in the 5% to 8% range. The standard non-renewal notice period is 30 days before the current term ends. Miss it and you’ve committed to another subscription period at whatever the new price is.
The FTC’s click-to-cancel rule, finalized in late 2024, requires sellers to make cancellation as easy as sign-up and to obtain express informed consent before charging under negative option features like auto-renewal.9Federal Trade Commission. Federal Trade Commission Announces Final Click-to-Cancel Rule Providers must disclose material terms before collecting billing information and must offer a simple cancellation path. The rule applies broadly to recurring subscriptions, including cloud services sold to consumers and small businesses. If a provider buries cancellation behind phone calls or multi-step escalation, that’s a potential violation.
Payment terms usually require monthly or annual prepayment. Most providers reserve the right to suspend access after a grace period following a missed payment, and grace periods are rarely generous. Confirm the exact number of days before signing, and check whether suspension means read-only access to your data or a full lockout.
The Provider’s Right to Change the Terms
Most cloud providers reserve the right to change the agreement unilaterally. The provider may adjust the service portfolio, change pricing, or modify terms of use at its discretion. Some agreements require advance notice; others simply expect you to check the terms page periodically, treating continued use as acceptance.10UNCITRAL. DRAFT Notes on the Main Issues of Cloud Computing Contracts
A stronger contract gives you the right to terminate without penalty if the provider makes a material change you find unacceptable, with a reasonable data retrieval period. Without that termination right, you’re agreeing to whatever the provider decides next. For enterprise customers this is negotiable. On standard click-through terms it usually isn’t, which makes reading update notices more important than most people treat it.
Governing Law, Arbitration, and Class Action Waivers
Every cloud agreement specifies which jurisdiction’s law governs and where disputes are resolved. AWS, for example, applies Washington State law and requires binding arbitration for most disputes.11Amazon Web Services. AWS Customer Agreement Arbitration means no judge, no jury, and limited appeal rights. An arbitrator can award the same damages a court could, but the process is private and the procedural protections are thinner. Both parties typically keep the right to seek court orders for intellectual property disputes; everything else goes to arbitration.
Many cloud contracts also include class action waivers, meaning you can’t join with other affected customers in a collective claim. If an outage harms thousands of small businesses, each has to arbitrate separately rather than pooling resources. For small individual claims, that structure effectively removes any incentive to pursue a remedy, which is the point.
Providers tend to select jurisdictions with well-developed commercial law, particularly Delaware and New York. A small business in another state may find disputes governed by unfamiliar law and resolved in an inconvenient forum. Enterprise contracts negotiate this. Click-through agreements do not.
Termination and Getting Your Data Out
Cloud agreements allow termination in two ways. Termination for cause lets either side end the relationship when the other fails to meet a major obligation, such as repeated SLA breaches by the provider or non-payment by the customer. Termination for convenience lets either side walk away without a specific reason on 30 to 90 days’ notice, depending on the contract.
What happens to your data after termination matters more than how termination is triggered. AWS gives customers 30 days after termination to retrieve their content, provided outstanding balances are paid.11Amazon Web Services. AWS Customer Agreement During that window you can export, but you still owe fees for any service usage. Once the retrieval period expires, the provider is contractually obligated to delete all copies. Some providers charge extraction fees on top of standard usage costs. Check for that before you need it.
Data portability is where things get practical. Most agreements guarantee export in standard formats like CSV for structured data, but they rarely require export of computed outputs, derived analytics, or custom configurations. If you’ve built complex workflows on a platform, a raw data export may be only a fraction of what you need to reconstruct operations elsewhere. Test the export process before you commit. Run a trial extraction and see whether what comes out is actually usable. Discovering during a 30-day termination window that your data is technically portable but practically unusable is one of the more expensive surprises in cloud computing.