E.B. Writers of Dallas

Wayne Epperson, Web Hosting Monthly,
July 2003

Every host or would-be entrant into the provider market requires fronting documents designed to protect their business and help sell their services.

A sound Terms of Service (TOS) policy can be a valuable tool in helping providers grow their business. Or, if done improperly, they pose potential hazards that can wreck a business. The difference often comes down to content, how the agreement drafted and whether it can withstand a legal challenge.

The purpose of a TOS agreement is to identify the shared goals and objectives of both parties, says Rick Leopoldi, a managing business consultant with more than 30 years of experience in IT.

"The host should agree to provide a level of service based on an agreed-to set of guidelines, while the user should agree to abide by the host's guidelines in anticipation of being provided the desired level of service," says Leopoldi, the owner of RL Information Consulting (itsm.info) of Phoenix, Ariz.

Leopoldi, who has developed and delivered consulting solutions for major organizations worldwide, outlined what he believes should be specified in a written contract between hosts and users.

A host's responsibilities should include:

Availability of the service to the user;
The performance target of various components of the user's workloads;
Bounds of guaranteed performance and availability;
Measurement and reporting mechanisms
Cost of the service (where cost is an agreed-to component of the service level agreement).
A service level agreement, which protects vendors and clients in the event of an outage, is also usually necessary for larger Web hosting contracts.
A user's requirements of a host could encompass a broad list of services and support, including:

Acceptable maintenance outage windows;
Data backup, storage, recovery and retrieval specifications;
System recovery time;
Application recovery time;
Incident/​disaster recovery priority and time;
Implied qualifiers that need to be quantified by IT;
Hardware and software vendor response times.
"Hosts should understand in relative detail their customers' business needs, requirements, and processes. Specifically how these relate to the business and the organization," Leopoldi says. "I feel it is critical that not only the performance but capacity of resources be monitored, managed, reported, and forecasted for service provisioning."
Experience has shown that an objective third party, such as an outside consultant, can best articulate the requirements of the business or organization and the services that will be provided by the host, Leopoldi says.

The legal aspect of the host-user agreement has a broader meaning for Eric Goldman, an assistant professor of law at Marquette University (marquette.edu).

"I take the position that the agreement is the manifestation of a broader risk management strategy," Goldman says.

"A lot of companies and clients think about it in reverse. They think, 'well let's draft the agreement and then we will worry about the legal risks.' But really, you should worry about the legal risks and then your agreement should be drafted to optimize your management of legal risks," says Goldman, who specializes in copyrights, intellectual property and cyber law.

The legal risks vary for different types of hosting providers, and there are numerous reasons why a host would have a user agreement above and beyond managing risks for hosting third party content. "You will have things like disclaimer of warranties, limitations of liability that will manage other aspects of the service relationship. But in all cases, all of that needs to be an outgrowth of a risk management plan," Goldman says.

He says it's incredibly difficult for business people to come up with a successful risk management plan without the guidance of legal counsel. Once they get that guidance, then the natural outgrowth would be for lawyers to help implement pieces of the plan to the various agreements.

The practice of some businesses of cutting and pasting from the Internet to create their documents "is one of my huge bugaboos," Goldman says. "I absolutely believe that is a path for disaster … because you have no idea what risk management strategy the company that you are cutting and pasting from is using. They may have decided they want to live an incredibly risky life."

Goldman says the same applies to a host's Acceptable Use Policy, which typically dictates what content and conduct is acceptable on a company's network. He says he has never understood the legal benefit of a Web hosting having its own, unique Acceptable Use Policy.

"When I worry about things for a client, the first thing I worry about is my upstream vendors. Whether it's colocation or managed services, the big issue is does your upstream Internet access provider, who is providing you connectivity, have a set of rules they expect you to manage," Goldman says.

So, before writing an acceptable use policy, a host should find out if the upstream vendor has such a policy, and then follow it.

Tom Laudise, an attorney with Thacher Proffitt & Wood, a technology and intellectual property practice (tpwlaw.com) of Summit, N.J., has clients from both sides of the hosting relationship.

He says he's seen people who have use the Internet to piece together all types of documents.

"You can do it, but that is the same as me deciding that I'm going to add an addition on to my house. The results of that are that at some point in time there's going to be a big problem. I'm going to wind up spending a lot of money to correct it and I'm going to have to have a specialist come in," Laudise says. "What I would say to somebody who is contemplating doing that is that you are really in a service business and the agreement is a large part of your product. If you think that what you are providing is just technology, then you haven't yet had a dispute over the agreement."

If a host, with the help of a lawyer, develops a sound agreement once and understands it, that document may be the basis of negotiations with subsequent clients, he says.

"My feeling is that these are all relationship agreements and it's important to have terms that reflect the reality of the situation so that the relationship can work the best that it possibly can," Laudise says.