Miami - January 30, 2020

Over the last few years, with a view to drastically cutting costs, many small-sized or medium-sized IT managed services providers (MSP(s)) have migrated their customers’ hosted database (software and data) from their on-premises physical servers and virtual machines (VMs) to the Cloud on large third party data center provider’s servers (such as Microsoft Azure). Therefore MSPs now ‘sub-contract’, for the most part, the provision of hosting services (to their customers) to third party data center providers.

However, the problem here is that MSPs sometimes omit to update the hosting services agreements they signed with their customers (IT Startups & SMBs) prior to such migration. Such omissions do not come without liability risks and exposures for MSPs. Indeed, the migration of customers’ hosted database onto third party data center provider’s servers creates a tripartite contractual equation which, in the absence of update of the hosting services agreement between MSP and its customers, suddenly renders the MSP liable to customers for hosting services (now provided by a third party data center provider) which are not provided by MSP anymore. Besides, if the initial hosting services agreement does not authorize MSP to migrate customers’ hosted database to the cloud (by sub-contracting the provision of most of the hosting services) then its update also enables MSP to formally obtain consent from Customers to proceed with such migration.

MSP’s & Third Party Data Center Provider’s Respective Liability to Customers: how does this work?

Following the migration, the third party data center provider provides most of the hosting services to MSP’s customers which requires and justifies a significant reduction in the scope of MSP’s liability towards its customers under the hosting services agreements.

The hosting services contract must therefore provide that the Customer acknowledges and agrees that the third party data center provider, in its capacity as owner, manager and controller of both physical servers and VMs, shall be the sole entity responsible and liable (a) for the proper functioning, maintenance and consistency of the physical servers and VMs, and for (b) hosting VMs.

However, on the other hand, considering that MSP’s customers are not in direct contractual relationship with the third party data center provider, the MSP should become responsible, under the hosting services contract (with its customers), for maintaining compliance with and apply the third party data center provider’s service levels (as provided under the third party data center provider’s service level agreements; for instance, in the case of Microsoft Azure, please see: https://azure.microsoft.com/en-us/support/legal/sla/) regarding for example VMs, Azure Active Directory, Azure Backup, Express Route, Storage Account / Managed Disks and Windows Virtual Desktop.

If you need your hosting services contracts to be updated, please do not hesitate to contact us, we are available 24/7 !

Dr. Ariel Humphrey