Hosting Agreement Template and How to Draft One (2026)

What is a hosting agreement, and when do you need one? A hosting agreement is a contract between a hosting provider and a customer that sets the terms for hosting a website, application or data on the provider's servers or cloud infrastructure. It covers what the provider will deliver, how much uptime it promises, who owns and protects the data, what happens when the service fails, and how either side can end the arrangement and get the data back. It applies to shared and dedicated web hosting, managed cloud hosting, colocation and application hosting alike. You need a written hosting agreement whenever a business relies on hosted infrastructure for anything that matters: a revenue-earning website, a customer-facing app, or stored personal data. The spoken promise of "we will keep it up" is not enough when downtime costs sales or a breach exposes customer data. The agreement is where uptime, security, data location and exit rights become real obligations rather than hopes. This article is general guidance, not legal advice. Hosting engages data-protection, consumer and tax rules that vary by jurisdiction, so have a qualified professional review one before you rely on it. ## Hosting agreement template Copy the block below and fill the bracketed fields. ```

HOSTING AGREEMENT This Hosting Agreement ("Agreement") is made on [DATE] BETWEEN: [PROVIDER NAME], [address] ("Provider") AND [CUSTOMER NAME], [address] ("Customer") 1. SERVICES The Provider will host the Customer's [website / application / data] (the "Hosted Content") on [shared / dedicated / cloud] infrastructure, and provide the resources and features described in Schedule 1 (the "Services"). 2. TERM This Agreement starts on [START DATE] and runs for [N months/years], renewing for successive [N]-month terms unless either party gives [N] days notice before the end of the current term. 3. FEES AND PAYMENT The Customer will pay the fees in Schedule 1, [monthly / annually] in [advance / arrears], within [N] days of invoice. Fees exclude taxes, which the Customer pays as required by law. Price changes take effect only from a renewal term and on at least [N] days notice. 4. SERVICE LEVELS (UPTIME) The Provider targets [99.9]% monthly uptime, measured as set out in Schedule 2, excluding scheduled maintenance notified in advance. If uptime falls below the target, the Customer receives service credits per Schedule 2 as its sole remedy for the shortfall. 5. SUPPORT AND MAINTENANCE The Provider will provide support via [channels] during [hours] with a target response time of [N]. Scheduled maintenance will be notified at least [N] hours in advance and run in [a low-traffic window] where practicable. 6. DATA OWNERSHIP AND USE The Customer owns all Hosted Content and data. The Provider may access it only to deliver and support the Services, and will not use it for any other purpose. Where the Provider processes personal data on the Customer's behalf, it acts as a processor on the Customer's documented instructions under the data-protection terms in Schedule 3. 7. SECURITY The Provider will maintain [describe: encryption in transit and at rest, access controls, backups every [N], patching] and will notify the Customer without undue delay, and within [N hours], of any security breach affecting the Hosted Content. 8. DATA LOCATION AND BACKUPS Hosted Content is stored in [region/country]. The Provider takes backups [frequency] and retains them for [N days]. On request the Customer may obtain a copy of its data in [format]. 9. ACCEPTABLE USE The Customer will not use the Services for unlawful content or activity, or in a way that harms the infrastructure or other customers, as set out in the Acceptable Use Policy in Schedule 4. 10. SUSPENSION The Provider may suspend the Services only for [non-payment after notice, a serious security risk, or a clear breach of the Acceptable Use Policy], with notice where practicable, and will restore them once the cause is resolved. 11. TERMINATION AND DATA RETURN Either party may terminate for material breach not cured within [N] days, or on the notice in clause 2. On termination the Provider will, for [N] days, make the Customer's data available for export, then delete it and confirm deletion. 12. LIABILITY Neither party is liable for indirect or consequential loss. Each party's total liability is capped at [the fees paid in the prior [12] months], except for [confidentiality, data-protection and indemnity obligations]. 13. GOVERNING LAW AND DISPUTES This Agreement is governed by the laws of [jurisdiction], with disputes subject to [courts / arbitration seat]. Signed for the Provider: __________ Signed for the Customer: __________ Name / title / date Name / title / date

- **Service levels (clause 4).** State the uptime target as a real number, say exactly how it is measured and what is excluded (scheduled maintenance), and set service credits that are meaningful. An uptime promise with no measurement method or with token credits is not worth much.
- **Data ownership and use (clause 6).** Make it explicit that the customer owns its content and data and that the provider may touch it only to run the service. Where personal data is involved, add the processor language and a data-protection schedule.
- **Security and breach notice (clause 7).** Describe the real controls (encryption, access control, backups, patching) and set a hard deadline for breach notification. A vague "we take security seriously" line gives the customer nothing to rely on.
- **Data location and return (clauses 8 and 11).** Name where data is stored, because location drives which laws apply, and guarantee a window after termination in which the customer can export its data before deletion. The exit is where customers get trapped, so write it clearly.
- **Suspension (clause 10).** Limit suspension to defined, serious causes with notice where practicable, rather than leaving it to the provider's discretion.
- **Liability (clause 12).** A mutual cap tied to fees paid, with carve-outs for data-protection and confidentiality, is the usual fair middle ground. ## Common mistakes to avoid - An uptime number with no measurement method or no exclusions, so the promise cannot be tested.
- No breach-notification deadline, which matters most exactly when something has gone wrong.
- Silence on data location, leaving it unclear which data-protection law applies.
- No data-export window on exit, so the customer cannot leave cleanly.
- Suspension left entirely to the provider's discretion.
- Service credits so small they do not motivate the provider to meet the SLA. ## A note on jurisdiction Hosting rules vary by jurisdiction. In India, a hosting agreement is a contract under the Indian Contract Act, 1872, personal data hosted on behalf of a customer engages the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 (including the intermediary and reasonable-security-practices rules), and fees attract GST. Data location can also carry sector rules, such as data-localisation requirements for regulated industries. In the UK, EU, Ireland, Singapore, Australia and the US, data-protection, consumer and localisation rules differ, so where the servers physically sit changes the obligations. Treat "varies by jurisdiction" as the honest default, and pin down data location before you sign. ## Where a contract workspace helps A template gets you a solid hosting agreement. The ongoing work is everything after signing: keeping uptime, security and data terms consistent across providers and customers, checking each version for weak terms before you sign, remembering renewal and notice dates, and keeping versions straight as plans and infrastructure change. Writing a hosting agreement, reviewing its uptime, security and data terms, and tracking renewal and notice dates can live together in one AI workspace tuned to how your company contracts with providers and customers, instead of being spread across separate tools. [Adira](https://adiralaw.com) is built along those lines. The template here is enough to put one fair hosting agreement in place; a workspace is what keeps drafting, review and tracking a single connected job across every provider.