How to Review a Hosting Agreement: A Clause-by-Clause Checklist

How to review a hosting agreement without missing what matters Reviewing a hosting agreement is about four things: whether the uptime promise is real and testable, who owns and protects your data, when the provider can cut you off, and whether you can leave with your data when you want to. Hosting is usually sold on the provider's standard terms, so the question is less "can I rewrite this" and more "do I understand where this contract leaves me exposed if the service fails or I want to move". This checklist works from the customer's side, which is where the risk mostly sits. This is general guidance, not legal advice. Hosting engages data-protection, consumer and tax rules that vary by jurisdiction, so have a qualified professional review anything business-critical. ## A fast first pass before you read clause by clause Spend two minutes on these. They set how carefully you read the rest. - What uptime is promised, and how is it measured? The SLA and its measurement method.

• Who owns the data, and where is it stored? Ownership and data location.
• When can the provider suspend or terminate? The suspension and termination triggers.
• Can you get your data out on exit? The data-return window. ## The clause-by-clause checklist 1. Services and scope. What exactly is hosted and on what infrastructure. Red flag: a description so vague you cannot tell what resources or features you are actually paying for. 2. Service levels (uptime). The uptime target, the measurement method and the remedy. Red flag: an uptime number with no stated measurement method, broad exclusions that swallow the promise, or service credits so small and so hard to claim that the provider has no real incentive to meet the SLA. 3. Support and maintenance. Support hours, response times and how maintenance is notified. Red flag: maintenance the provider can run at any time without notice, and no response-time commitment on a business plan. 4. Data ownership and use. Who owns the hosted content and whether the provider may use it. Red flag: anything less than clear customer ownership, or a right for the provider to use your data beyond running the service. 5. Security and breach notification. The security controls and the deadline for telling you about a breach. Red flag: a vague "we take security seriously" with no described controls, and no breach-notification deadline, which matters most exactly when something goes wrong. 6. Data location and backups. Where data is stored, how often it is backed up and how long backups are kept. Red flag: silence on location, which leaves it unclear which laws apply, or no backup commitment at all. 7. Acceptable use. The content and conduct rules. Red flag: rules so broad or vague that normal use could be read as a breach, giving grounds to suspend. 8. Suspension. When the provider can suspend the service. Red flag: suspension in the provider's "sole discretion" with no notice, for anything rather than defined, serious causes. 9. Termination and data return. How the agreement ends and what happens to your data. Red flag: no window to export your data after termination, or deletion so fast you cannot migrate. This is where customers get trapped, so read it closely. 10. Fees and price changes. The pricing and how it can rise. Red flag: price increases mid-term or with little notice, and automatic renewal with a hard-to-hit cancellation window. 11. Liability. The cap and the carve-outs. Red flag: the provider capping its liability at a token amount while leaving you exposed, with no carve-out for data-protection breaches. 12. Governing law and disputes. Which law applies and where disputes are heard. Red flag: a distant forum that makes any real complaint impractical. ## Red flags to negotiate or weigh before signing - An uptime promise with no measurement method or with token service credits.
• No breach-notification deadline in the security clause.
• Silence on where your data is stored.
• No data-export window on exit, so you cannot migrate cleanly.
• Suspension in the provider's sole discretion with no notice.
• Price increases mid-term, or auto-renewal with a cancellation window you are likely to miss. On standard hosting terms you may not win every point, but uptime measurement, breach notification, data location and the exit window are worth pressing on, especially for anything business-critical. ## How to run this review in ten minutes Read a hosting agreement in the order that affects your business, not top to bottom. 1. Start with the SLA and how uptime is measured. If the promise cannot be tested, it protects nothing. Confirm the measurement method, the exclusions and that the credits are meaningful.

2. Then read data ownership, location and security together. Confirm you own your data, know where it sits, and have a hard breach-notification deadline.
3. Then read suspension and termination with the exit clause. Make sure you cannot be cut off without notice for minor issues, and that you can export your data on the way out.
4. Finally, read fees and liability. Check how prices can rise, how renewal and cancellation work, and that the liability cap is not token. Note every clause you would want changed and raise them together before you commit anything business-critical to the service. ## A note on jurisdiction Hosting rules vary by jurisdiction. In India, a hosting agreement is a contract under the Indian Contract Act, 1872, hosted personal data engages the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 (including reasonable-security-practices and intermediary rules), and fees attract GST. Regulated sectors may require data to stay in-country. In the UK, EU, Ireland, Singapore, Australia and the US, data-protection, consumer and localisation rules differ, so where the servers physically sit changes your obligations. Treat "varies by jurisdiction" as the honest default, and confirm data location before you rely on the service. ## Where a contract workspace helps Reviewing one hosting agreement by eye is manageable. The work grows when a business runs across several providers on varying uptime, data and exit terms, with renewal and notice dates to track and security obligations to monitor. Drafting, reviewing, tracking and governing hosting agreements can sit in one AI workspace tuned to how your company runs its infrastructure. Adira is built to hold that work in one place.