Subcontracting in the Cloud


The rise of cloud computing services and the privacy/security issues involved have been much discussed (see, for example, our prior blog posts here). But when customers procure cloud-based services, a critical "behind the scenes" issue is often overlooked: is the cloud provider itself relying on third party subcontractors to perform critical functions? When these subcontractors are added to the mix, things become a bit more complicated.

Cloud computing offers a wide variety of services:

  • IaaS: infrastructure as a service to replace a customer's data center or testing environment;
  • PaaS: platform as a service to replace a customer's applications development environment; and
  • SaaS: software as a service to replace a customer's need to install and operate software.

Each of these services share the key characteristics of cloud computing (resourcing pooling, rapid deployment, location independence, high scalability) that are appealing to customers. It's little wonder that Gartner forecasts that the public cloud computing market will grow 18.5% this year to $131 billion worldwide.

When customers think about obtaining cloud services, they should keep in mind that a number of these services can be layered on top of each other with different providers to create a cloud "supply chain". This makes the customer-facing service more efficient and less costly.

Take, for example, an end user customer that has procured a SaaS solution. This end user customer uses the application but doesn't control the operating system, hardware or network infrastructure on which it's running. This is the trade-off that all end user customers make when implementing a cloud solution.

But it may be the case that the SaaS provider itself doesn't control all of these delivery elements. The SaaS provider, in turn, could be the customer of an IaaS solution. Under this model, the SaaS provider is hosting its application on a third party's IaaS cloud. The SaaS provider may control some of the delivery elements (e.g., the operating system and storage applications) but it would have no control over the cloud-based infrastructure that supports the application. As with the end user customer, the SaaS provider trades off operational control for scalability and efficiency. The SaaS provider's use of an IaaS solution makes the SaaS provider's solution ultimately more "cloudy" and therefore more appealing to the end user customer.

This is just one example of how a subcontractor could be involved. Cloud providers can subcontract a wide variety of functions to third parties (e.g., hosting, storage, processing, transmission, network security, etc.). A cloud provider's form agreement typically will permit it to subcontract without restriction (and, in fact, its out of the box solution may already rely on subcontractors). So when end user customers consider cloud solutions and perform their due diligence, they should think about not just the main provider, but also any subcontractors that the main provider relies on (now or in the future). This is because a failure or issue at any point in the cloud "supply chain" could affect the service being provided to the end user customer and could affect its ability to access its data.

So what are some of the key questions to ask when considering a cloud provider (and its current or potential subcontractors)?

  • Where is the data stored and who is storing it? It often will be stored by a subcontractor that is in a location with the lowest taxes and cheapest costs. Location may matter more for certain regulated industries and if the data is from certain jurisdictions like Europe. If the solution involves encryption (of either the data itself or the transmission of the data), location also may implicate U.S. export control issues. In certain jurisdictions, the government may have an easier time accessing data if it is stored by a third party in the cloud.
  • Who has the encryption keys to secure the data? If the prime cloud provider or a subcontractor has the keys, the end user customer will not have ultimate control over who can access the data. If any of these providers goes out of business, the end user customer may be unable to get to its data.
  • How are outages treated throughout the supply chain? Are there redundancies built into the system? Do availability, service response and restoration metrics apply to both the prime cloud provider and to all subcontractors? What are each party's obligations with regard to disaster recovery? Transparency is important here. The end user customer should have as much as possible an understanding of how its solution is architected throughout the chain.

There are, of course, other "due diligence" type questions to ask. But in doing so, it's always good to consider whether there are cloud subcontractors that are playing key supporting roles behind the scenes.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Pillsbury Global Sourcing Practice | Attorney Advertising

Written by:


Pillsbury Global Sourcing Practice on:

Popular Topics
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.