Subcontracting in the Cloud

The rise of cloud computing services and the privacy/security issues involved have been much discussed (see, for example, our prior blog posts here). But when customers procure cloud-based services, a critical "behind the scenes" issue is often overlooked: is the cloud provider itself relying on third party subcontractors to perform critical functions? When these subcontractors are added to the mix, things become a bit more complicated.

Cloud computing offers a wide variety of services:

  • IaaS: infrastructure as a service to replace a customer's data center or testing environment;
  • PaaS: platform as a service to replace a customer's applications development environment; and
  • SaaS: software as a service to replace a customer's need to install and operate software.

Each of these services share the key characteristics of cloud computing (resourcing pooling, rapid deployment, location independence, high scalability) that are appealing to customers. It's little wonder that Gartner forecasts that the public cloud computing market will grow 18.5% this year to $131 billion worldwide.

When customers think about obtaining cloud services, they should keep in mind that a number of these services can be layered on top of each other with different providers to create a cloud "supply chain". This makes the customer-facing service more efficient and less costly.

Take, for example, an end user customer that has procured a SaaS solution. This end user customer uses the application but doesn't control the operating system, hardware or network infrastructure on which it's running. This is the trade-off that all end user customers make when implementing a cloud solution.

But it may be the case that the SaaS provider itself doesn't control all of these delivery elements. The SaaS provider, in turn, could be the customer of an IaaS solution. Under this model, the SaaS provider is hosting its application on a third party's IaaS cloud. The SaaS provider may control some of the delivery elements (e.g., the operating system and storage applications) but it would have no control over the cloud-based infrastructure that supports the application. As with the end user customer, the SaaS provider trades off operational control for scalability and efficiency. The SaaS provider's use of an IaaS solution makes the SaaS provider's solution ultimately more "cloudy" and therefore more appealing to the end user customer.

This is just one example of how a subcontractor could be involved. Cloud providers can subcontract a wide variety of functions to third parties (e.g., hosting, storage, processing, transmission, network security, etc.). A cloud provider's form agreement typically will permit it to subcontract without restriction (and, in fact, its out of the box solution may already rely on subcontractors). So when end user customers consider cloud solutions and perform their due diligence, they should think about not just the main provider, but also any subcontractors that the main provider relies on (now or in the future). This is because a failure or issue at any point in the cloud "supply chain" could affect the service being provided to the end user customer and could affect its ability to access its data.

So what are some of the key questions to ask when considering a cloud provider (and its current or potential subcontractors)?

  • Where is the data stored and who is storing it? It often will be stored by a subcontractor that is in a location with the lowest taxes and cheapest costs. Location may matter more for certain regulated industries and if the data is from certain jurisdictions like Europe. If the solution involves encryption (of either the data itself or the transmission of the data), location also may implicate U.S. export control issues. In certain jurisdictions, the government may have an easier time accessing data if it is stored by a third party in the cloud.
  • Who has the encryption keys to secure the data? If the prime cloud provider or a subcontractor has the keys, the end user customer will not have ultimate control over who can access the data. If any of these providers goes out of business, the end user customer may be unable to get to its data.
  • How are outages treated throughout the supply chain? Are there redundancies built into the system? Do availability, service response and restoration metrics apply to both the prime cloud provider and to all subcontractors? What are each party's obligations with regard to disaster recovery? Transparency is important here. The end user customer should have as much as possible an understanding of how its solution is architected throughout the chain.

There are, of course, other "due diligence" type questions to ask. But in doing so, it's always good to consider whether there are cloud subcontractors that are playing key supporting roles behind the scenes.

Written by:

Published In:

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Pillsbury Global Sourcing Practice | Attorney Advertising

Don't miss a thing! Build a custom news brief:

Read fresh new writing on compliance, cybersecurity, Dodd-Frank, whistleblowers, social media, hiring & firing, patent reform, the NLRB, Obamacare, the SEC…

…or whatever matters the most to you. Follow authors, firms, and topics on JD Supra.

Create your news brief now - it's free and easy »

All the intelligence you need, in one easy email:

Great! Your first step to building an email digest of JD Supra authors and topics. Log in with LinkedIn so we can start sending your digest...

Sign up for your custom alerts now, using LinkedIn ›

* With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name.