Corporations considering outsourcing to an application service provider (ASP) should be cognizant of two key legal issues in the outsourcing contract: performance and liability. They are headline issues because, with an ASP, the customer has less immediate control over the software application, the hardware on which it runs and, more importantly, its own data.
The acronym ASP covers a broad spectrum of businesses. But the basic definition describes a supplier who remotely hosts and manages software applications for its customers in return for a ?rental payment.? In addition to this rental fee, there may be additional charges based upon the number of users, the applications available, the transactions made and/or the bandwidth used.
Most performance levels are defined in service level agreements (SLA). A customer should ask the ASP for examples of SLAs they have provided to other, similar customers and look for provisions relating to speed of response, throughput, availability of functionality, support and maintenance, escalation procedures, data security, back up and disaster recovery.
End-to-End Service Levels
ASPs generally back away from providing end-to-end service levels where they have no direct control over some components, like network connectivity. This can be a problem, as customers can often find that the metrics for end-to-end service levels, such as user response time and throughput, are far more valuable than the alternatives, which are often simply a composite of application performance measured on the hosting server plus third party network traffic statistics. In practice, this may mean that there is a business case for choosing an ASP which can supply and be responsible for all the components required for the service.
An ASP contract often comes in three parts:
- The terms and conditions.
- The description of service.
- The SLA.
The terms and conditions will call down the SLA. Take care how this is done. There is a difference between ?The ASP shall perform the services to meet or exceed the SLA? and ?The ASP will use reasonable commercial efforts to perform the services substantially in accordance with the SLA.? The latter may mean that the carefully negotiated SLA is not as effective as you thought it was.
The Importance of Liability Provisions
The liability provisions are some of the most important in any contract. Although insurance can hedge risk, only contracts can effectively limit liability against the person you contract with. Every customer should check what types of liability the ASP has sought to exclude and the limit that it seeks.
It is unfortunate that ASP contracts have adopted a practice from other areas of IT and exclude liability for consequential loss and damage. Generally, consequential loss would include things which are important to the customer including the loss of profits, loss of data, and losses arising from the provision of incorrect data.
In relation to the other loss component, direct loss, the ASP will usually specify a cap on liability. UK law will not allow the cap to be unreasonably low. But buyers the world over should note that the greater the cap, the more confidence the ASP has in the performance of its service.
The customer may be able to get the ASP to pay service credits, a refund against future payment when the performance of the service falls below certain metrics set out in the SLA. This is an extremely welcome way to ensure that the ASP is encouraged to provide good performance and to look after the customer?s data. However, this turns into a very bad result for the customer if these service credits are expressed as being in satisfaction of all the ASP?s liability.
In summary, The SLA is vital. But you still need to consider the rest of the contract.
The Pitfalls of Becoming an ASP
No matter how you define ASP, it is big business. A Durlacher report last year conservatively estimated the value of the European ASP market would be $340 million by the end of this year and $1.5 billion by the end of 2004. If your contract is structured well, some of that business may be safely yours.
The principle background issue for the prospective ASP is that of rights. Where the ASP has developed its own software, it is likely that it will have the right to offer the software on an ASP basis (subject to checking.) This may not be true of other software. Software licenses are often drafted restrictively. If the ASP wishes to offer third party applications, then it must check out the licenses carefully to see if resale and/or use via ASP is permitted.
Few licenses already contemplate use via ASP. This can allow third party application providers to force ASP business onto a different licensing model. English law, however, is very flexible. If a third party software license does not permit use of an application via ASP, the ASP may be able to buy and host the software as an agent of the customer.
Once the rights over the software are sorted out, there remain the issues surrounding bandwidth and hardware. If the ASP is to offer co-location, then it may be profitable to sell the relevant hardware and maintenance. But the terms and conditions must be set out. When reselling bandwidth, the ASP needs to be clear as to the terms of the bandwidth it resold. For example, if the ASP relationship with the customer terminates early, then the ASP does not want to be stuck in a telecom contract for bandwidth to the customer?s premises for the rest of the term.
When selling ASP services, customers appear attracted by the SLA and are concerned about data loss. Clearly, the ASP needs to position itself carefully in relation to the SLA. Read the comments I made to customers in reverse. A well structured contract does not attract significant liability. One way to alleviate customer fears on data loss is to offer customer service levels in relation to back ups. Also, you can offer them an access point to be able to back up their own data.
Application service provision should become a commoditized business in time. This should help drive down the cost. Clearly, setting the customers? expectations and mapping out responsibilities, including setting out at the start how the parties will deal with complaints and changes, can assist this.
The contract process is part of those costs. Careful structuring of the contract can not only help to ensure that they are signed with the minimum of fuss, but can help ensure that risk and liability are apportioned to the right party.
Lessons from the Outsourcing Primer:
- ASP buyers must worry about liability and performance.
- Read the language in service level agreements carefully. The wording may chip away at the SLAs you negotiated.
- When an ASP offers a high cap for direct losses, it has great faith that it can deliver the service as promised.
- The European ASP market may top $340 million by the end of the year.
- Hardware and bandwidth are the headline issues for ASPs.
Ashley Winton is a partner specializing in ASP contracts at Osborne Clarke OWA, a UK law firm with the largest team of specialist IT attornies in Europe.