Acts of God: Sorry, That's Beyond Our Control

By Doug Kaye

April 19, 2002 -- (WEB HOST INDUSTRY REVIEW) -- Why do you outsource your Web hosting? Among the reasons are your vendor's impervious data center and the robustness of its connectivity. You want to protect your Web site operations from outages due to lightning strikes, fires, floods, earthquakes, theft, vandalism, terrorists, labor strikes, power failures and fiber cuts by the infamous backhoe. You want to ensure that your content will be delivered quickly and reliably.

But take a look at your web-hosting contract and SLA and what do you see? Exclusions for force majeur and problems "beyond our control."

Isn't protection for your Web site against such risks one of the reasons you selected your vendor? Remember that data center tour with the salesperson? What about those beautiful facilities that can withstand a nuclear attack, the triple power grids, the overkill N+3 generators, and the fancy FM-200 fire suppression system? What good is a vendor's claim that its facilities protect you from risks if it won't support that claim in its contracts?

Force Majeure

Realistically, you'll find it difficult to get web-hosting vendors to take contractual responsibility for force majeure, defined as an unexpected or uncontrollable event. Their insurance underwriters insist that limitation of such liabilities be in all contracts. But you should carefully review what's included in force majeure. What's beyond the vendor's control and what isn't? If, for instance, you're hosting your site in redundant, geographically diverse facilities owned and operated by a single vendor, you should get at least some level of contractual protection against losses due to force majeure.

I encourage my clients to challenge prospective vendors to exclude from force majeur or acts of God any services they claim are particularly robust during their sales cycles or in their marketing materials.

Remember, any risk not assumed by the vendor remains yours. You'll have to either cover such risks with an insurance policy of your own or assume the risk yourself.

Off-Net SLAs

Another issue is responsibility for delivery of your data once it leaves your vendor's own network. This issue usually causes vendors to draw a proverbial line in the sand, over which they won't cross. From a vendor's point of view this is a no-brainer. How can it possibly take responsibility for anything under the control of someone else? This makes sense if you're a vendor, but as a customer it doesn't address your requirements. You need to get those packets delivered to a Web site visitor, and you need to have confidence they'll get there.

This is a case in which more progressive (and aggressive) vendors step up to the plate. While a vendor can't actually control the handling of individual packets once they leave its network, the vendor does have some control over the business and technology relationships with its ISP partners. Some vendors do a better job of managing these relationships than others, and it's the results of good relationship management (as measured by its effect on connectivity) that you should be looking for in an SLA. You can't hold a vendor accountable for packet loss or latency on each and every connection, but you can and should expect that the vendor will manage its infrastructure and peering relationships so that the connectivity you receive (when measured abstractly and objectively) is at least as good as, let's say, the industry average.

Specifically, you can measure your Web hosting vendor's connectivity as perceived by visitors to your Web site, and compare it to an average of such measurements from a statistically significant number of similar vendors. The philosophy of this approach is that a vendor can be held accountable for the overall effectiveness of its peering and other relationships relative to the effectiveness of other vendors. The best way to do this is via an independent, objective third-party measurement service.

If your contract and SLA contain exclusions for things that are "beyond the vendor's control" it may mean, in essence, that the vendor has no responsibility for the very services for which you're paying. Read those contracts and SLAs carefully, and shop around for a vendor that will put into writing what it claims in its brochures.