Tag: hosting centre

SaaS Agreements – SLA – Security Issues

As a SaaS supplier you will have noticed the increasing concerns about security voiced by SaaS customers. Your SaaS agreement should therefore provide comfort to your customer by including security provisions in the service level agreement (SLA). The specific matters you should consider including are set out below.

 Access

The persons able to access the hosting centre should be very limited and the individuals should be defined. Access should only be allowed for hardware and software maintenance. A record of all visits should be logged, which can be easily achieved if swipe cards are used. Remember that when using a third party hosting centre, access will be controlled by, and should reflect, the terms of your hosting agreement with the hosting centre.

Physical Security

This should prevent unauthorised access to the hosting centre to prevent damage, loss or theft to hardware and software. Surveillance of the hosting centre is essential and details of whether or not this is 24 x 7, via video camera, watchmen or electronic alarm systems should be included in the SLA. Within the hosting centre itself, racks themselves should be separately secured.

Hosting Environment Security

In order to provide a continuous service to customers, the hosting centre must have:

  • an uninterrupted power supply;
  • a dual power source;
  • air conditioning; and
  • fire and flood detection systems.

Server Security

In order to protect your servers, you should use:

  • up to date virus protection;
  • up to date security patches; and
  • firewalls.

Data Security

In order to protect customer data you should set out:

  • how, where and when data will be backed up;
  • how often data will be backed up;
  • where backups will be stored; and
  • when discs/tapes will be rotated.

ISO 27001 Certification

ISO 27001 is an internationally recognised security certification which is often required by SaaS customers who are looking for assurance that adequate levels of data security are in place to protect their data. Having this certification demonstrates to customers your commitment to data security by confirming that you comply with “best practice” security management.

Disaster Recovery

Is this offered at all, consider whether is it included in your standard subscription fee, or if a premium will be charged. Also, remember that your disaster recovery centre should be physically remote from your hosting centre, and with a different provider.

Commercial Considerations

The level of security obligations offered to SaaS customers will depend upon:

  • how much a customer pays for the SaaS solution, maintenance and support;
  • whether the SaaS application is business critical i.e. online banking;
  • what is standard in that particular business area.

Exclusions

Ensure that your SaaS agreement contains appropriate security obligations applicable to your customer, for example using up to date virus programmes. Exclude liability for any security breaches which are caused by something beyond your control or an act, omission or breach of your customer’s security obligations under the SaaS agreement.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – E-Discovery

As a SaaS supplier you may be ordered by a court as part of a litigation process to identify and disclose physical documents and electronically stored information (e-discovery). This creates problems for SaaS suppliers on a number of levels.

Location of the ESI

Data is often stored or replicated in an external hosting centre, the SaaS software application itself or a corporate data centre. If numerous data centres are used they are usually in different physical locations and in various countries. Discovery rules may conflict with compliance and privacy requirements in the countries where the data is held, however for the purposes of complying with your obligations under a country’s e-discovery rules the actual location of the data is irrelevant.

For example in AccessData Corporation v ALSTE Technologies GmbH a US court ordered a German company to disclose emails stored in Germany as part of the disclosure process in a court case, although the company argued that this breached the German Data Protection Act.

Compliance Issues

SaaS agreements should therefore permit SaaS suppliers and customers to comply with e-discovery requests, to avoid breaches of requests for disclosure. Although it is unlikely that any sanctions will be taken by the court against the SaaS supplier, the customer may try to claim damages for any losses it sustains. The SaaS supplier should therefore ensure that they exclude liability under the SaaS agreement for a technical or any other type of failure to comply with a disclosure request.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS, ASP Agreements – Data Protection Issues with Sub-contractors – Standard Contractual Clauses

Using a sub-contractor to process your SaaS customer data is a problem under data protection law, where the sub-processor is based outside of the European Economic Area (EEA). Incorporating EU standard contractual clauses into your SaaS agreement is NOT the solution to this common problem.

EU Standard Contractual Clauses

Under data protection law personal data may only be transferred to countries outside of the EEA where there is adequate protection. In order to deal with the problem of transfers of personal data from a customer (data controller) in the EEA i.e. in the UK, to a SaaS supplier (data processor) outside of the EEA i.e. a SaaS supplier in Asia, the EU drafted standard contractual clauses. When such clauses are included in a SaaS agreement, the requirement to provide adequate protection for the data being transferred will be met.

New EU Standard Contractual Clauses

In July 2010 the EU standard Contractual Clauses were amended to cover the position where personal data is transferred from a data controller in the EEA (customer) to a data processor outside of the EEA (supplier) and then a transfer to a sub-processor located outside of the EEA.

This is a common scenario in a SaaS agreement where a customer based in the UK is accessing SaaS software provided by a supplier outside of the EEA and the supplier is using a hosting centre or outsourced IT development centre located in India or Asia to process the customer data.

Sub-Processor located outside of the EEA

Despite the above changes to the EU model clauses, where a data processor (supplier) based inside the EEA, instructs a sub-processor based outside of the EEA, to process a customer’s data, the transfer of data is not covered by the new or old standard contractual clauses. This is a common scenario in SaaS agreements where the customer and supplier are both based in the EEA but the SaaS supplier uses a data centre or IT personnel outside the EEA i.e. in Asia to process the customer data.

The transfer of customer data to the sub-processor will not comply with data protection law if the new or old standard contractual clauses are used and an alternative solution will need to be found. This will usually take the form of an additional data protection agreement between the relevant parties.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – SLAs – Essential Elements

Have you ever wondered what should actually be included in a SaaS service level agreement, commonly referred to as a SLA?

SaaS Customers thinking of purchasing SaaS software applications – software delivered via the Internet – are often unaware of what terms should be included in the SLA.  Jargon in the SLA can seem like a foreign language and SaaS customers will often struggle to understand the terms of the SLA.

Content

A SLA forms part of the SaaS agreement and can be contained in a separate schedule or in the main terms and conditions of the SaaS agreement. The SLA contains:

  • Details about the availability of the SaaS software and services;
  • Technical details about the hosting;
  • Details about the support and maintenance of the software itself.

Review

Most SaaS customers do not accept a SaaS supplier’s SLA and may even try to impose their own SLA. Customers often review the content of the SLA, or have it reviewed by a legal expert. This can make the process painful and time consuming for the SaaS supplier, who will need to deal with numerous queries. It is therefore advisable to provide some degree of detail in a SLA to avoid unnecessary time adding or negotiating details requested by SaaS customers.

Minimum Requirements

SLAs should generally contain the following provisions, where appropriate:

  • Guaranteed availability of the services and software
  • Timing of and prior notice of maintenance;
  • Description of the security provisions at the hosting centre and the technical infrastructure;
  • Problem response and resolution times;
  • Customer support description and support hours;
  • Provision of service availability reports;
  • Backup of customer data;
  • Disaster recovery provisions;
  • Right to terminate for breaches of the SLA;
  • Service credits for breaches of the SLA.

Commercial Considerations

The degree of detail that a SaaS supplier provides in a SLA will depend upon:

  • How much a Saas customer pays for the SaaS software and services;
  • Whether the SaaS software is business critical i.e. is used for online banking;
  • What is standard in that particular business sector.

Summary

Due to the unique nature of SaaS you should seek specialist legal advice on the content of a SLA whether you are a Saas supplier or a SaaS customer to ensure that your rights are adequately protected.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: