Negotiating with hyperscalers and major cloud service providers

Negotiating with hyperscalers and major cloud service providers (CSPs) is crucial for any organisation looking to leverage cloud computing. As cloud services become central to business strategies, understanding how to secure favourable terms can significantly impact cost efficiency, service reliability, and overall success.

This post is for:

• IT professionals,
• legal advisors, and
• business leaders

involved in procuring and managing cloud services.

You’ll learn about the types of CSPs, the CSP perspective, and key negotiation areas such as service levels, suspension and termination rights, remedies, liabilities, and audit provisions. With this knowledge, you’ll be better equipped to secure beneficial terms and build a robust cloud strategy.

What are hyperscalers and cloud service providers?

• Hyperscalers are large cloud service providers with extensive, globally distributed infrastructure and a wide range of services. Examples include Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). These providers offer unmatched scalability and advanced technology, making them ideal for large-scale applications and enterprises.
• CSPs deliver technology and business process services via the cloud on an “as a service” basis. This means that applications are hosted remotely and delivered over the internet. Some cloud offerings cater to niche products or services, while others are broad and critical to business operations, often involving substantial contract spend.

Types of CSPs

Cloud Service Providers (CSPs) come in various types, each offering different levels of services and infrastructure.

The main types of CSPs include:

1. Infrastructure as a Service (IaaS)

   • Examples: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP).
   • Services provided: Virtualised computing resources over the internet. Users can rent virtual machines, storage, and networks.
   • Use case: Ideal for businesses needing to build virtual data centres, offering flexibility to scale computing power and storage.

2. Platform as a Service (PaaS)

   • Examples: Google App Engine, Microsoft Azure App Service, AWS Elastic Beanstalk.
   • Services provided: A platform allowing customers to develop, run, and manage applications without dealing with the underlying infrastructure.
   • Use case: Suitable for developers who want to create applications without managing the hardware and software infrastructure.

3. Software as a Service (SaaS)

   • Examples: Salesforce, Microsoft Office 365, Google Workspace.
   • Services provided: Software applications delivered over the internet. Users can access software through a web browser without installation.
   • Use case: Ideal for end-users requiring access to software applications like email, CRM, and collaboration tools.

4. Function as a Service (FaaS)

   • Examples: AWS Lambda, Google Cloud Functions, Azure Functions.
   • Services provided: A serverless computing model where code is executed in response to events or triggers, and the cloud provider manages the infrastructure.
   • Use case: Suitable for developers needing to run small pieces of code in response to events without provisioning or managing servers.

5. Managed Service Providers (MSPs)

   • Examples: Rackspace, IBM Cloud Managed Services.
   • Services provided: Comprehensive management of a company’s IT infrastructure and end-user systems.
   • Use case: Ideal for businesses looking for complete IT management services, including monitoring, security, and maintenance.

6. Specialised or niche CSPs

   • Examples: DigitalOcean, Heroku.
   • Services provided: Target specific markets or offer specialised services tailored to specific industries or applications.
   • Use case: Suitable for businesses needing specialised services like hosting for developers or services focused on a particular industry.

These different types of CSPs cater to various needs, from large-scale infrastructure to specific application services, providing flexibility and scalability for businesses of all sizes.

The CSP perspective

Understanding the perspective of CSPs is essential in negotiations.

• Hyperscalers aim to standardise their offerings to maximise efficiency. They focus on providing reliable, scalable, and cost-effective services, often at the expense of flexibility.
• Specialised CSPs, in contrast, may offer more customised and personal support due to their smaller scale and niche focus.

Areas for negotiation

Changes to the services/service levels

• Service level agreements (SLAs): Negotiate SLAs to meet your business needs, focusing on uptime, performance, and support response times. Ensure the SLAs provide meaningful service credits or compensation for breaches​.
• Service changes: Ensure CSPs communicate any changes in advance and allow you to provide input on significant changes that could impact your operations.

Suspension rights

• CSP’s rights to suspend services: Understand the conditions under which CSPs can suspend services. Negotiate to limit these rights to critical scenarios and ensure proper notice and remediation opportunities.
• Your rights: Secure the right to pause services if CSPs fail to meet agreed terms or if changes negatively impact your operations.

Termination rights

• Early termination clauses: Negotiate favourable terms for early termination, including reduced penalties or exit fees. Ensure you can terminate without penalties if CSPs fail to meet SLAs or other critical obligations.
• Transition assistance: Include provisions for smooth transition assistance to another provider or in-house solutions upon termination.

Remedies and liabilities

• Remedy provisions: Define remedies for SLA breaches, such as service credits or financial compensation. For example, if a CSP fails to meet its uptime guarantee, service credits should be substantial enough to cover the loss.
• Liability limitations: Negotiate liability caps and exclusions to protect your organisation from excessive financial exposure. Ensure CSPs remain accountable for gross negligence or wilful misconduct.

Audit provisions

• Audit rights: Ensure you can audit the CSP’s compliance with security, privacy, and operational standards. Define the scope, frequency, and cost responsibilities of these audits.
• Third-party audits: Where direct audits are not feasible, leverage third-party audit reports and certifications.

Practical examples and insights