Location, Location, Location

“Location, location, location” ' does this rule of the “real” estate world matter in the “virtual” business world online?

Today, no business starts without planning its Web site and online strategy. But is the same attention given to the choice of the Web site host as to the more exciting aspects of the site design? For example, you should not choose your host on price alone, as a commodity purchase. Instead, you should consider other factors, just as in choosing any vendor or business partner.

This concern about the issues that a hosting agreement should address is only increased by the current trend toward cloud computing (see, http://en.wikipedia.org/wiki/Cloud_computing), as the “cloud” ' the offsite host ' becomes the location of your firm's data and programs (although, in this case, it is the cloud service provider's host that matters) (see, http://blogs.zdnet.com/SAAS/?p=899&tag=nl.e539). The recent controversy over Microsoft's apparently temporary loss of its Sidekick customers' data highlights the potential harm in this area (see, http://forums.t-mobile.com/tmbl/category.id=Sidekick and http://online.wsj.com/article/BT-CO-20091015-710685.html). If your business depends on the integrity of your “cloud,” then you should choose it with the same care as you would use in selecting a Web site host.

Offline, as reinforced by the real estate agent's maxim, the right location can spell success ' or disaster ' when setting up a real shop. As in many areas of Internet law and practice, the virtual world is no different. Your host should disappear into the background, and make “everything easy,” so that you can concentrate on the business. Potential customers should be able to reach your site, without delays or downtime. Usage reports should let you know who is visiting your site, where they came from and what they did while on your site.

Very Fine or Hard?
It's Up to You

Sadly, that is not always the case, even though the choice of your hosting provider has many consequences, positive or negative, that may not be apparent when reading the often non-negotiable boilerplate in the hosting agreement. Let's discuss how some of what is in that boilerplate, and the considerations behind selecting a host, can make your virtual home “very fine” ' or very “hard” for your customers and clients to use.

For example, how reliable is your provider? Just as no real-world business would remain long at a building that was open only intermittently, or lost power and utilities without warning, a hosting provider should, at a minimum, guarantee that the Web site will be available, and that it will not lose the data you have stored there. Normal maintenance can be scheduled, but a good host will have backup systems in place to handle outages or downtimes, whether these are planned or unexpected.

Moreover, does the host have enough server capacity to handle your expected traffic? Are there backup facilities, to assure uninterrupted service through any problems, or extra support when you anticipate a surge in traffic, for example, on the day after Thanksgiving? The level of backup capacity will affect your ability to remain open for business should a force majeure event limit your host's “normal” services.

Because of the importance of these issues, perhaps there should be a legal standard of care for Internet hosting services, much like that imposed on providers of essential services because of the critical importance of the host, not only to many online businesses, but so much of modern society. But such a legal duty is certainly not the law yet, and especially not actual practice in hosting agreements. Despite the seemingly obvious requirement that a hosting service actually provide service, and avoid outages or loss of data, many hosting contracts routinely deny responsibility to provide uninterrupted service, or to keep what you put on the host server. Such disclaimers are the online equivalent of a warehouse owner who warns that property stored at the warehouse might be stolen or lost, or an office building whose doors are locked and opened on an unpredictable schedule.

Instead, many hosting firms' lawyers try to protect their clients through their forms, through hosting contracts that contain boilerplate disclaimers and other legal protections that can actually undercut the hosting company's marketing. Language such as the following (quoted from agreements selected from top results in a search for online hosting agreements, rather than particularly egregious examples) is all too typical in the industry:

[Hosting Company] makes absolutely no warranties whatsoever, express or implied. As a result, the Customer agrees that [Hosting Company] shall not be liable to the Customer for any claims or damages which may be suffered by the Customer, including, but not limited to, losses or damages resulting from the loss of data (including database data in any format), email data, delays, non-deliveries, or service interruptions. The customer also acknowledges that by using any shopping cart system, whether provided by [Hosting Company] or not, [Hosting Company] will not be held responsible for charge backs, errors, loss of revenue, loss of data, web server failure, downtime, or any disputes that may arise from the use of any shopping cart system. (See, http://ipcolo.us/forms/ipcolo.hosting.agreement.pdf.)

Similarly, another contract provides that:

[Hosting Company] shall have no liability or responsibility for any direct, indirect, incidental, or consequential damages suffered by you in connection with your use of or inability to use the [Hosting Company] Services including, but not limited to, damages from loss of data resulting from delays, non-deliveries, misdeliveries, service interruptions, or the inadvertent release or disclosure of information sent by you even if the same is caused by [Hosting Company's] own negligence. (See, http://vtlink.com/vt2/legal.htm.)

Also, you must consider and investigate whether the hosting firm keeps its security procedures up-to-date. While the client and its employees should certainly build a secure site, a good hosting provider can probably handle many such functions more efficiently with scale economies. Yet some firms even deny that responsibility, notwithstanding today's focus on the importance of online security. Consider, for example, the following:

You agree that neither Business Professional nor its Service partners shall, under any circumstances, be held responsible or liable for situations where the data stored or communicated through the Service are accessed by third parties through illegal or illicit means, including situations where such data is accessed through the exploitation of security gaps, weaknesses or flaws (whether known or unknown to Business Professional at the time) which may exist in the Service. (See, www.business-prof.com/bpwebsite.nsf/SaaS%20Host ing%20Agreement?OpenPage.)

Be Sure the Host Can Handle It

Why should any firm trust its Web site to a host that does not have adequate systems and backups in place to avoid such problems ' or to provide its customers uptime guarantees that will give comfort that the business will not be down at a critical time?

And these concerns are not just theoretical. Consider, for example, the problems plaguing the Commonwealth of Virginia from its
recent, state-wide computer-upgrade program (see, www.washingtonpost.com/wp-dyn/content/article/2009/10/13/AR2009101303044.html?wpisrc=newsletter). According to news reports, important government offices, including the Department of Motor Vehicles, were unable to provide services during periods of computer-service interruptions, and other agencies could not open offices because of computer problems.

While Virginia's problems may have been unique, both because of the scale of the state-wide project and the complications of mixed public and private management, the service interruptions it faced nonetheless should be every IT manager's worst nightmare: When an e-commerce business network is down, it is not selling or making money.

The solution, if possible, is to negotiate for a strong performance warrant that states the site will operate without problems for as long as the host will agree to provide the hosting and operations. The warranty should be backed up by an indemnity, that is, an obligation to pay you money to make you whole for losses if the warranty is breached by service problems or outages. Beware, however, of common indemnity caps, or limitations of liability.

In the real world, however, most firms will not be able to negotiate such protections, as evidenced by the existence of boilerplate like that quoted above that can be found in many hosting agreements. While a very large firm may have the leverage to wrangle some contractual protection, most seeking a hosting provider must “take it or leave it.”

Keep in mind, too, that just as when selecting any vendor, there are still ways to try to protect your firm. First, perform due diligence on the provider, and determine how likely it is that the provider will be able to perform. Also, consider the financial strength of the provider, as well as its technical expertise ' a great warranty from a company that will go out of business as soon as claims are filed will be of no comfort. Should a problem occur, your host should be able and willing to stand behind all its promises in its contract with you.

If contractual protection is not realistically available, insurance coverage can help when problems occur ' your coverage, and your host's coverage ' but it won't be a lifesaver. Tripp Craig, a sales executive and risk-management consultant with the NSM Insurance Group (see, www.nsminc.com, and see disclosure note at the end of this article), a national insurance brokerage that has placed such coverage with internationally recognized carriers like Travelers, Chubb Corp. and AIG, warns that typical business-interruption coverage, for lost profits due to a host's failure to perform, “would typically respond.”

However, the limits available to the insured are set at fairly insignificant amounts. In certain cases, “Impairment of Computer Services,” or similarly termed coverage, may also be available but, again, limits offered are capped at low limits. In other words, your own insurance may cover small losses, but not a major outage ' for that, you may have to sue the host, and confront the disclaimers limiting its liability as discussed earlier in this article.

In that case, the host will look to its own carrier for funding to settle the case ' if it has the correct coverage, and in an amount sufficient to cover your firm's losses.

“Typically the hosting firm should consider professional liability coverage for failure to perform, breach of contract, and failure to render services,” Craig says. “In certain instances we negotiate a blended insurance contract containing both professional liability and intellectual property coverage to address breach of data and trade secrets events, depending on the needs of our clients, which include both companies who provide hosting services as well as firms looking for related services.”

Therefore, Craig also seconded the author's recommendation that the hosting firm should, ideally, provide a certificate of insurance, so that any claims for its default will be charged against its policy, rather than against yours.

“Companies considering hosting services should absolutely obtain proof of coverage to ascertain the financial strength of the hosting company's carrier, as well as the limits provided,” Craig adds. “Another prudent move may be to obtain an idea of any applicable deductibles and the financial strength of the hosting company.”

Is Your Business a Regulated One?

Additional protection may be necessary in regulated industries.

“If the hosting company's clients deal with information related to HIPPA regulations and other types of information perceived as highly sensitive, every effort should be taken to avoid potential situations of underinsured and/or uninsured coverage areas,” Craig says.

Although shifting risk to a third party seems attractive, he warns that you shouldn't count on insurance alone ' your own or the hosting company's ' but instead, you should look to the integrity and assets of the host, not its insurance company's.

“Many insureds are under the impression that their primary general liability policy will respond to alleged third-party business-interruption losses, but in most cases this is a false and dangerous assumption,” Craig warns. “If the hosting company's response is to refer to their general liability policy as their source of coverage, it may be time to consider another service provider.”

Just as in doing your own due diligence on a prospective hosting provider, your firm's insurance broker should be able to assist you in this process. Describing his own firm's services, Craig advises: “Reviewing sample client contracts and certificates of insurance, both what our clients are required to provide and what they request from their service providers, are routine services the NSM Insurance Group provides as part of a risk management approach to address and minimize our client's total cost of risk.”

Look for a Little Extra Help

Fortunately, consideration of hosting contracts isn't always about what can go wrong. As noted earlier in this article, a Web site host can assist your business, too. Hosting contracts often also involve a large marketing component, the assistance the host provides its client in getting its Web site noticed online.

Frequently, the hosting company is primarily a marketing concern that offers hosting as a “loss leader” to get advertising and Web-development business in the door ' especially when one considers that the aggravation of changing domain-name service and other e-commerce links effectively means that a firm's first hosting contract often becomes its permanent one, even if the first firm was chosen solely on low price, rather than quality of service provided.

Also, because Web site marketing has become an art unto itself, scrutinize carefully the level of marketing services promoted by a hosting provider, because simply performing the act of registering a Web site online may do very little, if anything, to get your site noticed. Instead, consider the lifetime costs of a good hosting service ' your Web site should not be a static object, so your marketing of it should evolve and grow as well. Beyond the technical requirements, can your host help you and your programmer grow your business, with marketing reports based on the latest technologies? Will your host quickly alert you to changing usage patterns, or new or unexpected sources of visitors to your site (so that you can negotiate linking contracts)?

Cindy Speaker, president of Speaker Media and Marketing, and creator of StateLawTV (see, http://statelawtv.com), marketing services for personal-injury law firms, emphasizes the importance of the relationship between hosting and marketing services in advising her clients on choosing a proposed Web site host.

“In my experience, only a very small firm would use a hosting company that does not also handle their Web site development,” Speaker says. “Your Web site is really foundational to your marketing program and marketing is all about relationships. I recommend that a firm choose a Web site hosting and development company that is interested enough in their business to contribute innovative ideas on a regular basis. If the Web company is simply competing on price and serving up the one size fits all solution, then at best, your Web site will struggle to obtain average results.”

Of course, hosting companies often have their own agendas, ones they pursue in addition to trying to meet yours. Many, for instance, may blend Web site hosting and design agreements with a sale of other services, which may be complementary to their basic duties. For example, I have seen a firm that markets accounting software integrate its software packages with an e-commerce Web site development team, to build front- and back-office products simultaneously.

But a risk that comes with the convenience of using such firms can be the “all or nothing” approach ' you may want to switch development duties, but not if it would involve the costs and delays of changing all your hosting needs. Even worse, if the original agreement does not make the Web site content the property of the customer, rather than of the host/developer, then the firm would have to start over with a new Web site (or pay to buy ' again ' the site it thought it had acquired with the original agreement). Review carefully the language in the hosting or development agreement about intellectual property rights, especially if you see the term “work made for hire.”

Even worse, many developer/hosts use proprietary templates, so separating the site from its server or developer may not be possible. Firms that pay to create a customized site should, therefore, be sure to negotiate not only to own the rights to the site, but also to get the code, software tools and other information necessary to use it at another host site.

Seek Beyond the Obvious

A host's expertise in other areas beyond the contract may also be relevant. For example, knowledge and experience in a firm's industry may be valuable in helping the customer market itself and compete ' as long as the host is not bound by any noncompetition agreement preventing it from using what it has developed for one client for the benefit of another. A host firm that is experienced in building and promoting social-networking sites would also offer an advantage to a firm interested in promoting itself in that emerging area of e-commerce.

At a mechanical level, you should see whether the host will take any responsibility to monitor and maintain the Web site, including handling security issues, or whether your firm must handle those matters itself, or pay someone else to do so. In today's security-conscious world, the level of security projected by your firm and your host may make the difference in attracting new business and retain established business.

At a basic level, will your host be sure to renew all your domain-name registrations on a timely basis? A client of my firm allowed its domain name to lapse, inadvertently, and had to pay several thousand dollars to the offshore speculator that quickly bought it from (presumably) a lapsed-name list ' after the Web site became a porn site overnight.

The hosting firm should also make your site user-friendly, especially if the hosting firm is also the Web site developer. Today, no firm need outsource routine site updates, when the technology exists to allow basic work to be done with typical desktop software in the ordinary course of business. Your contract with the hosting firm and with the development firm should confirm that ability. More complex sites, however, should be left to the professionals.

For many online firms, the “virtual back office” can be just another overhead item, getting far less attention than the PR campaign or the Web site design. Without that attention, however, it can devour not only the profit margin, but also the hard-won customer base that won't come back to your site if it does not function well.

Therefore, don't automatically sign a hosting agreement because you believe it is non-negotiable boilerplate. It probably is, but investigate whether the firm providing it to you can help you grow your business, and whether the firm will work with you, notwithstanding its legal right not to do so under typical boilerplate hosting agreements.

In the interest of full disclosure, I and my firm represent the experts quoted in this article, NSM Insurance Group, and Speaker Media and Marketing.