Service Scope
Define services, resource allocation, API access, uptime targets, backup frequency, and accepted usage. Be explicit about excluded services and change management to avoid scope creep.
A Cloud Hosting Agreement clarifies service expectations, allocates cybersecurity and compliance responsibilities, limits liability for outages, and sets pricing and termination terms. Clear agreements reduce operational risk, support regulatory compliance such as HIPAA or state privacy laws, and streamline dispute resolution.
Organizations that commonly use a Cloud Hosting Agreement include companies outsourcing infrastructure, software vendors, and regulated healthcare or financial institutions.
Choose or tailor the agreement based on industry compliance needs, contract value, and data sensitivity.
The primary signer is typically the customer's CIO, CTO, or head of procurement authorized to accept service levels, pricing, and data handling terms. Ensure their legal name and title match corporate records to avoid enforceability challenges, and confirm authority in a board resolution if required.
On the provider side, an officer or contracting manager signs with delegated authority. If hosting involves regulated data (HIPAA, GLBA), obtain written confirmation of compliance commitments and any required subprocessor lists before signing.
Define services, resource allocation, API access, uptime targets, backup frequency, and accepted usage. Be explicit about excluded services and change management to avoid scope creep.
Specify measurable uptime, response and resolution times, credits for downtime, maintenance windows, and escalation contacts. Include metrics and methods for uptime calculation and dispute resolution for SLA breaches.
Detail encryption standards in transit and at rest, access controls, vulnerability management, and incident response obligations including notification timelines and remediation responsibilities.
State applicable certifications, regulatory obligations (HIPAA, SOC 2, PCI DSS), audit rights, and whether a Business Associate Agreement or similar addendum is required.
Clarify geographic data residency, cross-border transfers, export compliance, and whether the customer can require specific regions or data centers.
Set notice periods, service wind-down assistance, data return or secure deletion procedures, and fees for early termination or transition support.
| Workflow Field and Configuration Name | Configuration |
|---|---|
| Routing and signer order configuration | Sequential or parallel; conditional branches |
| Authentication method and verification level | Email OTP, SMS code, or KBA for high risk |
| Notification, reminders, and deadlines settings | Email reminders, expiration alerts, escalation steps |
| Retention and archival handling after signing | Auto-archive signed PDF; set retention duration |
Decide how you will distribute the agreement and which integrations are necessary for downstream systems.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial, no credit card required | Varies by vendor | Varies by vendor | Varies by vendor | Varies by vendor |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | No | No |
| Envelope Cap | No cap | 100 envelopes/user/year | Varies by plan | Varies by plan | Varies by plan |