On-Demand Software and Service Level Agreements

By Minda Zetlin

On-demand software customers worry about the prospect of outages. In a recent survey of more than 400 IT executives by Rackspace Managed Hosting, 59% listed application uptime as a major concern about software-as-a-service (SaaS).

They're right to be concerned.

"There will always be outages with any provider," says Elie Ashery, president and CEO of Gold Lasso, a hosted software provider that provides mass mailings to opt-in email lists. "The question is, how often, how severe, and how are they dealt with?"

A certain amount of downtime may be inevitable with all hosted applications, but there are things that IT managers can do to reduce the chances of prolonged unplanned downtime and minimize the effect if an outage does happen. Here's how:

Choosing the right provider
Not all hosted software providers are created equal. "The software-as-a-service model allows vendors to come out of nowhere," says Rob DeSisto, vice president and distinguished analyst at Gartner. "Two guys with a garage can get themselves up and running."

To avoid being the customer of an outfit like this, make sure to get answers to the following questions:

• How long has the provider been hosting this application? "Software-as-a-service can be complicated to deliver, so hosting providers who have offered a specific service for less than a year or two are often working out the kinks," notes Rurik Bradbury, vice president of strategy at hosted software provider Intermedia. "Ideally, a provider should have more than two years experience hosting the specific application being considered."
• What are they hosting it on? "Many providers use no-name equipment and will not say what facility they use for hosting," Bradbury says. "This is a very bad sign." Instead, he recommends using providers who host their data at a Tier 3 data center at a minimum, using the Uptime Institute's widely accepted rankings (in which Tier 4 is the most reliable and Tier 1 is the least reliable). The data center should also use major brand-name equipment not bought second-hand, he says.
• Is it possible to visit the data center? The best way to find out what's actually happening in a data center is to go there -- if the vendor will allow it. "If I'm a customer that will buy 5,000 seats, I'll probably get a visit to the data center, but if I'm a small company, they won't let me visit anything," DeSisto says. For example, Salesforce provides customers with information about its infrastructure and security on a Web site that was set up after the much-publicized December, 2005 outage.
• What's the backup plan? "A good provider will have a backup plan, even if it's a small company like we are," Ashery says. "Ask to see the plan in writing and incorporate it into the service level agreement." In the best case, the provider will also have a second data center available, in case of a local disaster such as a hurricane or flood.
• Does the provider have the right certifications? "Two key ones are SAS 70, which shows the provider has been audited for controls and security safeguards, and PCI compliance, which is required by major credit card networks," Bradbury says.

Crafting the contract
Once a reliable provider is chosen, the best line of protection against outages is a carefully worded contract. Surprisingly, despite the high level of concern over possible outages, more than a third of IT executives in the Rackspace survey weren't sure what amount of uptime was specified in their contracts. It's important to know exactly what's in the contract, and to create a document with real teeth in case of an outage. Aim for the following:

• Guaranteed application uptime of at least 99.7% "Some vendors don't have service level guarantees for uptimes at all, so the first step is getting that clause into the contract," DeSisto says. Gartner recommends that contracts should specify 99.7% uptime in relation to unplanned outages (planned outages announced well in advance don't count). "We assume that the customer is shooting for 99.5% uptime, but there may be interruptions, due to such issues as Internet connectivity, that are not the vendor's responsibility."
• Restitution for outages In an ideal world, hosted software vendors would reimburse customers for the business impact of outages -- but in the real world no vendor would agree to such terms. On the other hand, it's not reasonable either for vendors to simply reimburse customers on a pro-rated basis for whatever time the software was down.

It's often possible to strike a compromise in which the vendor is indemnified against business losses caused by an outage, but does have to pay a penalty. Sometimes the penalty takes the form of credit for more time than the software was actually down. "For instance, if the system is down for an hour, the customer might get credit for that day," DeSisto says.

• A termination clause Some vendors insist on annual, rather than month-to-month contracts that come with heavy penalties for customers who want to bail out early. But the customer shouldn't be penalized for leaving the contract early if the reason for the departure is unsatisfactory uptime performance. There should be a clause allowing the customer to leave with little or no penalty if the vendor misses its service levels by significant margins. Determining just what amount of downtime triggers a release from the contract is part of the negotiation.

What if there is an outage anyway?
Legal remedies and reimbursements may help defray some cost in the event a hosted software provider has an outage, but they're unlikely to completely make up for lost revenues -- or lost goodwill. So the best strategy is to be as prepared as possible in case a provider's software does go down. Unfortunately, it's probably impossible to completely replace hosted software in an outage, but there are some things that can minimize its effects. Consider these steps:

1. Running replacement software in-house. Best practices dictate that hosted software customers should regularly back up copies of their data in-house. Of course, having the data alone is not enough during an outage: they also need software that can replace the hosted application. Some hosted software providers offer non-hosted versions that can run without connecting to the host server, though usually functionality is more limited. In some cases, these non-hosted versions can serve as a stop-gap during an outage.

2. Establishing outage procedures. What should staff do first if the software goes down? Which tasks should be performed in-house, manually if need be, and which should be left till the outage is over? Creating a detailed plan for staff to follow in case of an outage can keep things functioning as smoothly as possible, and prevent employees from panicking.

3. Keeping customers in the loop. Companies that use hosted software as a customer interface should keep in mind that customers may be surprised and confused if they try to use the system and find it isn't there. "Something as simple as a maintenance page with information as to what customers should do and what they should expect can go a long way toward helping you manage their experience," says Glen Willis, a consultant in PA Consulting Group's IT Consulting practice. "That could have a more significant long-term business impact than pursuing legal remedies."

While planning for outages is important -- and it's wise to assume they will happen -- experts agree that this is no reason to avoid using hosted software. After all, few companies experience 100% uptime with in-house software either.

"Usually a hosted software provider is better at managing server performance and keeping the system running than its customers would be with in-house IT staff," Ashery points out. "It's one of their core competencies."

Minda Zetlin is co-author, with Bill Pfleging of The Geek Gap: Why Business and Technology Professionals Don't Understand Each Other and Why They Need Each Other to Survive (Prometheus Books).