Dear Cloud, I Think We Have Trust Issues: Cloud Computing Contracts and Trust

Abstract

Cloud computing is the dominant paradigm in modern computing, used by billions of Internet users worldwide. It is a market dominated by a small number of hyperscale cloud service providers. The overwhelming majority of cloud customers agree to standard form click-wrap contracts, with no opportunity to negotiate specific terms and conditions. Few cloud customers read the contracts that they agree to. It is clear that contracts in cloud computing are primarily an instrument of control benefiting one side, the cloud service provider. This chapter provides an introduction to the relationship between psychological trust, contracts and contract law. It also offers an overview of the key contract law issues that arise in cloud computing and introduces some emerging paradigms in cloud computing and contracts.

Use of Commercial SaaS Solutions in Swedish Public Sector Organisations under Unknown Contract Terms

“…([69] (our translation)) Further, the City of Stockholm also finds that contract terms for M365 can "be changed at any time" and that it is impossible for the PSO to determine if a tool can or cannot be lawfully used [69]. The observation that the provider of M365 unilaterally can change the contract terms confirms previous research, which has reported that cloud service providers "typically reserve the right to change contract terms and policies unilaterally" [37].…”

“…An investigation of all relevant contract terms and conditions for use of cloud based SaaS solutions from global providers illuminates significant challenges [1,8,10,35,37].…”

“…Market concentration involving a few dominant global providers of cloud-based Software-as-a-Service (SaaS) solutions has caused concern amongst nations and public sector organisations for disproportionate supplier dependence [30]. When a public sector organisation (PSO) acquires and uses a SaaS solution from a global provider, such as Microsoft 365 and Google Workspace, this implies that data processing and maintenance of the organisation's digital assets may be exposed to many sets of regulations applicable in different countries and different lock-in effects, which imposes a number of legal, technical and societal challenges [8,9,11,22,26,27,35,37,40,51,53,57,66,69]. Previous research shows that many Swedish PSOs have acquired a specific globally provided SaaS solution (Microsoft 365) without having addressed critical issues, including the need to identify, analyse, and maintain all contract documents containing all applicable contract terms and the need to obtain all necessary licences, before use of the acquired SaaS solution [34,35].…”

“…Several studies show a range of technical, economic, and legal issues which cause challenges related to use of cloud based SaaS solutions [10, 28,35]. Major issues include the use of complex and time limited contract terms for such solutions [1,37,70]. In the EU, there are several initiatives that seek to address data sovereignty and concern over lawfulness and appropriateness of using cloud based SaaS solutions from global providers by seeking alternatives.…”