Provider Terms of Service: The Clauses That Matter

Cloud terms of service run to tens of pages and are agreed to with a
checkbox. Reading all of it is not a reasonable expectation. Reading six
sections is, and those six determine almost everything that can go wrong between
you and a provider.

1. Acceptable use

The most practically important section, because breaching it is the fastest
route to suspension and the breaches are often accidental.

What to look for: whether outbound email is restricted, whether
cryptocurrency mining is prohibited, what counts as excessive resource use on a
shared or free tier, whether network scanning and penetration testing require
prior permission, and what content restrictions apply.

Two of these catch people regularly. Outbound email on port 25 is blocked by
default essentially everywhere, which is covered in
port 25 and outbound email. And
mining is prohibited on most free tiers specifically, which is why free tier
abuse detection is aggressive.

Note also that you are responsible for what happens on your infrastructure
even when you did not do it. A compromised server sending spam is your policy
breach, which is one more reason for
basic server hardening.

2. Suspension and termination

This section tells you what can happen and how fast.

Look for: what triggers immediate suspension versus a notice period, how you
are notified and at which address, what the appeal process is, and how much
notice you get for termination.

Most providers reserve the right to suspend immediately for acceptable use
violations and to give notice for billing problems. The notice address matters
enormously, because warnings are routinely discovered after the fact in an
unmonitored mailbox.

3. Data retention after termination

The clause with the hardest deadline in the whole document.

Look for: how long data is kept after suspension or closure, whether you can
export during that window, and what is deleted immediately versus retained.

Retention windows are typically measured in weeks. After that there is no
recovery and no appeal that changes it. This single clause is the strongest
argument for keeping backups outside the account, as set out in
backups: what your provider
does not do for you and
what happens to your data when an
account is suspended.

4. Liability and service levels

Expect liability to be limited to something modest, commonly related to what
you paid over a recent period. Expect lost profits and consequential damages to
be excluded. Expect the service to be provided without warranties beyond the
uptime commitment.

This is standard and not unreasonable, given the price. The implication is
that the financial consequences of an outage sit with you, which is why your own
architecture and backups matter more than the guarantee, as discussed in
what an uptime guarantee really
promises.

Check also whether the uptime commitment applies to your deployment shape.
Several providers offer their headline figure only for multi-zone deployments,
so a single instance may be covered by a lower commitment or none.

5. Changes to the terms

Providers reserve the right to change terms and pricing. Look for how much
notice is given, how you are notified, and whether continued use constitutes
acceptance, which it usually does.

This matters because it is the mechanism by which the deal you evaluated can
become a different deal. Notice periods are generally reasonable; the risk is
again that the notification goes to an address nobody reads.

6. Account ownership and transfer

Look for: whether accounts may be transferred and by what process, whether
sharing credentials is permitted, and what identity verification is required for
account changes.

Essentially all providers prohibit transferring an account to someone else
outside their own formal process, which is the contractual basis for the
practical problems described in
why purchased accounts get
suspended. It is also why a legitimate transfer, between an agency and a
client for instance, should use the provider’s documented mechanism rather than
a handover of credentials.

A reasonable approach

1. Skim the acceptable use policy before deploying, specifically checking
   anything unusual about your workload.
2. Note the data retention period after termination and write it down.
3. Confirm which address receives notices, and that someone reads it.
4. Check whether the uptime commitment applies to how you actually deploy.
5. Keep a copy of the terms as they stood when you agreed, since they
   change.

That is perhaps twenty minutes per provider, and it covers the parts that
determine what happens on a bad day.