An e-commerce client loses forty-eight hours of revenue during a datacenter outage. The host's terms cap indemnity at the last month's subscription — nine euros — and exclude all indirect damage. The client's lawyer sends formal notice. Your clause was "market standard." It is not necessarily enforceable.
Hosting terms of service frame price, duration, termination — and above all liability limits. Poorly drafted, they protect little in litigation and scare informed clients. Well calibrated, they align risk, service level, and pricing without illusory promises.
If you are a provider, your terms are your contractual shield — provided they match what you actually sell. If you are a client, they reveal what the host truly assumes when everything goes wrong.
Clauses to reread with a critical eye
The indemnity cap — often twelve months of billing — deserves careful reading. Check whether data-related damage, GDPR violations, or business interruption are excluded from the cap or silently absorbed by a general clause.
Indirect damage exclusion is standard in B2B; it remains negotiable for strategic clients requiring broader coverage. Force majeure becomes problematic when it includes cyberattack, datacenter power failure, or undocumented subcontractor fault — events at the heart of hosting.
Best efforts versus result obligation distinguishes standard hosting — best efforts — from absolute availability promises outside measured SLA. Finally, the backup clause: "client responsible for backups" is acceptable if clear; it becomes abusive if snapshots are sold as included without tested restore procedure.
| Clause | Risk if poorly calibrated | Good reflex |
|---|---|---|
| 1× MRR cap | Insults pro client | Tier by offer or SLA+ option |
| Data exclusion | GDPR conflict | Aligned DPA + SLA |
| Unilateral termination | Reversibility | Notice + documented export |
An illusory clause does not protect you — it signals you do not stand behind the service level sold.
Align terms, SLA, and DPA
Three documents, one coherent story. The SLA defines measured availability, credits for downtime, and planned maintenance exclusions. Terms set a cap consistent with that SLA — no "without warranty" contradiction beside a measured commitment. The DPA specifies GDPR roles, incident notification, and subcontractor list.
For sensitive clients, offer an annex with RTO, priority support, and raised cap — rather than generic clause copy-pasted from an online template. Cross-read Host liability to understand role split during incidents.
B2C versus B2B: two regimes, two requirements
In B2C, abusive clauses are more easily set aside. In B2B, contractual freedom is broader — but an informed enterprise client will systematically negotiate caps, exclusions, and SLA credit mechanisms. Anticipating that negotiation beats discovering at the first major incident that your standard clause does not hold.
The peak: commercial and contractual double talk
Decide and move forward without blind spots
This week, reread your terms, SLA, and DPA side by side and harmonize caps, exclusions, and commercial promises. If you are a client, request a consolidated version before signing and reject vague wording on data liability. Compare host contractual transparency via the directory and compare tool, then see Breach notification to align incident clauses with your GDPR register.
Frequently asked questions
Can you exclude all liability for an outage?
Not absolutely, especially B2C. Even in B2B, gross negligence and fraud are not excludable. Caps must stay proportionate to service and price.
Is a "last 12 months' fees" cap standard?
Very common, but challengeable if disproportionate to real harm. Also read what the cap excludes — data, GDPR, business interruption.
Must SLA and terms say the same thing?
Yes, imperatively. Contradiction between measured SLA and "without warranty" clause creates a gap in negotiation and litigation.
Who is responsible for hosted data?
The publisher for content; the host for infrastructure per the DPA. Terms must not silently shift infrastructure fault to the client.
Credible terms protect what is actually guaranteed — not what marketing would have liked to promise.