Buying a hosting and colocation provider in Canada

What a buyer acquires in a hosting or colocation business is a set of service promises, a place to keep them and the people who know how that place works. Judging the opportunity means asking whether the promises are being kept safely and at a profit, and whether they can be carried across to a new owner without breaking. The sections below cover evidence of a good provider and warning signs, what a seller may not volunteer, what you must qualify for yourself, and the questions to settle before an offer.

Evidence of a good provider, and warning signs

Busy halls and a long customer list do not show everything. Useful evidence includes customers who stayed through renewal, prices that held and an incident history that is documented rather than remembered, plus a statement of how much power, cooling and network capacity is sold, how much is spare, and who controls that capacity: a building the provider owns, or a landlord’s systems it is entitled to draw on for a limited period. Warning signs include halls filled with discounted short-term customers, dependence on one engineer who knows how everything is wired, and uptime described in marketing terms rather than from logs. Ask for the capacity plan, the carrier agreements and the largest customers’ contracts before you ask about price.

What the seller may not volunteer

These items may be missing from an information memorandum. Ask about each one directly and ask for the paper behind the answer.

• Promises made in emails rather than the contract, such as extra credits, price holds or a commitment about where data is kept.
• A hardware refresh that has been deferred to improve the profit on show.
• Dependence on one person for access, passwords and emergency work, with no written procedure behind it.
• Legacy pricing given to early customers or friends that will not survive a change of owner.
• Disputes over outages, or credits promised but not yet paid.

What you must qualify for yourself

Several approvals sit with you rather than the seller. The facility owner has to accept a new tenant; in Ontario a covenant against assignment without consent is deemed subject to a proviso that consent is not to be unreasonably withheld, unless the lease expressly provides otherwise (Commercial Tenancies Act, section 23). If the buyer is a non-Canadian acquiring control of a Canadian business, the Investment Canada Act page from Innovation, Science and Economic Development Canada says it must submit a notification or an application for review unless a specific exemption applies, and the government can review foreign investments of any size for national security, with sensitive technology, infrastructure and personal data among its stated concerns. A hosting provider may hold data and infrastructure of those kinds. An established operator buying to consolidate should ask a lawyer whether the Competition Act’s notifiable-transaction rules apply, since they catch transactions of a specified type that exceed their thresholds and are not exempt. Where Quebec’s private-sector privacy law applies to the business, Quebec’s privacy regulator says the person who operates it is responsible for protecting the personal information it holds, the person with the highest authority acts as the person in charge of that protection and can delegate the function in writing, in whole or in part, and the person in charge’s title and contact details must be published on the business’s website or, if it has none, made available by another appropriate means. If a seller relies on PIPEDA subsection 7.2(1) to show customer information to a buyer during due diligence, the parties’ agreement must require the buyer to use and disclose it solely for purposes related to the transaction, protect it with safeguards appropriate to its sensitivity and, if the deal does not proceed, return or destroy it within a reasonable time.

Privacy and security as a buying issue

Customers may carry their own legal duties for the personal information they store with a provider. The Privacy Commissioner’s guidance treats an organization that transfers information to a processor as still responsible for reporting a breach that happens there, while noting that control is assessed case by case, and says an organization must keep a record of every breach involving personal information under its control, whether or not it reaches the reporting threshold. Ask the seller for that record, for the incident reports customers received and for any customer who left after a security event.

Who else is looking

Ask whether larger hosting and data-centre operators that could move the customer base into their own facilities, or infrastructure-focused investors, are also looking. A broker who knows this sector may be able to say who has been looking and why earlier talks failed. Deavo is a listings platform rather than a brokerage and works alongside brokers instead of replacing them.

Questions to settle before an offer

1. Does the provider own its facility, and if not, how long does its right to stay run and can it renew?
2. How much power, cooling and network capacity is sold, and what limits the next customer?
3. Which upstream carriers does it depend on, and would one failing take every customer offline?
4. What do customer contracts say about assignment, service credits and termination, and which customers are off-contract?
5. Where does customer data physically sit, backups included, and does that match what customers were told?
6. What would it cost to bring the hardware to a current standard, and when was it last replaced?