Hosting and colocation provider due diligence

Due diligence on a hosting or colocation provider means verifying claims that are easy to make and hard to check from outside: uptime, capacity, data location and clean title to the equipment. Start from the seller’s statements and test each against a record somebody else created, such as a registry search, a carrier invoice or a logged ticket. A finding is not automatically fatal: depending on what it is, it may end a deal, reprice it or need only a condition or a promise in the agreement. This guide groups the work by where the evidence lives and says what question each kind of finding raises.

Public registry searches

Search the provincial personal property registry wherever the provider holds equipment or is registered. British Columbia’s guidance says to make sure personal property has no liens registered against it before buying it privately or lending against it, and Alberta’s says to search before purchasing. Ontario provides online access to its registry through Access Now, and Saskatchewan through Information Services Corporation. Quebec’s equivalent is the register of personal and movable real rights. A registered lender over the racks, switches and power equipment raises the question of whether the lender will consent to the sale or be paid out. A registration by an equipment lessor may mean some of the gear you inspected is leased rather than owned by the provider. Alberta’s search runs on the debtor’s legal name and flags inexact matches for further checking, so match the debtor name in each search to the legal name on the contracts.

The incident, breach and notice records

Some records are ones the law expects an organization to keep, which can make them useful evidence. The Privacy Commissioner’s guidance says an organization must keep a record of every breach of security safeguards involving personal information under its control, whether or not the breach reached the reporting threshold, and must keep those records for two years. Ask for the register and compare it with the provider’s incident tickets. A serious incident in the tickets with no matching entry is a finding to raise. In Quebec, the privacy regulator says organizations must notify the Commission and the people concerned of a confidentiality incident involving personal information they hold that presents a risk of serious harm, so ask whether any such notices were given.

The copyright notice log

Providers that store customers’ content may receive infringement complaints, and the Copyright Act sets out a procedure for them. A copyright owner may send a notice of claimed infringement to a person who, for the purpose set out in subsection 31.1(4), provides the digital memory used for the electronic location to which the claim relates. On receiving a notice that complies with the Act’s form and content rules, and on being paid any fee lawfully charged for doing so, that person must as soon as feasible forward it electronically to the person to whom the electronic location belongs and inform the claimant that it was forwarded or why that was not possible. It must also retain records that allow that person’s identity to be determined for six months from receipt, or for one year if the claimant starts proceedings and notifies it before the six months end. The Act makes statutory damages, within a range it sets, the claimant’s only remedy for a failure to do these things. Ask for the log of notices received, the forwarding records and who handled them. A very thin log at a large provider deserves a question.

Contracts, credits and the facility

Read the customer contracts against what actually happened. Take the service level commitments, list every outage and degradation in the period, and work out what credits each customer was owed. Credits owed and unpaid are a liability, and the purchase agreement can say who carries it. Then read the facility agreement as a buyer would: its term, the renewal right, how power and cooling capacity are allocated, who bears the cost when the building’s systems fail, and what it says about assignment, which provincial law may modify, as our guides to commercial leases in an Ontario business sale and in a Quebec business sale explain. Read carrier and interconnection agreements for minimum terms and early-termination charges that a sale could trigger.

Where the data really sits

Ask for an asset register showing where every rack and device sits, and a list of every place customer data is copied: backups, replicas and monitoring tools included. Compare both with what contracts, sales material and security questionnaires say. A provider that told customers their data stays in one province while a backup replicates elsewhere has made a promise it is breaking. Quebec customers raise the stakes: the province’s privacy regulator says an organization must carry out a privacy impact assessment before communicating personal information outside Quebec, and the communication can proceed if the assessment shows the information would be adequately protected, under a written agreement that meets set terms. A mismatch can mean a customer’s own compliance rests on a false statement.

Findings and the questions they raise

• A facility agreement that cannot be assigned or renewed on acceptable terms: ask whether a replacement site exists.
• Registered security over equipment that the secured lender will not release: ask how it will be paid out or consented to.
• Undisclosed credits owed or service level breaches: ask who carries them, for example through a price adjustment, a holdback or a specific indemnity.
• Data-location statements that do not match reality: ask whether customer notices or a migration are needed.
• A breach register that does not match the incident tickets: ask what else may not have been recorded.

Keep the working papers in an organized data room so each finding points back to the record that produced it, and run the checks above alongside the general buyer due diligence checklist.