Introduction
Cloud computing is a general term for outsourcing of various computer/IT needs. It can involve outsourcing of infrastructure, platform and/or software applications. Cloud computing has many advantages. It greatly reduces if not eliminates the need for purchasing and maintaining large, expensive servers. It significantly reduces the need for a substantial IT staff. It allows for almost unlimited scalability. So what’s not to like?
Perhaps the most significant concern is that your data is no longer completely within your control. That fact is not overly concerning under most circumstances provided you have done adequate due diligence in selecting a provider and have proper contractual protections in place. However, even those protective measures may be of little use if the cloud provider files for bankruptcy or goes out of business.[1] At that point another set of intervening issues comes into play. Besides the obvious fact that the cloud service may no longer be available to you, it could be extremely difficult and time consuming to obtain your data — data which likely is critical to your operations. While you cannot completely eliminate these risks, there are some steps that you can take to try to minimize the adverse effects on you of a cloud provider bankruptcy.
What Happens When a Cloud Provider Files for Bankruptcy Protection?
It should be noted at the outset that there are potentially multiple participants involved in the cloud computing services being provided, whose bankruptcy could be an issue (e.g., the host, the data center – if different from the host, the Internet service provider, to name a few). While the issues raised in this article could come into play in varying degrees depending on the role of the cloud provider, for purposes of our discussion we are focusing on the bankruptcy of a party that is both the host and provider of the data center.
When a cloud provider, or any debtor for that matter, files a bankruptcy petition, a “bankruptcy estate” is created. The bankruptcy estate consists of, among other things, all legal and equitable interests of a debtor in property as of the commencement of the case (the “Estate”). The filing of a bankruptcy petition also affords a debtor the protection of the automatic stay under Section 362(a) of the Bankruptcy Code. Generally, the automatic stay prevents, among other things, any act by a non-debtor to: i) obtain possession of property of the Estate; or, ii) exercise control over property of the Estate (the “Stay”). While the creation of the Estate and imposition of the Stay provide significant benefits to the debtor, such as preventing a landlord from immediately locking the debtor out, or a secured creditor from repossessing its collateral or a utility company from immediately shutting off the electricity, the Estate/Stay dynamic presents certain challenges, as discussed below, that may impede your ability to recover your data post-petition.
A typical business may file one of two types of bankruptcy: a Chapter 7 liquidation or a Chapter 11 reorganization. In a Chapter 7 liquidation, a trustee is appointed to accumulate the bankrupt provider’s assets and sell them to pay the debtor’s creditors. While it is possible that a Chapter 7 trustee could continue the provider’s operations for a time to allow for efficient liquidation of assets (likely without providing support to you), it is more likely that the trustee will simply shut down operations (if operations were not previously shut down by the provider). The consequence is that you are left with the task of either recovering your data from the Estate and finding a new provider, or, dealing with a new provider to which your contract was assigned by the Trustee.
Financially ailing businesses, however, often believe that their financial problems can be solved and their operations saved, so rather than liquidate they try to use bankruptcy as a reorganization tool. As an alternative to filing a Chapter 7 liquidation, the cloud provider could attempt to reorganize and file a Chapter 11 petition. If this action occurs, the provider can, for most purposes, continue business as usual, which means that you would theoretically still receive the services you had been receiving pre-petition. However, the provider who files a Chapter 11 petition can (as can a chapter 7 trustee), with permission from the bankruptcy court and provided that there is no non-bankruptcy law that expressly prohibits it, assume and assign its executory contracts (those contracts under which performance is still due from both sides). Potentially, then, if your cloud provider contract meets the requirements for an executory contract, it could be assigned to a third party regardless of whether or not the contract contains a clause prohibiting assignment. Of course, before an executory contract can be assigned, it must be assumed by the debtor, which generally requires the debtor to cure certain types of defaults and provide adequate assurance of future performance. Such an assignment might not be the worst thing in the world, because it could mean the continued provision of services to you (although from a company that you have not chosen yourself). [2]
In addition to assumption and assignment, the Chapter 11 debtor also has the right to reject executory contracts. Once a contract is rejected by a debtor, the debtor is relieved of its obligations under that contract. For the counter-party to the contract, the rejected contract is treated as breached by the debtor, allowing the counter-party to file a claim in the bankruptcy court for its damages. Until an executory contract is rejected, the debtor must fulfill all of its obligations under the contract.
In the context of a rejection of a cloud provider contract, the customer would not have use of the provider’s services any longer, but it would be reasonable (and prudent) to negotiate the return of any customer data upon rejection by the debtor. There are some provisions of the bankruptcy code however that may limit the adverse effect of a rejection of a cloud provider contract upon the customer. For example, if a cloud provider contract contains a license of software and is therefore construed as, or determined to be, a license of intellectual property under the Bankruptcy Code, Section 365(n) of the Bankruptcy Code provides that even if the debtor rejects the contract, the licensee (i.e., you) may either treat the contract as breached and make its claim for damages, or, retain its rights under the contract and any other supplementary agreement thereto for the duration of the contract term or any extension thereof. The upside here is that the customer may still use the software and gain access to the source code as it all existed on the petition date (and even enforce any exclusivity provisions) – but the downside is that the customer must make its regularly scheduled payments under the contract and cannot compel the debtor to perform its obligations.
What Precautions Can You Take in Advance to Minimize the Adverse Effects of a Cloud Provider Bankruptcy?
Perhaps the most important thing you can do up front to protect yourself is to do your due diligence. Make sure you use a well-known, established, financially strong provider. You should also look into the strength of other indirect providers in the chain and learn what protections the direct cloud provider has in light of the contingencies mentioned above. Furthermore, it would be wise to address in your cloud provider agreement steps for protecting yourself in case of bankruptcy.
One of the more significant issues that could arise is whether or not your data is part of the Estate and therefore not yours to obtain/recover. Accordingly, it is critical that your agreement with the cloud provider make it absolutely clear that you own all data and information provided by or obtained from you and that the cloud provider has no legal or equitable interest in, or claim to, such data and information. It is useful as well to have, in addition to the foregoing, the cloud provider acknowledge that such data and information will not be considered by the cloud provider to be part of its bankruptcy estate. Additionally, it would be useful to require the cloud provider to agree to notify you immediately of any determination that it makes to file for bankruptcy protection, and to turn over to you before such filing a copy of all of your data in a medium that can be easily used by you.
Another issue to consider is how soon after the petition date will you be able to recover your data from the Trustee in a chapter 7 case. The reality of the situation is that a trustee, who is appointed to administer the Estate, will have very little information at the commencement of a case and will therefore be hesitant to release any property that could be Estate property. It will be up to you to press this issue with the Trustee providing whatever information may be helpful, however, even if you are vigilant, resolution and recovery of your data could take, at best, a few days, but more likely, a few weeks and at worst a few months and you might not have the luxury of time. It is advisable to try to negotiate a provision in your contract with the provider that permits you to have immediate access to your data upon the filing of a petition in bankruptcy. Even if a bankruptcy court does not enforce such a provision, the language potentially could be used as additional support or grounds for immediate relief from the Stay.
Obviously to the extent you can do it, you should be backing up the data you provide to the cloud provider. Another step you can take in advance is to require the cloud provider to provide to you at frequent intervals a copy of a backup tape/disk or backup on other sufficient media that you can easily use, so that at least you will have reasonably current data to work with if all else fails. Of course, it could be that current data is absolutely critical to you and your ability to carry out your business responsibilities, so this option might not be a completely satisfactory alternative – but it could keep things afloat while you work your way through the bankruptcy court to get your data released and turned over to you.
Conclusion
There are many advantages to outsourcing your IT needs to third parties. The benefits are not without risks however. One risk that looms in the background is the potential bankruptcy of the cloud provider. While the risk cannot be eliminated, the potential adverse effects on you can be reduced by making sure your written agreement with the cloud provider has certain provisions built in that are designed to minimize these adverse effects. Careful planning, thorough due diligence, and appropriate legal advice in connection with your agreement are important steps to help reduce the potentially crippling effects of a cloud provider bankruptcy.
