For Web Apps, Get a Service Guarantee

What should a business manager look for in a service level agreement? The most basic item should be an uptime commitment for application availability, ideally 99.9 percent of the time or above. It should also address planned maintenance downtime, which, if too frequent, can become bigger burdens on customers than accidental outages.

When negotiating, inquire whether the SAAS vendor owns its own data centers or whether it depends on a partner, and be sure to investigate who the partner is and the extent of its infrastructure. Also verify that the SAAS vendor has key certifications, such as the SAS 70 Type II audit.

The SLA should address performance, as well, because   an application that is extremely slow will affect a company's operations. It's also a good idea to include provisions for the data created with the applications and to put in writing what responsibility the vendor will assume for data that is lost, corrupted, or stolen, along with statements about   the vendor's data security measures and data backup and recovery services.

Kaplan recommends assuming the worst--that the vendor may go out of business altogether. To protect against that eventuality, customers can request that the vendor bring in a third-party "escrow" provider that will, for example, house the applications source code and data, in case the SAAS vendor goes under.

Business managers need to remember, too, that they must be proactive in securing a satisfying SLA, because SAAS vendors are understandably reluctant to volunteer generous service guarantees. Many elements outside of a SAAS vendor's control can interfere with the performance of its applications and with the integrity of data. Such external factors can include interference from security software on users' PCs, problems with the customer's local network, ISP issues, and structural Internet hiccups.

"Every provider will write an SLA, especially if you ask them, but it's going to cover things that they can control," Burton Group's Maiwald says.

Still, industry experts agree that, little by little, both buyers and SAAS vendors are recognizing the importance of SLAs, so business managers should find securing them progressively easier.

Help is coming indirectly by way of large enterprises, which initially limited their SAAS deployments to small groups and individual departments but are now extending their rollouts, sometimes companywide, says Forrester analyst Liz Herbert.

As a result, though business managers with little software-purchasing experience often used to be the only people negotiating with SAAS vendors, now IT and corporate procurement departments are getting involved and extracting more service guarantees from vendors, she says.

As vendors--such as Google, with its Apps Premier--set their sights on the enterprise market, they are hearing the message that feeble SLAs won't cut it there, says Eric Berridge, cofounder of Bluewolf, which provides consulting services to large companies adopting hosted applications.

"Google is probably 12 to 24 months away from being considered an enterprise play with Apps. They need to work on the SLA piece," Berridge says, adding that the suite's SLA must be extended beyond Gmail for enterprise acceptance. Bluewolf, a Google partner, is certified on Apps Premier deployments and is itself a satisfied user of the suite, whose uptime it considers solid. It also does consulting for customers of Salesforce.com and other SAAS vendors.

SAAS applications have so far been used for important processes--including office productivity, e-mail, customer relationship management, project management, and human resources operations--but they're not as common in industrial-strength operations in which downtime is outright deadly, such as back-end stock-trading systems and real-time point-of-sales transactions. When SAAS gains more traction in that critical application area, robust SLAs will follow. "When we get to that point in the SAAS market, you'll see a whole new type of SLA emerge," Berridge says.

Those and other factors will move the SAAS market toward stronger SLAs. "It's going to be an evolutionary process, driven a lot by customer demand, competitive pressures, and the specific nature of applications and their target audience," ThinkStrategies' Kaplan says.

Already, some SAAS vendors are adopting aggressive SLA postures. Mailtrust, which provides hosted e-mail primarily for small businesses, offers a 100 percent uptime guarantee. "We want to make it known to our customers that downtime is just not acceptable," says CEO Pat Matthews.

Mailtrust, which is backed by parent company Rackspace, a managed hosting specialist, also doesn't lock customers into long-term contracts, but rather renews the engagements on a monthly basis. Thus, dissatisfied customers can walk at any time, with no penalties.

In addition, Mailtrust has invested in troubleshooting and diagnostic tools so that it can help customers identify problems, even if they aren't on Mailtrust's end, something that Matthews says customers appreciate. "We embrace that [troubleshooting] part of our business, and we work really hard to make sure we don't get in the habit of blaming customers or third parties," he says. Mailtrust's uptime stands at 99.997 percent, according to RealMetrics.com.

Meanwhile, OpSource, which provides services to software makers of all sizes that want to deliver their applications over the Internet as SAAS, also offers 100 percent uptime for its servers and for the availability and performance of its customers' applications in its OpSource OnDemand service, says Chief Marketing Officer Richard Dym. "We made the decision that it made sense not to fool around," says Dym, whose company's clients include BMC and Business Objects.

Dym also sees a broader shift in the SAAS market toward stronger SLAs. "With SAAS, the SLA concept is now making inroads into the delivery of software over the Web," he says.