How to use this managed hosting provider checklist for vendor due diligence
When you select a managed hosting provider, send every candidate the same questions and ask for written answers with supporting documents. That makes proposals comparable and keeps your vendor assessment on record. Assign the question groups to procurement, information security, data protection and IT operations, and write the commitments your decision relies on into the contract.
The questions are numbered throughout, so you can point to individual items in the bid comparison. Below each question you will find what to look for in the answer. Rate every answer on one of three levels:
| Level | How to recognize it |
|---|---|
| Documented | A document exists, such as a certificate with its scope, a contract template or a test log. |
| Committed | The statement is binding because it is part of the proposal or the draft contract. |
| Stated | The statement appears only on a website or in a slide deck, or was made verbally. Ask for evidence. |
Print the list with your browser's print function or the “Print the checklist” button. The printout leaves out navigation and buttons, adds two lines below each question for the provider's answer and never splits a question across a page break. More guides are in our knowledge hub. Our own answers follow at the end of the list and on our Security & Compliance page.
Location and law: data center, governing law, jurisdiction
Start by establishing which data centers run your systems and backups, who operates them and which law governs the contract. A country name alone is not an answer: your risk analysis, data protection review and emergency planning need the operator, location and role of every site.
Which data centers run your systems and backups, and who operates them?
Operator and location of each site, with the address in the contract on request, including backup and fallback sites.
What role does each site play?
Production, backups or failover, and what happens if an entire data center goes down.
Which law governs the contract, the SLA and the data processing agreement (DPA), and which courts hear disputes?
One governing law for all contract documents and a venue for disputes within your own legal system.
Can the provider move your systems to another site without your consent?
Advance notice and a right to object or terminate.
Contract and SLA: availability, response times, service credits
A percentage in a service level agreement (SLA) says little until you know where it is measured, which period it covers and which outages are excluded. Ask for the definition, measurement method and consequences of a breach in writing, along with response times by priority, contract term and notice periods.
How is availability defined, and where is it measured?
Measurement point, reference period (month or year) and how planned maintenance is treated. Our availability calculator guide shows how much these choices change the figure.
Which response and restoration times apply per priority level?
Separate targets for response and restoration, clearly defined priority levels and the service hours during which the clock runs.
What happens if the provider misses a commitment?
Service credits or other remedies, their amount and whether credits are applied automatically.
What term, notice periods and pricing rules apply?
Minimum term, renewal, price adjustments, setup fees and services not included in the price.
How does the provider report against the agreed targets?
Regular reports on availability and incidents, measured as defined in the SLA.
Data protection: DPA, subprocessors, third countries
If a provider processes personal data on your behalf, Art. 28 GDPR requires a contract governing that processing, known as a data processing agreement (DPA); in Germany it is called an AV-Vertrag. Also check which other service providers are involved and whether data reaches a third country, including through support tools such as remote access, ticketing or monitoring.
Is there a DPA under Art. 28 GDPR, and can you review it before signing?
The minimum content under Art. 28(3) GDPR, such as processing only on documented instructions and your right to audits, including inspections.
Which subprocessors does the provider use?
A complete list with service and location. Under Art. 28(2) GDPR the provider needs your prior written authorization; with a general authorization it informs you of intended changes so you can object.
Does any data reach a third country, including through support tools?
Besides the data centers, email, ticketing, remote support and monitoring. Transfers to a third country are governed by Art. 44 et seq. GDPR.
Which data does the location commitment cover?
Data on the systems, backups, logs and contact data may be handled differently.
Evidence: whose certificate covers what?
A certificate only proves what falls within its scope. A data center operator's certificate, for example under ISO/IEC 27001, covers that operator's organization within the scope it states, typically building, power, cooling and physical access. It does not cover how the hosting provider runs your systems. For every certificate, check the holder, the scope and the validity.
Which organization is the certificate issued to?
If it is meant to cover your provider's operations, your provider's name must be on it.
What scope does the certificate state?
The sites, services and processes covered; it says nothing about the rest.
Is the certificate valid, and who issued it?
Expiration date and certification body, shown on the document itself, not by a logo.
What evidence exists for the provider's own operations?
A certificate of its own, an attestation or audit report, or otherwise logs and reports from day-to-day operations.
Operations: monitoring, on-call duty, escalation, coverage
For critical systems, what matters is who at the provider responds at night and on weekends, and how firmly that is agreed. Ask about the scope of monitoring, how on-call duty is staffed, the escalation paths and how incidents are documented. With smaller providers, coverage during absences is a key question.
What is monitored, and from which perspective?
Every layer from hardware to application, with health checks from the user's perspective.
Who responds to alerts outside business hours?
Around-the-clock on-call duty, including public holidays, with a documented alerting chain and the number of people who share it.
How is coverage handled during vacations and sick leave?
A designated deputy with access to documentation and systems.
How do escalation and communication work during an incident?
Escalation levels, fixed contacts, a deadline for the first notification to you and a written post-incident report.
Security: patching, hardening, access, encryption
Ask which measures protect your platform, and get deadlines, procedures and responsibilities in writing. Generic statements such as “hardened to current standards” do little for your risk analysis. If the provider refers to a standard, ask for its name and scope. The four questions cover patching, hardening, privileged access and encryption.
Within what timeframes are security patches applied?
Deadlines by severity, a procedure for critical vulnerabilities and interim measures until a patch is available.
Which standard is used to harden the systems?
The name of the standard or concrete measures such as minimal services, restrictive firewalls and network segmentation.
How is privileged access secured?
Multi-factor authentication, personal accounts, logging of administrative access and revocation of rights when staff leave.
Which data is encrypted, and who manages the keys?
In transit and at rest, assessed separately for production data and backups, plus key management.
Backups: separation, retention, restore tests, deletion protection
A backup only protects you if it is stored separately from production, kept long enough and proven to restore. Replication within a cluster does not replace it, because it copies deletions, errors and ransomware-encrypted data just like valid changes. Ask about the technology, the schedule and the evidence.
Where are backups stored, and how are they separated from production?
Separate systems, separate credentials and a second site.
How often are backups taken, and how long are they retained?
An interval that matches your tolerable data loss (RPO, recovery point objective) and retention periods that meet your requirements.
How often are restores tested, and do you receive the results?
Restore tests on a fixed schedule, with a written log and the measured time to restore.
Are backups protected against deletion and modification?
Immutable or offline copies and separate credentials, so an attacker with administrator rights cannot delete them.
Failover testing: rehearsed, logged, repeated
Whether a high availability architecture survives a failure only becomes clear in a test. Ask whether the provider rehearses component failures before go-live and regularly afterwards, and whether you receive the results in writing. A test log with measured times carries more weight in your vendor assessment than any architecture description.
Is failover tested before go-live?
Loss of a node, a network link and a storage path, logged before acceptance.
How often is failover tested during operation?
An agreed schedule, with a say for you in timing and scenarios.
What does the test log contain?
Scenario, measured switchover and recovery times, deviations and follow-up actions. Our guide to split brain, quorum and fencing explains why a cluster needs quorum and fencing to fail over safely.
Are there emergency plans for scenarios beyond automatic failover?
Plans for events such as the loss of a data center or data loss, with owners and the date of the last test.
Documentation: what you receive and who owns it
Documentation decides whether you can act during an emergency, an audit or a provider change. Before signing, clarify which documents you receive, how they are kept up to date and whether they belong to you. If knowledge about your environment sits only with the provider, every switch becomes slow and expensive.
Which documentation do you receive, and in what form?
Architecture, configuration, access and emergency plans, in writing and readable without the provider's tools.
Does the contract give you ownership of the documentation?
Ownership or an unrestricted right of use, including after the contract ends.
How is the documentation kept current?
Updates after every change, versioned configuration and a visible revision date.
Exit strategy: data return, formats, proof of deletion
An exit plan sets out how you get your data and systems back when the contract ends. For personal data, Art. 28(3)(g) GDPR requires the DPA to provide for deletion or return at your choice. Agree on formats, deadlines and migration support in the contract as well.
In what format and within what deadline do you get your data back?
Open, documented formats for data, virtual machines and configuration, with a fixed deadline after the contract ends.
How does the provider support a migration, and what does it cost?
Scope, duration and price of the provider's support, for example parallel operation and data handover.
How is deletion confirmed?
Written proof of deletion for production data and backups, unless a legal retention obligation applies.
Supply chain: assessing IT service providers and their suppliers
Your hosting provider is part of your supply chain and relies on service providers of its own, such as data center operators, network providers, and software and support vendors. A weakness at any of them can affect your systems just as much as one at the provider itself. So ask whom the provider uses, how it manages these service providers and how quickly it notifies you of incidents.
Keep the written answers on file together with your assessment. That way you can later show how you made your choice, for example in audits of your information security or in reviews against the security requirements of your industry.
Which service providers does the provider itself rely on?
Data center operators, network providers, backup targets, and software and support vendors.
How does the provider assess and monitor its own service providers?
A documented procedure with security requirements in its contracts, regular reviews and the evidence the provider requires from its service providers.
Within what deadline does the provider notify you of security incidents, and what audit rights do you have?
A contractual deadline that fits your own reporting channels and deadlines, plus audit rights; for personal data, Art. 28(3)(h) GDPR requires the provider to allow for audits.
How we answer these questions
This checklist applies to managed-cluster.net as well. Our answers are on our Security & Compliance page: data location, the DPA, operational measures and the documents you receive from us. By the rating above, these are website statements; what is binding is the operations contract. The list is deliberately vendor-neutral and includes criteria on which we publish no information today.
According to the operator Maincubes, the FRA01 data center is certified to ISO/IEC 27001 and ISO 9001. These certificates cover the data center, not our operations, as detailed under operator certifications. We agree the availability target, response times by priority level and recovery targets with you in the operations contract. Which tasks we take on in operations and which stay with you is summarized in our overview of responsibilities.
Where this website makes no statement
- Location and law: the operator of our second site NBG01, the venue for disputes, your rights if we move to a different data center
- Contract and SLA: how availability is measured, contract term and notice periods, setup fees, service credits
- Data protection: the list of subprocessors, third-country links of auxiliary services in operations such as email, ticketing and remote maintenance
- Evidence: the validity of the data center's certificates, a certification of our own operations
- Operations: the number of people on call and how absences are covered
- Security: patch deadlines by severity, multi-factor authentication for privileged access, encryption of stored data
- Backup: backup interval, retention period, how often restores are tested, immutability of backups
- Exit: deadline and format for returning data, support and cost when you switch providers, proof of deletion
- Supply chain: how we assess and monitor our own service providers, deadlines for notifying you of security incidents, audit rights beyond the audits required under Art. 28 GDPR
Ask us these questions as you would any provider. Tell us your requirements, and we will tell you plainly what we can document today.
How we put this into practice
Security & compliance at managed-cluster.net
Three layers with separate responsibilities: the data center with its operator, platform operations with us, and your application and data with you.
Three layers of responsibility