How to compare draft and executed versions for Cloud Hosting Agreements

Compare the complete executed cloud hosting package against the last customer-approved draft, not merely the signature document. Establish which versions and attachments belong to each package, verify the comparison, and assess changes to service scope, availability, security, charges, remedies, and exit rights together with their dependencies. Record each material difference with pinpoint evidence, its effect on the hosted workload, approval status, and proposed response. The deliverable is a version comparison checklist that distinguishes accepted changes, execution discrepancies, and unresolved document gaps.

When to use this workflow

Use this workflow when customer counsel receives signed hosting documents, procurement hands an agreement to operations, or a contract file contains conflicting final versions. It is particularly useful when the order incorporates separately circulated service terms, an SLA, security commitments, and a data processing agreement.

The task is to identify changes between approval and execution and determine which require correction or informed acceptance—not to renegotiate every unfavorable provision. An unchanged concern belongs in this comparison only when it affects a changed term.

This is a US-focused transactional workflow. Rights depend on the language, governing law, facts, and deal context. The HIPAA checks apply only to covered relationships and information; other sector-specific obligations require separate assessment.

What you need

Collect the documents and evidence establishing both packages:

• The last customer-approved draft, clean and tracked copies, approval emails, and approval conditions.
• The executed master agreement, orders, signature pages, amendments, and available execution-package records.
• Each package’s SLA, support terms, security exhibit, DPA or BAA where applicable, and incorporated policies.
• Dated copies of incorporated webpages and the clauses identifying applicable versions and amendment mechanisms.
• Workload facts: service layer, deployment architecture, regions, data categories, dependencies, and export requirements.
• Pricing schedules, commencement dates, entity details, and the customer’s negotiation checklist, approved fallbacks, and escalation owners.

Preserve originals. Assign stable document IDs to working copies and maintain an inventory recording source, receipt date, version, and completeness. A filename containing “final” does not establish approval.

Use the template

Copy the Cloud Hosting Agreements — Version comparison checklist into your working document or spreadsheet. Use one row per substantive difference or unresolved package gap. Group cosmetic changes only after verifying that they have no identified substantive effect.

Source entries should include document IDs, sections, pages, and table cells where relevant. Preserve short exact extracts alongside summaries; reference longer passages in the comparison file.

Use “Dependency / uncertainty” for missing attachments, precedence questions, or technical assumptions. Explain the workload consequence in “Customer effect,” rather than writing only “high risk.” In “Approval / owner,” distinguish the authorized decision-maker from the investigator. Include the approval-record reference and any target response date in the action field. Close a row only with supporting disposition evidence.

Step by step

1. Establish the approved and executed baselines

Identify the last draft actually approved for signature and whether approval covered every schedule. If procurement approved pricing while legal approval remained conditional on a security exhibit, preserve that distinction. Do not replace the baseline with a later provider-generated clean copy without checking approval history.

Match the executed package to the customer, provider, order, and service. Inspect signatures, dates, attachment lists, and exhibit references. Check whether the received signature pages belong to the reviewed agreement version; a signature page alone does not resolve package completeness.

Record: baseline document IDs, approval evidence, and separate rows for disputed versions or incomplete attachments.

2. Map incorporated documents and precedence

Trace incorporated references from the order and master agreement. Identify each document’s name, date or version, location, and applicable precedence wording. Compare those references before comparing substantive clauses.

The AWS Customer Agreement illustrates the dependency: section 10 addresses modifications by posting or notification, while section 11.2 addresses incorporation and Service Terms precedence. This is provider-specific wording, not an enforceability conclusion about another agreement. See the AWS Customer Agreement. (aws.amazon.com)

A current webpage does not establish the historical text incorporated at execution. Request the applicable copy if unavailable. If the package uses dynamic incorporation, distinguish the execution-date comparison from a separate inquiry into later amendments.

Record: changed references, precedence differences, and unavailable versions, with an evidence-retrieval owner.

3. Generate and verify the comparison

Compare corresponding documents individually, then reconcile the package. Use comparison tools to identify additions, deletions, and substitutions, but verify findings against the underlying files. Where scanned material requires text recognition, inspect the page image before treating a discrepancy as contractual wording.

Check tables, footnotes, appendices, definitions, hyperlinks, and image-based pages. Confirm service tiers, quantities, regions, committed spend, overage rates, commencement dates, and renewal terms. A shifted pricing cell or changed definition may matter more than an extensive formatting revision.

Distinguish demonstrably removed language from language not found in reviewed material and language that cannot be assessed because material is unavailable or unreadable.

Record: verified extracts and pinpoint references, identifying comparison artifacts separately from substantive differences.

4. Test changes to service scope and availability

Read the changed SLA against the purchased architecture. Compare covered resources, measurement periods, downtime definitions, maintenance treatment, exclusions, and outage evidence. Do not assume an unchanged percentage means an unchanged commitment.

The Amazon Compute SLA distinguishes qualifying multi-zone availability from individual-instance availability and measures unavailability through external connectivity conditions. Those EC2-specific definitions do not promise application-response performance. See the Amazon Compute SLA. (aws.amazon.com)

For changed credit tables, test illustrative outages immediately below, at, and above altered boundaries. Verify the fee base, credit cap, and restrictions on combining remedies. Have the service owner validate architecture assumptions.

Record: affected workloads, changed eligibility or calculations, test assumptions, and unresolved technical questions.

5. Trace changes across remedies, security, and exit

Read related clauses together. A preserved availability promise may offer less protection if execution narrows the credit base or changes exclusive-remedy wording, damage exclusions, indemnities, or liability caps. Compare export rights with termination grounds, payment conditions, deletion provisions, and migration assistance.

AWS section 5.3 illustrates conditional retrieval rights: its specified post-termination period depends on payment and excludes a stated termination category. It is not an unconditional migration commitment. See the AWS Customer Agreement. (aws.amazon.com)

For HIPAA-covered hosting, reconcile the BAA with the SLA and access restrictions. HHS explains that maintaining ePHI can make a cloud provider a business associate even without the encryption key, and advises consistency between the SLA, BAA, and HIPAA requirements. See HHS cloud computing guidance. (hhs.gov)

Record: connected provisions, their combined consequence, and the legal or operational owner required to resolve conflicts.

6. Reconcile deviations with approval evidence

Classify each verified difference as approved, unapproved, or approval not established. Do not treat silence, signature alone, or approval of an earlier draft as proof that the specific deviation received internal authorization. This classification concerns approval evidence, not whether the executed contract is binding.

Prioritize by affected workload, outage or disclosure consequence, recoverability, and available mitigation. Distinguish commercial preferences from legal requirements. A shortened export window may be operationally unacceptable without establishing a legal violation.

Propose clarification, a corrective amendment, informed acceptance, or temporary mitigation. Preserve the signed record; proposed corrections belong in a separate document.

Record: approval references, authorized decision-maker, recommended response, and acceptance conditions.

7. Produce the disposition package

Deliver the checklist, verified comparison, inventory, and summary of material deviations. Separate confirmed changes from evidence gaps and state what remains undecided.

Hand changed claim procedures, renewal provisions, maintenance notices, and export windows to their operational owners. Preserve contractual triggers rather than converting billing cycles into assumed calendar days. The Amazon Compute SLA, for example, specifies a billing-cycle claim deadline and required claim information; these are contractual procedures, not a statutory limitation period. See its credit request provisions. (aws.amazon.com)

Record: disposition evidence or an assigned next action for every material row. Assigned issues remain open until resolved; assignment permits an accountable handoff, not a statement that the package is discrepancy-free.

Worked example

Fictional scenario: Cedar Vale Analytics purchases managed hosting from Harbor Stack Services for a reporting application. Legal approved D-07 and its attached SLA and security exhibit. Procurement receives executed package E-01. Operations documents a minimum 30-day export and replacement-validation requirement. All parties, documents, and terms below are fictional.

The review identifies two confirmed changes and one evidence gap. The supplied approval record contains no approval of the confirmed changes. For C2, the export trigger and conditions are unchanged, allowing a direct comparison of the periods.

C1 redirects the decision from the availability percentage to covered failure events. C2 warrants prompt escalation because the changed period conflicts with a documented operational requirement. C3 supports an evidence request, not a conclusion that security protections disappeared. Counsel can pursue confirmed corrections while investigating the missing exhibit.

Common mistakes

• Using the latest circulated draft. Establish the approved baseline and retain conditional approval evidence.
• Checking uptime but overlooking scope and charges. Compare covered resources, definitions, service quantities, fee tables, and credit calculations.
• Calling unavailable obligations deleted. Distinguish confirmed deletion from missing or unreadable evidence.
• Reading exit rights alone. Test payment conditions, termination exceptions, assistance, and export feasibility together.
• Correcting the signed file itself. Preserve the original and document proposed amendments and authorized decisions separately.

Final quality check

• Approval evidence supports the baseline and identifies conditions.
• Both inventories account for orders, schedules, amendments, and incorporated versions.
• Material findings have verified text and pinpoint references; unavailable evidence is labeled.
• Tables, image-based content, entities, signatures, dates, and pricing were checked.
• Availability findings reflect the actual service and deployment assumptions.
• Remedy, security, and exit findings address related provisions.
• Closed rows have disposition evidence; open rows have authorized owners and next actions.

Complete the workflow with DecoverAI

DecoverAI is the Legal Intelligence Platform for litigation and transactions. Its contract review capabilities support customer-side review in Word with deal-specific instructions. Findings quote clauses, rank severity, locate text, and identify missing language as not present. Lawyers verify findings and edit or insert suggestions as ordinary tracked changes in the signed-in Word user’s name, or dismiss findings with reasons. Tabular review supports work across multiple documents; the checklist remains the team’s work product. Keep executed originals separate from proposed corrections. Book a demo to discuss this review workflow.

Frequently asked questions

Which draft should serve as the baseline?

Use the last version supported by customer approval evidence. Identify limits where approval covered selected documents or depended on edits. Retain competing candidate versions until the responsible approver resolves the ambiguity.

Can we rely on the provider’s current online SLA?

Not as proof of historical wording. Obtain the applicable dated copy and examine incorporation and modification clauses. Treat later changes separately rather than attributing every current-page difference to execution.

Does signature establish approval of every deviation?

Do not equate execution with documented internal approval of each change. Record the approval evidence separately from questions about contractual effect. Counsel should assess any disputed consequence under the actual agreement and governing law.

Is an unchanged clause outside the review?

Not when it affects a changed provision. An unchanged liability exclusion may influence the significance of a revised SLA remedy. Record that dependency without expanding the exercise into unrelated renegotiation.

Sources

• Amazon Compute Service Level Agreement — service-specific availability definitions and credit procedures.
• AWS Customer Agreement — conditional retrieval, modifications, incorporation, and precedence.
• HHS Guidance on HIPAA & Cloud Computing — covered cloud relationships and consistency of related agreements.

Scope: October 13, 2026. Provider terms are wording examples, not market-standard evidence; live pages do not authenticate the versions applicable to a transaction.

This guide is general information about legal workflows, not legal advice for any matter. It was drafted and reviewed with AI assistance. The worked example is fictional. Contract rights and procedure depend on the governing law, the actual wording, and the facts, so check the cited sources and the rules that apply in your jurisdiction before relying on it.