Common security structures in hosting agreements, what each one protects against, and how to keep a deposit from becoming a loan to your host.
A host asks for several months of hosting fees paid up front before your machines go live. Is that normal, or is it a sign the deal is not what it looks like? It depends less on how many months are involved than on what the payment is for, and most contracts do not say clearly enough which of two different things it is.
Two different instruments wearing one label
A security deposit and a prepayment of hosting fees get discussed in the same conversation and often sit in the same line of the schedule, but they protect against different failures and behave differently when something goes wrong.
A deposit is collateral. It exists to cover the operator against a customer who stops paying, damages equipment through misuse, or walks away from the contract before the notice period runs out. It is meant to be returned, in whole or in part, once the term ends without incident, and it should be described in the contract as returnable rather than as revenue.
A prepayment is different. It is hosting fees paid ahead of the period they cover, and once that period passes, the money is earned by the operator and is not coming back. A prepaid balance is not a deposit that protects you; it is service bought in advance, and if the relationship ends partway through the prepaid period, what you are owed back is a question of contract mechanics, not a question of the payment having been held for your benefit.
The two get blended in practice when a schedule states a single up-front figure without saying which portion is which. Split that single line before you sign: how much is deposit, how much is prepayment, and what triggers each one being drawn down.
What a deposit is meant to cover
Ask the operator directly what scenario the deposit is sized against. Common answers are unpaid invoices at the point of termination, damage to hosting infrastructure attributable to the customer's hardware, or the cost of removing and storing machines the customer does not collect within a stated window. A deposit sized against a real scenario is easier to reason about than one that is simply a round number applied to every customer regardless of fleet size or contract length.
The mechanism matters as much as the amount. If the operator draws on the deposit, does the contract require notice and an itemised reason before the draw happens, or can the amount simply be applied and reported afterwards? A deposit you cannot query before it is spent is not really functioning as security for you, only for the operator holding it.
Custody and what happens to the money meanwhile
Where does the deposit sit while the contract runs? Held in the operator's general operating account, it is functionally a loan to the business, indistinguishable on the operator's books from working capital. Held in a separate account, ring-fenced from day-to-day operations, it is closer to what most customers assume a deposit already is.
Ask about this directly rather than assuming, because the contract often does not say. Is the deposit held separately from operating funds, and if the operator's own obligations lapse, is there a clear basis for the customer to recover it ahead of other creditors, or does it sit with everything else the business owes?
What survives if the operator's business runs into trouble
This is the scenario the deposit language rarely addresses head-on, and it is the one that matters most. If the host cannot pay its own bills, is insolvent, or the site is repossessed by its landlord or lender, what is left of a deposit that was sitting in the general account rather than held separately?
Our hosting agreement guide goes through security and collateral clauses in more detail, including the point that most drafts address what secures the operator against the customer and say little about the reverse. Raise that asymmetry before signing, not after. A related question sits next to it: what notice period applies if the operator wants to end the relationship early, since a deposit is only as useful as the time you have to act once you learn you need it. We cover that in minimum terms and notice periods.
What you can reasonably ask for in return
Security does not have to run in one direction. A customer paying a deposit or a large prepayment can reasonably ask for something back in exchange: written confirmation that the deposit is held separately, a defined and itemised process before any amount is drawn, and a stated timeline for returning the balance once the contract ends cleanly. None of that is an unusual ask, and a host that has already thought through its own security structure should be able to answer without treating the question as adversarial.
Before agreeing to any up-front figure, get four things in writing: the split between deposit and prepayment, the specific events that allow a draw against the deposit, where the money sits while the contract runs, and what happens to the balance if either side exits early. If the draft in front of you does not answer one of those, that is the question to raise before the figure gets wired.
Our own terms, security included, are set out in the service agreement, which comes with a quote from our hosting rate page, on the view that a customer should be able to read the mechanism before they are asked to fund it.
