Long lock-ins
A three or five year minimum term is a big commitment for a service you have not yet experienced. If the provider underperforms in the first six months, you may face a choice between putting up with it and paying out the remaining term. Some long contracts bundle hardware into the monthly fee, which can make sense, but then the term should match the life of the hardware and the support terms should still be separable.
Shorter terms or month-to-month arrangements shift the risk back to the provider, who has to keep earning your business. If a provider insists on a long term, ask what you get in return, such as a lower rate or included project work, and ask for a performance-based exit clause that lets you leave if agreed service levels are repeatedly missed.
Automatic renewal traps
Many contracts roll over automatically for another full term unless you give notice within a narrow window, sometimes sixty or ninety days before the end date. Miss the window by a week and you can be locked in for years more. This is one of the most common complaints owners raise about IT contracts, and it usually catches people who meant to review the arrangement but forgot.
Look for renewal clauses that convert to month-to-month after the initial term rather than a fresh multi-year commitment. If the contract does auto-renew, diary the notice date as soon as you sign, with a reminder a month earlier. Ask the provider to confirm in writing that they will remind you before the window closes.
Price escalators and vague scope
Check how prices can change during the term. A clause allowing increases at the provider's discretion, or linked to undefined cost changes, leaves you exposed. Reasonable contracts cap increases, tie them to a stated measure such as CPI, or limit them to once a year with notice. Licence costs set by vendors like Microsoft are a separate matter and do change, so check how those pass-through increases are handled.
Vague scope is just as risky. Phrases like reasonable use, standard support or fair usage can mean anything. If the contract says unlimited support, find the exclusions, which are often in a schedule at the back. Ask for examples of what counts as a billable project, and get the definitions into the contract itself.
Who controls the keys
The most serious red flag is any arrangement where the provider owns or exclusively controls your admin accounts, domain name, Microsoft 365 tenancy or licensing. Some providers register these in their own name for convenience. It may be harmless while the relationship is good, but it gives them enormous leverage if you ever want to leave, and in the worst cases businesses have struggled to regain control of their own email.
The contract should state plainly that your business owns its data, accounts, domains and documentation, that you can have a full copy of admin credentials at any time, and that these will be handed over promptly when the contract ends. Ask for this clause specifically if it is not there.
Exit fees and handover terms
Read what happens when the contract ends. Some agreements charge an exit or transition fee, or bill heavily for helping the next provider take over. Others require the remaining contract value to be paid in full if you leave early, even if the provider has breached its own obligations. These terms are easy to skip when signing and expensive to discover later.
A fair contract describes the handover: what will be provided, how quickly, and at what cost. It should include returning credentials, removing the provider's monitoring tools cleanly, handing over documentation and cooperating with the incoming provider. If hardware is on a lease or financed through the provider, check what happens to it and to the outstanding balance.
Liability, data and privacy terms
IT contracts often limit the provider's liability to a small amount, sometimes a few months of fees. Some limitation is normal, but understand what you are accepting. Check whether the provider carries professional indemnity and cyber insurance, and whether the contract requires them to tell you promptly if a security incident affects your systems or data.
Under the Privacy Act 2020, your business remains responsible for personal information even when a provider manages the systems that hold it. The contract should cover how the provider handles your data, where it is stored, who can access it and how a privacy breach would be reported to you so you can meet your own notification duties. If you are unsure, have a lawyer read the agreement before you sign.
In short
- Be wary of long minimum terms without a performance-based exit.
- Diary any auto-renewal notice date the day you sign.
- Insist that your business owns and holds all admin credentials.
- Read exit fees, handover terms and liability limits before signing.