Privacy and security risks depend to a great extent on the terms in the:

1. Much of cloud security is contractual rather than technical. 2. What the provider owes is written down in one place. 3. Privacy and security risks depend to a great extent on the terms established in the service agreement. 4. So the answer is the service agreement. _Source: NIST SP 800-144, 'Guidelines on Security and Privacy in Public Cloud Computing'_