You’ve heard me mention this cringeworthy comment before but bear with me for a moment. A consultant was explaining technology to a group of accounting professionals. His advice was to move from on-premises applications to the cloud. The reason – “When you’re in the cloud, they take care of it.”

Who “they” are and what “it” is were anyone's guess. Simply imagine the cloud as the happy place where accountants and their clients could do business without a care in the world. 

In its simplest words, the cloud is nothing more than someone else’s server somewhere else. Instead of connecting to a server (another computer) that you can see and touch in your office (on-premises), the server is physically located somewhere else.

There's a natural – but flawed -- assumption that because it's someone else's server, they take care of it. Not so.

Cloud Services Come in 3 Popular Flavors

1) SaaS (software as a service) where the vendor delivers hosted applications on a cloud server, often on a subscription basis. Think Dropbox, Box, O365, Google Workspace, Shopify, and QuickBooks Online.

2) PaaS (platform as a service) provides the technology platform for developing, testing, and deploying applications. The vendor provides both the hardware and software necessary to support the customer’s application development. 

3) IaaS (infrastructure as a service) includes a broad range of computing resources such as virtual servers, storage, and network equipment over the internet. Think Azure and AWS.

There is a common belief that because it’s someone else’s server, they take care of it. This is a flawed assumption that has significant consequences for you, your company, and your customers. 

The Shared Responsibility Model You Didn’t Know About

How many of you have ever read the Terms of Service or Terms of Use for one of your cloud services? It’s safe to say you haven’t. No shame. Few of us read service agreements.

Each of the three cloud categories carries with it a shared set of responsibilities between the customer (you) and the cloud service provider. The diagram below is a summary of who does what. 




What is immediately apparent is that you are responsible for protecting your data, the information you freely share with the cloud application, and managing secure user access. 

These are hefty responsibilities. 

The Truth About Cloud Backups

To make the burden even weightier, cloud providers do not backup your individual data.

You’re probably thinking, “But they say they have regular, redundant backups.” When you hear cloud providers say they perform sophisticated backups, be aware that these backups are for the sole purpose of restoring their entire infrastructure. It’s not about you.

Cloud providers cannot support granular customer data backups.

For example, read Shopify’s clear data policy  –

“You are responsible for all activity and content such as photos, images, videos, graphics, written content, audio files, code, information, or data uploaded, collected, generated, stored, displayed, distributed, transmitted or exhibited on or in connection with your Account.”

Think about that for a minute.

• If an employee inadvertently deletes your entire CRM data, it’s gone. Forever.

• Stolen and then deleted financial data. Gone. Unrecoverable.

• The implications are substantial.

  
  

Which Cloud Providers Use the Shared Responsibility Model?

The short answer: Most of them.

Here are 16 of the popular companies you rely on every day for you basic business services.

Box
O365
Slack
Zoom
WebEx
GitHub
Atlassian
Shopify
Dropbox
Salesforce
MailChimp
Microsoft Azure
QuickBooks Online
Adobe Creative Cloud
Google Cloud Platform
Amazon Web Services (AWS)

3 Things You Can Do