Where is my cloud data physically located?

Let’s start with a true conversation, reported to me by the figurehead of an ICT industry trade association. My acquaintance attended a government meeting where the subject of the cloud and data centres was under discussion, during the course of which a minister asked: “What’s going to happen to all the data centres once everyone stores their data in the cloud?” While I don’t imagine that the minister in question actually thought that all of the world’s data was going to be somehow floating above us in clouds of all shapes and sizes, and weather…they clearly did believe that by moving to the cloud, businesses would be taking all of their data out of data centres, which would, as a result, be empty.

If you think of the cloud as very similar in concept to virtualisation, then you will understand that a) your data and applications are located on physical servers and storage in a data centre somewhere and b) that, to a large extent, that’s all you need to worry about. The cloud provider acts in the same way as virtualisation software, storing your data/serving your applications from where it thinks best and, so long as it’s available to you as and when required, you don’t need to know the details.

Ah, but then along came GDPR and a whole tranche of similar data handling and storage laws across the globe, and then the UK left the EU, and then the US and the EU couldn’t quite decide whether or not to reciprocate when it came to their respective data laws, and on and on it goes. And that’s before we’ve delved into individual industry sector regulations around data protection and privacy.

Confused?! Let’s try and provide some clarity.

A cloud provider may own their own data centre(s) and/or lease space in one or more colocation facility. They will then kit out all the data centre space they have acquired with servers, storage, networking etc. – the complete IT infrastructure required to serve applications to users. The cloud providers then offer a whole range of services to these users. These services range from ‘basic’ data storage – where users transfer their data over one or more networks to the cloud data centre, where the data then resides on physical storage hardware; right up to complex managed services – the simplest example being the way in which many of us access a whole suite of software applications (such as Microsoft 365) via a cloud provider.

The cloud provider may have multiple customers’ data or applications stored or served from the same storage device or server – subdividing the space available on the disk(s)/drive(s) available, and kept separate and secure thanks to partitioning.

Another name for cloud computing is (or was) utility computing. And thinking of how a utility operates, and how you access your utility services, is another good illustration as to how it works. Turn on the light, and, so long as it works, you really don’t care how the required electricity arrives at the switch – that’s someone else’s problem. Turn on your computer, and so long as your applications work, and your data is accessible, does the user really care where the actual software and data is being kept?

At the purely operational level, the answer is almost certainly ‘No’. Your cloud provider manages everything. You might be based in the UK, but your cloud provider may be storing your data somewhere else within Europe or even further afield. Access a managed service, and it could be located in a data centre just down the road, or thousands of miles and a couple of continents away. So long as the performance is as you require, all good.

Furthermore, so long as you have a suitable device and connection, you can access your cloud from anywhere. Doesn’t matter if you are in the office, at home, on a bus or train, you can still be working – accessing your applications and data remotely.

So, you could be a UK resident on a business trip to, say, Australia, and accessing your IT via a US colocation data centre, where your UK cloud provider has leased space for (cloud) storage and servers.

A word of caution

Hopefully, that was the easy bit in terms of understanding that physical IT and data centre infrastructure is the foundation of cloud computing provision.

Slightly more complex and, as far as I am aware as of right now, being able to discover exactly where your data/applications are physically located is not necessarily that easy. Your cloud provider may even move around your assets in the never-ending quest for efficiency and cost optimisation. As explained previously, so long as you can access and use everything you need in the cloud as and when you need it and suitably fast, you can let your cloud provider manage everything. Knowing where your data is kept – and your cloud provider should be able to tell you when asked – is unnecessary.

Except…for the growing, complex and frequently misunderstood and/or misrepresented topic of data sovereignty, localisation and residency. For understandable reasons, certain industry sectors (primarily those where transparency and accountability are near enough a matter of critical importance, or at least extremely large sums of money) have rules and regulations about how and where data needs to be stored.

For less understandable reasons (other than possibly patriotic or (anti)competition reasons – and maybe even genuine security reasons, although that’s less obvious!), individual countries and wider geographical regions, such as the EU, have introduced regulations which require data to be processed, used, stored, archived and even destroyed according to specific sets of rules. It’s beyond the scope of this article to delve into these complexities. All I will say is that it’s worth spending the necessary time to fully understand what requirements/regulations your own organisation’s data falls under across the various countries and regions in which you operate. At the present time, there seems to be a generally held view that ‘our data can’t leave the country’, which in many cases simply is not true.

Therefore, do ensure you understand the difference between data sovereignty – government policy or law; data localisation – ie the EU’s GDPR which requires personal information collected on European citizens to be hosted within the EU or several other specified countries; and data residency – a decision by a business to store their data in a specific location, for regulatory, performance and/or tax considerations.

Anyhow, where industry and/or government regulations do make specific requirements as to where and how data is stored, your choice of cloud provider becomes increasingly important. And they should be able to tell you where your IT assets are located. Whether or not they can guarantee that your assets will be located where you need them to be is less certain at the current time.

In summary, when you use a cloud provider to host your data and/or applications, this will reside on physical storage and physical servers, and be moved around via physical networks, all housed inside one or more physical data centres. This data centre/these data centres may be owned by the cloud provider itself, or they may be colocation facilities, in which the cloud provider has rented space. When asked, your cloud provider should be able to tell you the physical location(s) of the IT assets you have entrusted to them. Whether or not they can guarantee to keep everything at a location of your choosing (ie within a specific country) is less likely, although with the increasing focus on data regulations making more and more demands when it comes to the safe processing and storing of data, for example, cloud providers are busy building out more and more capacity in individual countries (as opposed to more generally US/Americas, EMEA and APAC).

One final observation. When it comes to the cloud, you pretty much get what you pay for. The most basic provision of data storage, for example, with no guarantees as to location, service levels, security and so on, will seem like a bargain. At the other end of the scale, a cloud service with a guaranteed location, guaranteed quality of service, guaranteed performance metrics, guaranteed security probably doesn’t exist! But those cloud offerings that come close to such enterprise-fit requirements will come at a significant cost.

Related Articles