Business data in the cloud: nine questions to ask before you choose software for your service company
Customer data, installations, reports, invoices: software for a service company holds your company’s memory. If you choose that software in the cloud, it is better to ask up front the questions that otherwise only come up after an incident.
Published by Abdelhay Rahou (opens in a new window)5 November 20265 min read
What are the risks of data in the cloud?
Software in the cloud means that your data sits on a supplier’s servers, and no longer on a PC or a server at the office. That shifts part of the responsibility to the supplier, and the risks change shape:
- Access by people who should not have it: a shared password, a former employee who can still log in, a role that sees too much.
- Loss or damage: an error during an import, a deleted customer, an incident at the supplier.
- Leaving: you stop using the software, or the supplier stops, and the question is how you get your data back.
- Where the data is: inside or outside Europe, and under which rules.
No service is completely free of risk. What you can check is how a supplier limits those risks and what is expected of you.
Nine questions for your software supplier
- Where is the data? Within the European Economic Area, storage falls under the GDPR (AVG / RGPD). Also ask about supporting services: is any data processed outside the EEA, and with which transfer mechanism?
- Are customers kept separate from each other? A separate database per customer is a clear answer.
- How is access organised? Named accounts, permissions per role, and the principle that everyone sees what they need for their work.
- Is two-factor authentication possible? A second factor, such as a code from an authenticator app, protects an account even if a password leaks.
- How often are backups made, where are they stored and how long are they kept? A copy on the same server does not protect against a problem with that server.
- Is restoring tested, and what is lost in a restore? A backup that has never been restored is a promise. A restore puts back an older copy: whatever changed after it is not in it.
- Who owns the data, and how do you get it back when you leave? Ask about the period for exporting after the end of the contract, and when the data is deleted after that.
- Is there a data processing agreement and a list of sub-processors? For your customers’ personal data, you are the controller and the supplier is the processor. The data processing agreement sets out those roles.
- What happens in a security incident? Who notifies whom, and within what time?
What you control yourself
Part of the security stays with you:
- Give each employee their own account and do not share passwords.
- Revoke access immediately when someone leaves.
- Review the roles regularly: who sees the financial figures, who can change data?
- Enable two-factor authentication, especially for the administrators.
- Export what you want to keep before you end a contract.
Short video · 0:30
Waar staan uw bedrijfsgegevens, en wie kan erbij?
In Europa, met een eigen database per klant en toegang op naam, volgens de rol. Elke nacht een versleutelde kopie buiten de server, en het herstel wordt regelmatig getest.
Video in Dutch, with Dutch captions
All short videos (in Dutch)How Digitalnatie Service Suite answers these questions
The answers come from this site’s frequently asked questions, where you will also find the full wording.
| Question | Answer |
|---|---|
| Where is the data? | Primary hosting and storage are within the EEA. For certain supporting or optional services, a limited part may be processed outside the EEA, with a transfer mechanism permitted by Chapter V of the GDPR. |
| Separate customers? | Each customer has its own database. |
| Access? | Individual named accounts, permissions per role and the need-to-know principle. Administrator access is logged, and data is encrypted in transit. |
| Two-factor authentication? | Yes: users enable it on their account, with an authenticator app. |
| Backups? | Every night, an encrypted copy goes off the server. One copy per day for the last 7 days, per week for the last 4 weeks and per month for the last 6 months. |
| Restoring? | Restoring is tested regularly. A restore puts back a stored copy; whatever has changed since is not in it. |
| Ownership and leaving? | The data remains your property. You can export it for 30 days after the end of the contract; after that, it is deleted within 90 days. |
| Data processing agreement? | Available for every customer, as is the list of sub-processors, on request via [email protected]. |
| Incident? | As processor, Digitalnatie informs you without undue delay and assists you with your own obligations. |
Specific restore commitments, such as a maximum restore time, can be set out separately in a service level agreement. What happens at the start is covered under pricing and implementation.
Frequently asked questions
Is cloud software safer than a server at the office?
That depends on the measures on both sides. With a server at the office, you take care of the updates, the backups outside the building and testing the restore yourself. With cloud software, the supplier does part of that; ask them exactly which part, with the nine questions above.
What is a data processing agreement?
An agreement stating that you, as the customer, are the controller of the personal data in the software, and that the supplier is the processor. It describes what the supplier may do with that data. At Digitalnatie, you request it via [email protected].
Is my data used to train AI?
Not at Digitalnatie. Customer content is not used for Digitalnatie’s own purposes and is never sold.
How long can I export my data after the end of the contract?
For 30 days after the end of the contract; it is up to you to export what you want to keep within that period. After that, the customer data is deleted within 90 days.