Beside the price
Before you commit
What to weigh beside the price.
Price is 1 part of choosing where your data lives. Before you sign with a provider, put these questions to it, check the frameworks and law that apply to you, and keep the answers with your decision.
This guide says what to ask and which frameworks and laws to be aware of. It is not legal advice: for what applies to your organisation, ask your own adviser.
Area 01
Security assurance
A provider’s certificates and audit reports tell you which controls an independent auditor has checked. Each covers a stated scope of services, locations, and dates, so a certificate that does not cover object storage where your data is held tells you little about it.
Questions to ask, among others
Which certifications and audit reports cover object storage in the region I will use?
When does each certificate expire, and when was the last audit?
Area 02
Privacy and data protection
If you store personal data, the provider processes it on your behalf. Data protection law expects a written contract with it, control over who else handles the data, and safeguards wherever the data leaves the country whose law protects it.
Questions to ask, among others
What data processing agreement do you offer, and does it apply without my having to sign anything further?
Which sub-processors may handle my data, and how will I be told of a new 1?
Area 03
Jurisdiction and sovereignty
Where your data is held, and which company and which country’s law stand behind the service, decide who can be compelled to hand it over and which courts hear a dispute.
Questions to ask, among others
In which countries is my data stored, and can it leave them without my instruction?
Which legal entity contracts with me, and under which law and courts?
Area 04
Data protection features
Ransomware, a mistaken deletion, or a regional outage is survivable when the right protection was switched on before it happened. Check that each feature you need exists in the storage class and region you plan to use.
Questions to ask, among others
Can objects be made unchangeable for a set period, so that nobody, an administrator included, can delete them?
How is my data encrypted when stored and when sent, and who holds the keys?
Area 05
Service terms
An availability promise is a contract term with conditions. The usual remedy is a credit against your bill, which you must claim and which is capped. It is not compensation for what an outage costs you.
Questions to ask, among others
What availability do you commit to for this storage class, and how is it measured?
What do I receive if you miss it, and what is the most a credit pays?
Area 06
Exit and portability
Leaving is easiest to plan before you arrive. Find out what it takes to move your data out, how long you have, and what leaving costs, before you put data in.
Questions to ask, among others
What does it cost to move all my data out, and do you waive charges when I leave?
How much notice must I give, and how long do I have to retrieve my data after the contract ends?
Area 07
Contract and commercial terms
The rate you are quoted sits inside an agreement that says how prices can change, what support you get, and what the provider is liable for. Read those terms with the same care as the price.
Questions to ask, among others
How much notice do you give before changing prices, and can I leave if they rise?
What does support cost, and how quickly do you respond at each level?
Area 08
Sector rules
A regulated organisation must show its regulator that it manages the risk of relying on a cloud provider. These rules set what the contract and your own oversight must cover, whichever provider you choose.
Questions to ask, among others
Will you agree contract terms that meet my sector’s rules, such as rights of audit and access for me and my regulator?
How do you support my exit plan, and testing it?
Area 09
Operations and ecosystem
Running a service day to day shapes the real effort of a choice: whether your tools work with it, how you see what is happening, and whether you can find people who know it.
Questions to ask, among others
Which interfaces does the service support, and how compatible is it with the S3 API?
Do the tools and backup software I already use support it?
Area 10
Sustainability
If your organisation reports its emissions, its storage counts. Providers publish different measures at different levels of detail, so ask for the figures you need to report.
Questions to ask, among others
Do you publish energy, carbon, or water figures for the region or service I will use?
Can you give me the emissions from my own use, and how are they worked out?
Read every question, and what a good answer includes
With an account, on any plan, you read every question in each area, what a full answer contains, the frameworks and law each area is measured against with their official sources, and the checklist to work through with each provider.