When a firm chooses new software, one of the first questions is where it will run. Online you often come across the oversimplified view that the cloud is always insecure or that your own server is always secure. Neither is true. Security depends on how the system is set up and maintained, not only on where it is located.
What the difference is
Cloud means the service provider manages the application and the infrastructure. The firm signs in through a web browser, and updates and backups are part of the service.
Private server means the application is installed on infrastructure controlled by the firm or company: its own server, a private cloud or a virtual server. The firm decides where the data is, who has network access and how backups are made.
Comparison
| Cloud | Private server | |
|---|---|---|
| Getting started | Quick, no hardware to buy | Server and network need preparing |
| Maintenance | Handled by the provider | Handled by the firm or a contracted partner |
| Updates | Central, automatic | To an agreed schedule |
| Backups | Part of the service | According to your own strategy |
| Data location | The provider's infrastructure | A location the firm chooses |
| External access | Over the internet | Optionally from the internal network only |
| Integrations | Integrations available in the service | Plus internal systems |
When cloud is a good choice
- The firm has no IT support of its own and does not want to look after a server.
- Lawyers often work outside the office: in court, at clients' premises or from home.
- Getting started quickly matters, without buying hardware.
- The firm wants backups and updates taken care of as part of the service.
When a private server is a good choice
- The organisation has internal rules on data location or network access.
- There is an IT team or partner that maintains the infrastructure.
- The software needs to connect to internal systems, for example in the legal department of a larger company.
- Access needs to be restricted to the internal network.
Important: a private server is not automatically more secure. A server that is not updated and has no tested backups is a greater risk than a well-maintained service.
Questions worth asking the vendor
- Where exactly is the data located, and in which country?
- Who makes the backups, how often, and how is restoring tested?
- How are permissions assigned, and are important activities logged?
- What does moving from one model to the other involve if our needs change?
- How do I get all my data if I stop using the service?
Not sure which model suits you?
Tell us about your firm and infrastructure, and we will suggest a model.
Let's talk