When a client tells me they want to “move to the cloud”, my first question is what they mean by cloud, because it is almost never what the vendor means. This is what I explain in that first meeting.
What the cloud means for a small company
For a company of ten or fifty people, the cloud rarely means AWS or Azure. It means one of three things, or a mix of them:
- SaaS: software you rent and someone else maintains. Microsoft 365, Google Workspace, the CRM. You manage users and data, not servers.
- Hosted servers: the same server you have today, but as a virtual machine in someone’s data centre. You still administer it; only the location changes.
- Hybrid: mail and files in SaaS, plus one or two systems that stay in the office because there is no sensible alternative.
Most SMEs end up with the third model, and that is fine. The question is not “cloud or not”, it is “what goes where”.
What to migrate first and what to leave on premises
There is an order that almost always works, from the most standard to the most particular.
What goes first
- Mail and calendar. The biggest gain and the least dependence on your own infrastructure. If you still run Exchange in the office or keep mail on the web hosting account, this is the first candidate.
- Office files. SharePoint or OneDrive replace the shared folder on the server for almost everything.
What goes later, or not at all
- Line-of-business applications (ERP, workshop management, the clinic’s practice software). If the vendor has a cloud edition, evaluate it; if not, it stays.
- Software that controls machinery: scales, lathes, diagnostic devices. It needs to sit next to the machine.
- Latency-sensitive applications, such as databases taking many small writes from the office. Locally they answer in microseconds; over the internet, in milliseconds, and people notice.
A realistic phased plan
Migrations fail on the order more than on the technology. This is the one I use.
- Inventory. Which applications exist, who uses them, where the data lives, what depends on what. Include what nobody remembers, like the printer that scans to the server.
- Pilot. Two or three people, one week, with mail and files already migrated.
- Mail and files for everyone. A weekend for mail, then files department by department. The old server goes read-only for a month before it is switched off.
- Line-of-business applications. One at a time, each with its own test plan and its own rollback plan.
Security and compliance
Moving data out of the office does not make it more secure or less. What changes is the perimeter: it is no longer the router, it is identity.
- MFA on every account, no exceptions for management. A password on its own no longer protects anything.
- Conditional access: sign-ins from a country where you have no staff, or from an unmanaged device, get blocked or challenged.
- Backups of your SaaS data. The provider guarantees that the service runs, not that your data still exists if someone deletes it or ransomware encrypts it through the sync client. You need an independent copy, just as before: the 3-2-1 strategy still applies.
- GDPR and data residency. Pick EU regions when the tenant is created, read the data processing agreement, and document where the data lives.
The costs that are not in the brochure
The cloud replaces a one-off purchase (a server every five or six years) with a subscription that never ends. Neither is better by definition; run the numbers with your own figures. Things that tend to surprise:
- Licensing. The cheapest Microsoft 365 plan does not include what you need for conditional access or device management. Move up a tier before you find out halfway through the project.
- Egress. Uploading is free; pulling large volumes out usually is not. It matters when you want to change provider or back up elsewhere.
How migrations fail
Patterns I keep seeing:
- Lift-and-shift of a server nobody understands. The VM is copied as is, unsupported Windows and undocumented application included. It is just as fragile, only more expensive and further away.
- No exit plan. Nobody asks how to get the data out if the provider raises prices or shuts down. Ask for exports in open formats before you sign.
- One admin account, with MFA on the phone of someone who is on holiday. You need two administrators and an emergency account kept outside the system.
When the cloud is the wrong answer
Mallorca has a few clear cases:
- Poor connectivity. A farm or a workshop in the interior of the island with an unstable line should not depend on the internet to work. If the ERP is in the cloud and the line drops, the business stops.
- Latency-sensitive workloads, or ones moving many gigabytes a day between machines in the office.
- Software tied to machinery, which usually demands a specific PC, a specific port and a specific Windows version.
In those cases the right move is to keep that system on premises, properly backed up, and move everything else.
Where to start
Do the inventory even if you will not migrate anything this year. If mail is still in the office or on the web host, that is the first step, and a good moment to choose between Microsoft 365 and Google Workspace. And if you have a server with line-of-business applications and it is not clear what can leave and what cannot, that is exactly the analysis we do in cloud architecture before touching anything.