They'd gone cloud-first two years earlier. No server room, no on-prem infrastructure — everything in the cloud. It was supposed to simplify things.

When we did the audit, the actual picture was different. The owner knew about $180/month in cloud costs. The real number, once we counted every SaaS subscription across every employee's company card and expense account, was $1,200/month. Fourteen separate tools were in active use. Most couldn't share data with each other. Three were duplicates of functionality they were already paying for in another tool. Two had been signed up for by employees who'd since left — nobody knew the login details.

Cloud-first is a reasonable strategy. Cloud-first with no governance is just accumulating technical debt in someone else's data centre.

The actual cloud vs. on-prem question

For most small businesses in 2026, the question isn't "cloud or on-prem" as an ideology — it's a workload-by-workload decision that depends on cost, compliance, performance, and operational overhead.

Cloud makes sense when:

  • You need zero capital expenditure. SaaS tools and cloud services have predictable monthly costs instead of large upfront hardware investments.
  • Availability and redundancy matter. Microsoft 365, Google Workspace, Salesforce, and similar platforms have higher availability than most on-premises setups any SMB could afford to build.
  • Staff work from multiple locations. Cloud applications are inherently accessible without VPN, which simplifies remote and hybrid work.
  • You don't want to manage the infrastructure. The cloud provider patches, backs up, and monitors the infrastructure layer.

On-premises (or hosted private cloud) makes sense when:

  • Compliance requires data residency. Some regulated industries require data to remain in specific jurisdictions or specific types of infrastructure.
  • You have high-bandwidth local workloads. CAD files, video production, large databases with heavy internal use — these may perform better and cost less on local infrastructure than in the cloud.
  • You have a line-of-business application that won't run in the cloud. Some legacy or specialized applications require local infrastructure.

The hidden costs of unmanaged cloud

Cloud services have a way of accumulating without accountability. Unlike a server in a closet (which requires a purchase decision and physical space), a SaaS subscription requires only a credit card. The result is what IT people call "SaaS sprawl" — a proliferation of tools that nobody fully owns, that often duplicate each other's function, and that may be storing company data in ways nobody has thought about.

The risks:

  • Data scattered across services. If client data lives in 14 different tools, how do you respond to a PIPEDA breach notification obligation? How do you find what you need during a legal dispute?
  • Orphaned accounts. A former employee's SaaS account with client data still active is a security and compliance problem. Shadow IT (tools employees sign up for without IT approval) compounds this.
  • No backup of SaaS data. Microsoft 365 is not a backup service. Teams messages, SharePoint files, and Exchange emails are subject to retention limits. A deliberate or accidental mass deletion may not be recoverable from within the platform without a third-party backup.

What cloud governance looks like

Cloud governance doesn't mean restricting access — it means having visibility and accountability.

  • Software inventory. Know every cloud tool in use and who owns it. This should be documented and reviewed quarterly.
  • Approval process for new tools. Before someone signs up for a new SaaS product, there should be a lightweight review: does this meet security requirements, does it duplicate existing functionality, who owns the account?
  • Offboarding that includes SaaS. When an employee leaves, their access to every cloud service should be revoked as part of the offboarding checklist.
  • Backup of SaaS data. Critical data in cloud services should be backed up with a third-party service, not relied upon solely within the platform.