Scorethecloud

CLOUD score - Godaddy versus Dyn

2013-03-05T05:15:00.000-08:00

We recently reviewed both DynECT Managed DNS and GoDaddy DNS and our analysis shows Dyn to be a better fit for us. Both scored well, GoDaddy with a 73 and Dyn with an 81. Either would be a good choice.

Both offer reliable service, yes even though GoDaddy had an outage recently, they are still reliable. Both have multiple data centers globally, though Dyn has more and in more areas too, IE South America. If you are global that matters. If you are US or US. EMEA, APAC only it may not be a big deal.

Contract wise they are comparable, which means there are things in both we don't like. The GoDaddy SLA was actually better. If they miss their 99.999% goal then you get 2 months free. (If you got a 2 month free from the last outage we would love to hear it, always good to confirm)

Where Dyn really excels is on the relationship. GoDaddy really seems to focus on the smaller shops and expects you to do most of the shopping online with a credit card. Dyn has an account team that can talk to you, explain their products and provide that advice and, well relationship that I think is important.

GoDaddy though is cheaper, has the better SLA and better support hours, though I felt that their support, at least when I tested it, was a little less technical than Dyn. I asked about backing up my DNS records and GoDaddy suggested taking a screen shot, even though they have an option to export. Not a wrong answer, but if I had a lot of records it could be many screen shots and manually having to enter them would not be fun.

GoDaddy also offer more services. I can do web hosting, email hosting and even get them to help with my web design. We didn't look at those services, but there is something to be said for having your hosting and your registration be the same company.

Both Dyn and GoDaddy reserve the right to terminate you at any time. There were at least a few complaints about GoDaddy doing that to protect against fraud, which is good, but getting things turned back on seemed painful. That makes sense since there is no account team to help.

In summary, if company relationship and personal support is important to you for DNS, stick with Dyn.

If you want cheap and easy and are looking to host a website as well, GoDaddy can be a good option.

AWS stands alone

2013-01-14T13:25:00.001-08:00

CIO recently ran an article about Amazon Web Services and the fact that Gartner claims they are pretty much well ahead of the pack in the leadership space of IaaS. This is not that surprising, I mean Amazon was one of the first to offer cloud computing first with EC2 (elastic computing) and S3 (Storage) and now with AWS. When you help to define a market, being seen as the leader of it is really yours to lose.

We are actually just starting to use Amazon for Infrastructure, though we have used a lot of SaaS vendors, like Salesforce.com, Okta and Google. In fact the event that made the change a priority for us was a data center move. The move will take us 46 hours (according to the plan) and being without our primary web site for that long wasn't a real popular thought, so we moved it to AWS.

We chose them because it was so easy. Setting an account up is easy, adding machines is a snap and when we decided this morning we really needed a SQL database to go along with it for some of our applications, it took minutes to provision that too. It's cheap, especially for short term needs like this, and can easily fit on a credit card and be expensed to the company. Many people underestimate how important that is, but that ability to work within financial guidelines is a big deal.

We will find out this weekend how it works, but so far I'm impressed.

Scorethecloud - Cloud consulting company of the year Finalist

2013-01-04T07:15:00.003-08:00

Thanks to everyone that voted for us for the "Best cloud consulting 2012" from UP 2012. We made it to the finalist round which was a great accomplishment for such a new company!

Everyone always says it is an honor to be nominated and we agree. Making it to the final round is pretty great too!

In 2013 we will get our application live so everyone can score their cloud vendors and get useful data from the global cloud user base. We also hope to upgrade our website and get even more social.

Stay tuned!

Watch out ... terms are changing

2012-12-18T09:56:00.001-08:00

The great pace of change in real cloud vendors is what really makes them attractive. Unfortunately that ease of changes also has a dark side. This month two big names in cloud decided to change their terms of usage.

Most cloud vendors use a neat trick like pointing their terms of use to a web page with a notice that they are allowed to change the terms at any time with no notice. We have been warning about this practice for a while and this week shows why that can be a dangerous trap.

Let's look at instagram. They decided to change their terms to allow them to sell your pictures without paying you a dime or even having to tell you. Now I know that instagram is free and they have a lot of expensive infrastructure to support all the users they have. Someone has to pay for it.

But imagine if you are a celebrity whose face and or likeness is actually worth a lot of money, say Mila Kunis or Robert Pattinson. You happen to have used Instagram in the past and all of a sudden they can use your face and likeness to sell other products. I'm also a little unclear on what happens if I don't agree and terminate my account. Here's why. Under "General Conditions" paragraph 3 it says

".....You agree that we may notify you of the Updated Terms by posting them on the Service, and that your use of the Service after the effective date of the Updated Terms (or engaging in such other conduct as we may reasonably specify) constitutes your agreement to the Updated Terms......"

That seems fair. If you disagree stop using it.

But in paragraph 1 of the same section it says

"...If we terminate your access to the Service or you use the form detailed above to deactivate your account, your photos, comments, likes, friendships, and all other data will no longer be accessible through your account (e.g., users will not be able to navigate to your username and view your photos),..."

So far so good I can delete my account and not have to worry about it right?? Keep reading

but those materials and data may persist and appear within the Service (e.g., if your Content has been reshared by others).

OK If my data still persists does that mean I am "engaging in such other conduct as we may reasonable specify" constitutes my agreement? I'd hope not since I tried to cancel my account but courts can be weird some times. Frankly I'd be shocked if that were the case but I'd hate to be the one to have to pay a lawyer to find out. The bigger issue is what if you didn't know that the terms changed.

Google also changed their terms for the business free version of Google Apps. They handled it a bit better since they "grandfathered" people whose account was created before the announced it. My Google account from earlier this year is still free and will continue to be free, but if anyone going forward wants one, they need to pay.

That just feels like a "fairer" way of dealing with changes. It let's the turn an incredibly popular service into a way to make money without penalizing the people that helped it become an incredibly popular service.

Google and Instagram aren't the first vendors to change the rules and I'm sure they won't be the last ones either. Personally the way Instagram handled the change would annoy me if I were a user of their service. It just feels a little sneaky and devious. The Google approach seems perfectly reasonable to me.

Nasuni and cloud storage

2012-11-27T08:24:00.002-08:00

I had a chance to meet with the CEO from Nasuni yesterday, Andres Rodriguez (@
nasunista), and get a look at what they are doing. Wow Cool stuff. We will work up a cloudscore for them soon but they said all the right things.

But first let me back up. A few months ago at VTUG's Fall Forward event I got to hear Steve Duplessie (@stevedupe) from ESG talk about the future of storage. One of the things that stuck with me was his idea that virtual storage controllers were the next big storage thing. I didn't quite get it then, some times it takes a little time to roll around my brain before it settles in, but after looking at Nasuni I get it.

Normally storage controllers are tied to the physical storage, but imagine if they were not. Nasuni essentially builds a controller (and NFS,CIFS, iSCSI front end) that is independent to the storage. In fact the back end storage they use now is Amazon S3.

They have a local cache to get rid of the performance concerns but all the storage, replication, backups etc are done with S3. In fact someone used the analogy (and I love analogies) that it is like EMC + Akamai.

They encrypt the data and the customer has the keys so compliance and security should not be a concern. S3 is super reliable when configured correctly and if the on site box crashes you can configure a new virtual one in 15 minutes.

The other interesting thing that they are not doing yet, but probably can, is connect to other types of storage. Imagine, if you had box, amazon, dropbox and local storage all managed through this one virtual controller. Also, since we are making stuff up, that you can scale multiple ones of these together to get super high performance, only limited by the network connection. With 100Gb Ethernet on the radar that's a pretty good size data pipe. String 10 of these in parallel you could get 1Tb access speeds to unlimited data. Talk about big data....

The other thing that they do that is pretty unique is you pay only for usable storage, not usage, not snapshots or number of users. This makes it really easy to understand the cost. It is literally COST X USABLESTORAGE.

When comparing costs though you do need to factor in some of the other benefits you get. Disaster recovery is built in. No need to replicate data, or buy extra hardware, you can literally configure a VM appliance in minutes, or have it already running in the second (or third) sites. You get centralized storage in the cloud with data backups for free too. Which saves a lot of compliance headaches and missed tape pickups..

Still working on the math to see if this is cheaper or not than local storage, plus backup licenses and media, plus a hot DR site plus the time to manage it plus the WAN link etc... I'm thinking it will be pretty close.

Cloud gives the ultimate in flexibility

2012-11-20T05:10:00.000-08:00

In today's world it's important that companies be nimble and flexible. Things change too quick to be stuck with a rigid infrastructure, processes or mindset.

This is where cloud, in particular SAAS, really come into play. In my opinion cloud for cost savings is short sighted, not that there can't be cost savings, but that should not be the reason to go cloud. It's really about being faster and more flexible.

Imagine two companies, one with on premise infrastructure and one cloud based. Both want to merge with another company and add 1000 "new" employees to their email system because of it. The on-premise company needs to upgrade it's email servers, storage, add backup licenses and add the new users. Let's assume they are all outlook users and don't need training since it's the same interface. Still adding servers and storage (and possible network ports) can take a month and cost $50,000. If disaster recovery is important (and it should be) you may need to double that.

Now the cloud based company simply process a change order (or whatever paperwork is required to add 1000 new users and add's their accounts. This can literally be done in a week. Technically hours, but there is usually some level of financial approval required for an additional monthly cost like that.

The other way cloud makes you more flexible is the fact that upgrades can happen with no real IT work needed. Now IT needs to spend time on testing the new features, figuring out use cases and then training the user community on the best way to leverage them, but they should do that for on-premise features too.

Please vote for us

2012-10-10T13:26:00.003-07:00

We were recently nominated for "Best cloud consulting 2012" from UP 2012 and are hoping to win at their Third Annual Global Cloud Computing Conference taking place on December 12th in San Francisco.

We are honored and are really hoping to win and need your help.

If you think CLOUDscores and scorethecloud help, we would love it if you would go to http://up-con.com/vote?page=19 and vote for us. We are up against some big names and tough competition, though we think we are better, just not bigger, so every vote helps!

CLOUDscore - Salesforce.com versus Oracle CRM

2012-10-04T11:00:00.002-07:00

With Dreamforce and Oracle Open World both in the last 30 days there has been a lot of new and announcements about their various products. Some of it is really good news. Some is interesting. Some is false..

We worked up a quick CLOUDscore for them both based on what we know. Salesforce.com scores an 81 and Oracle scores a 67. Both of them make a good product for our use case, salesforce.com was a better choise. This does not mean that it is a better choice for you since you may rank them or score the differently.. Let's walk through the differences.

Company wise they both have solid datacenters, recoverability and are stable companies with great management teams. With Oracle it's a bit hard to tell. Their website is a little hard to follow and we don't yet have a relationship with Oracle but we think it's a pretty safe bet that they have redundancy built into their cloud solution, since they have a practice around DR.

Relationship wise though salesforce.com is much closer to us. To be fair we have worked with them for many years and our relationship with Oracle really revolves around them auditing us for licensing every few years. Oracle very well may be better or at least comparable when it comes to company relationships, attention and influence. Use your best judgement on that.

From a Legal perspective they both score roughly the same. I could not find specific mention of a SAS70 or SSAE certification on the Oracle side, but they listed enough other certifications to make me believe they have it and just didn't list it. Ask before you sign though and make sure it covers the general computer controls you expect.

Neither deal with assignment if you get bought , Oracle's SLA penalty is actually better then Salesforce.com's. They will give you 10% back for a missed SLA. As the contract reads though that looks like the max as well. So if they go down once, you get 10%. If they go down 10 times, you still get 10%. Salesforce.com seems to be 3% per issue. Neither talks about maximum increases in their default contracts, though this is probably negotiable given a large enough deal.

Under Openness, salesforce has a trust site, where Oracle doesn't, at least not that we could find. Oracle does though have the option to bring their solution in house which really helps make them attractive. Salesforce.com has no option other than their hosted model.

Salesforce does a better job on free training resources for users. We couldn't find much detail around Oracle's infrastructure and how global it was or how well it would perform. We gave them fairly high marks because of their other practices in this space. Oracle does have a desktop client though which is good and bad. It's good in that it allows them to offer offline pretty seamlessly, but it makes more requirement for the client.

Salesforce.com seems to have a better development community, or at least a more focused one. Oracle owns Java which is obviously widely used, but it was hard to find CRM specific development groups. While they may exist they seemed hard to find. While Oracle having the option to bring the software in house helps them with Openness, it hurts them here since they tend to have a slower pace of innovation. Of course they are huge, so when they want to make a splash it can be a big one, but having to test more installations means they need to spend at least some time on that. Not that they aren't still releasing regularly, we think salesforce.com is a little faster to market.

Just a reminder this is based on a single CLOUDscore and our environment may not match yours. We encourage people to do their own due diligence, but do recommend you use our CLOUDscore methodology. We think it is good. :)

If you want to run your own numbers you can get the public cloud score sheet from here. If you do, we would love to see your score and add it to our database, Please share it with us and email it to us at info at scorethecloud.com

Is it PaaS or IaaS? Don't ask Oracle

2012-10-03T12:49:00.002-07:00

Oracle Open World is this week. It is one of the largest tech events and generally comes a few weeks after Salesforce.com's Dreamforce. Both Oracle and Salesforce try to outdo each other and since they are both in San Francisco it usually makes for some humorous stories.

Last year Oracle cancelled Mark Benioff (salesforce,com CEO) who was scheduled to be a keynote speaker after he bashed their "cloud strategy". He quickly put together an event at a local hotel just down the street. You can see it at http://www.youtube.com/watch?v=adjvEEs1A6w. This year Mark made a point to say he wasn't invited to Oracle Open World this year. He took on Microsoft in 2010, but I digress.

Oracle this year is talking a lot about their cloud, but they seem to be using different lingo then everyone else. They were talking about their IaaS (Infrastructure as a Service) solution. That was one area that people said they were missing so they made a show of announcing it. Good for them and I think they have some pretty good products. I loved Sun. Java everyone loves and Oracle has always made a great database.

But when they talk about IaaS I think they are confused. See IaaS is Infrastructure. Things like OS, hardware, network, storage, but in Oracle-land they include the database later, which in reality makes it more like a platform as a service or PaaS play. In fact they compare it to Amazon Web Services, which is the leader in PaaS, not IaaS. Amazon has an IaaS play but that's called EC2.

This feels a little bit like "putting lipstick on a pig". Not that their platform as a service isn't a solid offering, but if they want to play in the infrastructure as a service playground at least sell one. They shouldn't just rename their platform offering as infrastructure and expect no one to notice...

Asking the right questions about contracts

2012-10-02T12:56:00.001-07:00

I was doing a cloud score on a vendor and one of the questions we ask is around termination of the contract. Many times in the past I have had to get out of a contract for various reasons, downsizing, mergers, change of direction etc. I always make sure that a termination clause exists now.

But just asking if the contract can be terminated early isn't enough. Recently I asked the question and the answer was, "yes with 30 days notice". A very reasonable answer. This gives the vendor time to find a way to reuse the capacity and was enough time for us to switch providers if we needed to. I was very happy with that answer and gave them a "5" for that question.

A few days later though I was reading through the contract and while the contract can be cancelled with 30 days notice, there is an early termination fee. That by itself is not unusual telco's normally will charge you for their build out costs, which can be expensive. Cellular contracts often will make you pay for the phone if you cancel early to make back their money etc.

The problem was though that the early termination fee was equal to the monthly fee times the number of months left on the contract. So I can terminate the contract but it costs me the same as if I kept the contract and I had to pay it all at once...

I've changed the question to be two parts, can I cancel, and what if any is the fee to cancel.

Five tips for selling cloud

2012-09-27T08:29:00.003-07:00

I listen to a lot of cloud companies trying to pitch their products, enough that I can tell when someone is pulling my leg, or trying to steer me away from asking certain questions. Enough already. CIO's it is time to unite and stand up to this FUD...

If you are selling cloud, whether it's IaaS, PaaS, or SaaS, here are my 5 tips to help.

1. Cost is not why I'm going cloud
Cloud can cost less, but it can also cost more depending on what exactly your solution offers and what else I may need to buy to give me the same functionality. Office365 may cost me less than on site software, but it depends on what license I go with, how good my Enterprise Agreement was.

Frankly saving money is great and if there is a big cost savings, cool, but I tend to think of this as VoIP (voice over IP) years ago. When VoIP first came out and everyone was paying a lot of money for long distance, cost savings was a big deal. Today though long distance costs are so low trying to sell me on cost is a difficult pitch.

2. Performance
Cloud performance is tricky. I mean one of the ideas of the cloud is that it runs over the internet, which cloud vendors have no control over anyway. I suppose a big ISP could argue that if all of your sites and home users are on their network which also houses the cloud data center then their performance could be guaranteed. Most cloud vendors can't guarantee end to end performance, and trying to sell me on "transaction performance" is going to lead me to believe you are stupid, or you think I am stupid. Neither is going to help your case.

Now if the solution is entirely based in your cloud environment and very little user interaction is required, maybe this works. Big data analysis, gene sequencing, complicated simulations etc, may be some examples of where performance matters, but for me entering data into a spreadsheet, the performance issue is almost always going to be internet related which cloud vendors can't guarantee.

3. Speed of innovation
One of the main reasons I want to go to the cloud is faster innovation. Since vendors only need to test in their environment, versus every possible combination on companies, they can dedicate more time to new features.

To show me this, you should be able to show regular release schedules and what features are in each one. I understand that not all features are created equal. Quoting me a number of features, is going to make me suspicious without some context. I don't consider changing the columns on a report to be a new feature, or changing the background color.Show me real, new, useful features or I'm going to think you are pulling a fast one.

4. Stop spreading FUD
Many companies, who don't yet have a cloud offering are going to try and confuse people with FUD, Fear Uncertainty and Doubt. They will talk about security breaches or reliability and try to convince them that cloud isn't ready. Sadly at least once a month we get another big story about a cloud outage or security breach so there is no lack of examples.

The reality though is cloud is no more likely to go down than an onsite solution. The big difference is you hear about it a lot more. No one would ever publish an article about a 1000 person company losing email service for 4 hours, but when that happens to Google or Yahoo it's front page news.

Same thing with security. I'm pretty sure a company like Google can hire some pretty darn good security administrators and can afford any solution they want, most companies can't. The downside is Google also gets attacked a lot more than a smaller company. They are a bigger target.

My advice, use reality and facts to educate me. Trying to scare me into not using cloud is just going to make me think you are hiding something.

5. Don't try to sell me 99.999% uptime.
Let's be honest, most people will not be able to tell the difference between a service that is 99.999% available and one that is 99.9% available. One is less than six minutes of downtime a year and the other is slightly under nine hours, which sounds like a big difference, but almost any outage is really going to take longer than 5 minutes to fix. Rebooting a system, which is what most IT people do as a first step can take that long.

I think of this as phone call quality. That used to be a big deal with PBX vendors, and sometimes they will still talk about that, but in the real world, we are all used to cell phone quality, which isn't very good.

While we are being honest, the bigger concern with cloud is the internet connectivity which is going to be the problem more often than not. WAN circuits, DNS servers etc are all lumped under "third party services" which you as a cloud vendor can't guarantee anyway.

Make sure you can explain why your service is available enough but don't make that be your main selling point. I expect it to be in a multiple redundant data center with redundancy and controls in place to avoid as much human error as possible.

Summary: If you really have a cloud product, sell me on the features that really can help me. Don't try to scare me or BS me. Many of us have been working in IT a long time and have really good detection mechanisms. Plus with social media, you might get away with it once or twice but eventually, and usually real soon, people will catch on.

More contract killers

2012-09-24T08:49:00.001-07:00

I spent the weekend reading cloud contracts and was amazed at some of the phrases I saw in some of them. These are the worst ones that I found.

1. We reserve the right to modify or replace these Terms at any time in our sole discretion.

In other words, whatever we agree to we may decide to change our end at any time and with no reason or notice.

2. Company may increase or add new fees for any existing Free or Paid Service or Free or Paid Service feature at any time without notice. Such notice will be posted on Company's Websites. YOU AGREE THAT YOU ARE RESPONSIBLE FOR CHECKING THE COMPANY's WEBSITES EACH MONTH TO CONFIRM WHETHER THERE ARE ANY NEW FEES AND, IF SO, THEIR EFFECTIVE DATE(S).

We agreed to a price but we may decide to change it. You need to ask us every month if the price increased and when we decided to change the price.

3. "We reserve the right, to temporarily suspend or terminate your access to the Service at any time in our sole discretion, with or without cause, and with or without notice, without incurring liability of any kind." .... "You acknowledge that if your access to the Service is suspended or terminated, you may no longer have access to the Content that is stored with the Service."

We might turn you off for no reason and you can't do anything about it. If we do, we don't have to give you any of your stuff back either.

Now imagine if these were contracts for something more tangible, say a rental agreement on your house. In theory, with no notice, you could go home and find your rent had gone up 300%, your door is locked with all the furniture in it and your new apartment is now in New Jersey instead of Manhattan.

I have not heard of anyone getting abused like that, and many times companies will have amendments that probably override the standard terms, so it may not be as bad is it sounds. But the point is this, If you are not reading and understanding these contracts carefully, you may be getting in trouble down the road.

It is possible to get cloud vendors to agree to custom amendments but only if you ask and are willing to walk away. There is a reason that legal is one of the 5 components of a CLOUDscore. Be careful...

Now the legal disclaimer. We are not contract attorneys. If you have questions you should check with one.

SaaS, PaaS and IaaS

2012-09-20T04:44:00.000-07:00

Cloud means a lot of different things to different people. Sofwtare, Platform and Infrastructure as a service (SaaS, PaaS, and IaaS for those that like acronyms), are the three main types of cloud today.

How do you know which is best? Well think of it this way, the higher up the stack you go, the less work you need to do to get the benefits of it. Let me explain what I mean.

Salesforce.com is a SaaS company primarily. Their sales cloud is the offering that started the cloud shift. Salesforce.com customers, don't need to write code to leverage the application. In most cases you can use the user interface and pretty easily make new reports, or add new fields to existing forms etc. You get out of having to develop. You also don't need to patch, maintain, backup anything. They handle it all. The trade off is flexibility. You aren't in control of when you get upgraded to the next release, and can't make changes outside of the ones in the user interface.

Amazon web services, or Microsoft Azure are examples of PaaS. They handle all the machine related things, like patches, backups, making sure power is redundant etc. They also give you a great programming interface that lets you easily build new applications. The key here is YOU build the software, but not the operating system. It's a step up from having to make sure you have the latest version of SQL or Linux, but it's more work than using someones else's application. It also gives you more flexibility and control over upgrades of the software.

Infrastructure as a Service puts you back in charge of the operating system but still keeps you from having to worry about details like, redundant hard drives or plugging power supplies into different circuits. You maintain the operating system and have to worry about patches. You need to decide if you want SQL or Postgres for a database. You need to decide on a version of Apache or IIS etc. Then you have to build the application (or buy it of course).

All of these are designed to be scalable (both up and down) and can help avoid a big capital expense up front. The key is to decide how much flexibility you can trade for ease of use.

We all have different cloud needs

2012-09-15T07:41:00.000-07:00

One of the things that is important to remember is not all of have the same needs. In fact even in the same company different things will be important depending on the solution you are building.

For example if you are using a cloud based backup, cost is probably important but reliability may not be that important. If the backup doesn't run at 10:00AM, then it will run when the site comes back up. If however you are running your entire sales team on salesforce.com than it absolutely has to be running or you aren't selling.

One of the things we take into account, and recommend for everyone, is to use a weighted matrix that takes into account that needs change. When we calculate a CLOUD score we take this into account and using out algorithm convert everyone to a 0-100 score, even though the needs change.

Eventually we will add the ability to use other's rankings, with your weightings to better leverage what others think. It's important to get as much data as possible and then use it properly to make sure you get the right solution.

Cloud and Internet redundancy

2012-09-09T08:35:00.000-07:00

In our last post we talked about contracts and SLA's and while they are important, not all of the problems are actually the cloud provider's responsibility. Some of the problem could be your network.

Historically internet access wasn't always considered mission critical, but when your financial system, customer support, sales and storefront are online, it needs to be. Not all companies have figured that out yet.

The best redundancy is dual carrier. Some carriers will sell you a redundant option and this is good, but doesn't always protect you from "logic" errors. Internet routing is complex and like any complex system can have problems. These problems can sometimes, and frankly pretty rarely, but sometimes affect the provider network, even if you have redundant physical connections.

Other times the problem could be with the ISP's uplinks and who they interconnect with. This isn't really a problem with the bigger network players since they have multiple uplinks to all the other providers, but smaller regional providers could have limited redundancy of their own. Also do not forget your own redundancy. If both circuits go into the same closet and a water pipe breaks and ruins both sets of equipment that is just as bad.

It's also possible, though not a technical problem, that something silly like a billing problem could cause the provider to terminate your service, either intentionally or not. I have seen cases where a $6.24 bill that was billed incorrectly, and sent to the wrong address, caused the provider to terminate services. Getting circuits turned back on, for some reason, is a lot more difficult than turning them off.

So two carriers is best, but even then many providers resell other providers services and even using two carriers isn't foolproof. You have to ask which paths the circuits take, where they locally terminate and then how they get to a major POP. I have seen cases where two providers were both using the same fiber and a single fiber cut took down both providers and both of our redundant circuits.

Even using a wireless provider for a backup isn't foolproof. In Lawrence MA a few weeks ago a mattress fire took down a major fiber and copper conduit which took many cellular providers offline as well as the phones and internet for many local businesses. It even took down emergency 911 service, and if anyone takes redundancy seriously it's those guys. Lives really are at stake if 911 isn't working. Luckily they had coverage with other towns to assist.

Getting internet redundancy is hard and not as foolproof as we would like. Make sure to ask questions around where they circuit goes, who the interconnect with and what the escalation points are in case something does go wrong. Redundancy is difficult to setup but not impossible. As more services move to the cloud, it is important to make sure you can always get there.

Cloud contracts

2012-09-05T06:19:00.001-07:00

As we started scoring cloud vendors, the biggest area that pretty much all the vendors do poorly at is contracts.

Some of the questions we ask about contracts are:

If I want to leave, for example if they get bought by a competitor, can I get my data out and go?

This varies, but often times the ability to leave is either not mentioned, or it explicity says "You can leave when the term is up".

Many times having the data by itself is almost useless, unless you have someplace to put it. Migrating out of salesforce.com without being able to re-use that data in another system would be difficult and costly.

Are there financial penalties for service level agreement failure.

These are almost universally, a joke. If you read closely most of them say "If the service is unavailable for a day, we will refund up to 3% of the monthly fee". This pretty much equates to, we won't charge you if you didn't get to use it. Not much incentive to fix a problem.

Other times we have seen clauses that say "You will receive this credit, but you must notify us, in writing, within 72 hours". Unless you are really good, that never happens.

Are maximum increases baked in?
By default this never happens, mostly because the vendors don't want you to think about that. In essence though the cloud vendors, once they hook you, can increase the rates until it is almost worth going somewhere else. Sort of like gas prices in the US. They, whoever they are, raise the rates until it's almost worth buying a more fuel efficient vehicle, or driving less. Almost, but not quite.

How much notice do you need to give us to terminate?
Rarely, but it has happened, a vendor will terminate you. If that happens how much notice do they need to give you? Is that enough time to find a new vendor, migrate the data and train on the new system? Usually it's either 30 or 60 days. You realistically probably need 6 months for a big SaaS. If it's something more commodity like VMware in the cloud, 30 days may be fine.

How much notice do we need to give them if we want to leave?
As a customer you want this to be as little as possible. Normal is 30 days. We have seen some that require 6 months notice.

Does the contract auto-renew? If so what are the terms?
Ideally this auto-renews at the current rate, but sometimes it will cancel, which if you are not expecting that, can be horrible. Other times it will renew, but at list price. If, for example, you negotiated 50% off of list, that means your monthly bill just doubled. Even worse, it may have doubled for the next 12 or 24 months depending on the contract.

Cloud contracts can be tricky and many vendors aren't used to amending their terms. Only by working together can we encourage vendors to be a little better about what we are allowed to do as customers.

Questions to ask cloud vendors

2012-09-01T16:23:00.002-07:00

Part of our methodology is to make sure we ask enough questions to fill out the weighted matrix we use for scoring cloud vendors. When we schedule a vendor interview, we will send them the below questions, not so that they can answer and send them back, but so they can have the right people available on the phone to discuss them. Many times this can prompt other discussions to help us better understand how they operate which helps us better score them

Feel free to use the below in your own cloud scoring. Or if you are too busy and want us to do it, by all means let us know.

--------------------------
We are reviewing our cloud vendors and we would like to have a discussion to understand your company, processes, contracts etc. We are very pro-cloud so please do not be alarmed. We are not using this as a reason to disqualify you, but simply to understand what our risks are and if we need to take additional steps to mitigate these risks. In essence this is our due diligence.

You do not need to answer these questions. We think there is more value in having a discussion around these topucs to we can drill in where we need to.

Disaster Recovery and Business Continuity
Do you have redundant sites designed for auto-failover? How long does it take for the redundant site to take over. Does this include the time to decide to fail over?

What kind of RTO/RPO are in place and are they actually tested against?

Do you have geographic redundancy?

Do you perform backups. and how granular and far back can we recover? Can we recover accidentally deleted files?

What impact does a failed HD, server, cabinet, switch, data center have?

E-discovery
Is it possible to search for any files, records or emails by keyword, owner, date?

Can we do legal holds by user, file, keyword?

Can we get access to “access logs” in the event we need to? If so how far back can we get? What does it show us?

Can you see who your users are sharing with? If so can you easily remove access from an enterprise level?

Are there any additional costs for this?

Stability
Do you have a public, or better yet third party, site that shows real time status for transparent operations?

Is code/data in escrow? If so how often does it get updated?
Can we request a backup or better yet, just take a backup, of our data including any customizations?

Company financials
Can you share financial data for the last few years?

Are you private or publicly owned?

Are you cash flow positive?

Are you adding new customers? How many?

Do you know your NPS (Net Promoter Score)?

Who are the key investors and management team?

Authentication
Do you support automatic provisioning and de-provisioning of user accounts?

Do you support LDAP.RADIUS or even better SAML authentication and authorization back to us?

Do you use encryption? If so is it for data in flight (moving across the network), at rest (on disk or in memory) or both? What kind of encryption is it?

Compliance and Privacy
Do we get notified of an investigation?

Can our data be seized as part of another companies investigation?

Is data recoverable by your organization?

Contract
If I want to leave, for example if they get bought by a competitor, can I get my data out and go?

Are there financial penalties for service level agreement failure.

Are maximum increases baked in?

How much notice do you need to give us to terminate?

How much notice do we need to give them if we want to leave?

Does the contract auto-renew? If so what are the terms?

Performance
Are you globally load balanced?

Do you use a specialized network or other Wan optimization, for better performance?.

Who do you use for WAN connectivity? I

Do you offer “offline” ability? If so it is automatic, or does the user need to know that they will be offline and plan accordingly?

How scalable is the system? Can we scale to 10X, 100X, 1000X? What is the breaking point? And how quickly can new capacity be added if needed to scale higher?

Development
Do you offer built in integration tools? If so to what other systems?

What toolset is used for “custom development”?

Can we customize the login or "main" screens with our logo, colors, etc? How much canned vendor wording needs to stay, or can we wipe it all clean if we want?

How vibrant is your customer community? Please point us to the public discussion Q&A boards for your product. What are the main Twitter hashtags your customers use when they talk about you? Do you monitor them?

Do you gather product ideas publicly from your customers, where they can read and vote on each others' ideas?

Are the API’s well documented? How often do they change?

How much of the system can be operated with API’s versus the user interface?

How is authentication handled in the APIs?

Support
Are you staffed 24/7?

Is it onsite, email, phone, web or all?

What sort of response time is available?

When we open a case, do wetalk to someone knowledgeable right away, or do we have to have a number assigned and wait for someone to call us back?

What is the average tenure of the tier1 staff?

Is there a public knowledgebase available? Is it the same as the internal one or is it filtered? How good is the search or UI?

Can anyone from our company or IT staff call, or do we only get a certain amount of “authorized users”?

Can I use support as part of my evaluation period?

Does the same engineer own a case throughout its lifecycle, or are cases "handed off" among tiers?

Does your support staff prefer or default to email, phone, or web?

What's your support team's onshore / offshore and employee / contractor breakdown?

Does your support team also support your own internal implementation of your software?

Can we log tickets on a portal and carry on the whole conversation there?

Architecture
How quickly do new features show up? Do we need to do anything or do we “magically” get them? How much notice do you give us for training users?

Are you built on a multitenant system?

Do you support multiple clients, like iphone, android, blackberry as well as tablets? Are you strictly HTML5/browser based? If so which browsers?

How long does it take to bring a development or evaluation system online? Does it need human intervention?

Are there any special restrictions on sandbox or developer systems? (storage, API’s, queries, users etc)

Do we have the ability to give customers "sandbox" instances, i.e. exact copies (including metadata and data) of our production instance, for testing purposes? If so, can we create them directly, or does it take a request and lead time? How often can sandboxes be refreshed?

To what extent is the system "metadata-driven," i.e. how much can I change without code?

User Experience
How accurate is the development roadmap for the next release? Next year’s worth of releases?

Are there mobile versions of the application? If so what limitations, if any, are there?

Is user training available online?

How extensive is the help system?

Administration
Can my system administrators "log in as" other users, in order to diagnose problems or confirm security settings?

For an implementation our size, how much IT time is typically required to manage the system?

How detailed are users' activities logged? What can a sysadmin see? e.g. can we see who logged in when; what functions they used; what pages they viewed; etc.

Not all clouds are created equal

2012-09-01T15:51:00.002-07:00

One of the great things with making cloud software is it is really easy to develop incredible useful and scalable software. Unfortunately there is a downside to that too.

Years ago, when you wanted to start a company you had to spend a lot of money and time to get it up and running. That meant you had to be very dedicated to it, since you typically had your life savings, and in many cases your friends and family's money too.

With companies so easy to start, it's also real easy to shut them down and many cloud companies have been closed down without much effort. That is one of the risks to cloud companies. It's important to understand how invested the management team is before you start betting your company on them.

Another challenge with "cloud vendors" is since cloud has become the hot phrase of 2012, everyone is suddenly a cloud vendor. Companies that have been selling products for years suddenly put cloud in front of it and try to pretend it is something different.

True cloud vendors are built from the ground up differently. They are built to take advantage of the benefits of multi-tenancy. They are built so scale seamlessly. They don't require new client software to be installed.

It's important to understand the architecture to be able to weed out the false cloud vendors from the real ones.

This blog will help explain how to decide which cloud vendors are good and which ones are trying to spin a tale of innovation to cover their lack of it. Hopefully it will help you. We would love it if you help share what you learn at www.sharethecloud.com and let others learn from your experiences.