One of the issues surrounding cloud adoption is the data governance requirements a customer may have, and what, if any, controls the cloud provider offers. For example, a financial institution within a jurisdiction such as Switzerland or Australia has regulatory compliance requirements stipulating that customer information must remain within the jurisdiction. For a large organization, this "data residency" issue may be enough of a deterrent to adopting a public cloud solution - unless that cloud hovers over their jurisdiction, they must look at on-premise solutions as the only viable alternative.

It's interesting to note that encryption of the data is not a viable option here. In some jurisdictions, the regulations treat encrypted values as clear text. The value, in any format, is still the value, and therefore at risk. In discussing it with a number of CIOs recently, even without a regulatory requirement, they were still unwilling to simply encrypt their data. Why? Moore's law, for one. As one CIO pointed out - "five years from now, that notebook on your desk will likely be able to decrypt anything that I can encrypt today". Another mentioned that "managing encryption keys is not practical. If I have a million records of data in the cloud, it's wholly impractical to extract, re-encrypt, and re-insert all of those records, even if it was physically possible". The only practical alternative is to keep the data at home.

Cloud Formations On-Demand
In response to these data residency requirements, Oracle made a very interesting announcement today - they will be offering their CRM on-demand in Australia through a local hosting provider in Sydney.  What this means for Oracle customers is that they can adopt Oracle's CRM cloud solution, while addressing their data residency requirements - the data never leaves the shores of Australia.  If successful, Oracle plans on similar offerings through partners in other geographies. They are able to offer this because each customer gets their own instance of Oracle CRM on-demand, but it's delivered to the end user as a cloud solution.

This model could spell a new trend in public cloud delivery and adoption - the quasi-public cloud. It's the middle ground between hosting your own application in a private cloud, and using a public cloud application completely managed by the provider. It's not without its own challenges - it's not a true public cloud. By introducing a hosting provider, new questions are raised about who is managing the overall solution, who is responsible and liable when things go awry, and who has control at any given time? Enterprise cloud adopters were worried about the cloud provider accessing their data - now they will have to worry about hosting providers accessing the data as well.

One unmentioned but hoped-for benefit is finer grained management and control - the hosting provider may also be able to restore some of the data governance and controls that enterprise cloud applications have not been able to offer before now. For example, imagine coupling the Virtual Private Cloud of an Amazon with this new model of cloud delivery - the customer can control accessibility to a much finer grained level than traditional cloud solutions have been able to offer. While Microsoft will not even reveal the location of your Azure data, this type of public cloud / local hosting model can conceivably let you control your own instance for access, audit ability, monitoring, and anything else the hosting provider can offer you.

The Quasi-Public Cloud
So what about the traditional public cloud vendors? Salesforce.com recently announced that a third data center will be setup in the UK sometime in 2012, joining California and Singapore. Great news if you are in those jurisdictions, but doesn't help if your data cannot leave your jurisdiction.

Hang on - Imagine your users are able to use salesforce.com, entering all sorts of sensitive and personally identifying information that your regulatory requirements would normally prohibit, and all of that data remains under your control, in your own database. You would have the best of both worlds - all of the benefits of salesforce.com, with all of the data governance of an on-premise application.

Now stop imagining and start using it! That's what I envisioned 4 years ago, and offer today as the PerspecSys PRS Server^TM. At the risk of sounding like a sales pitch, this is what I envisioned every public cloud provider would need - a solution that lets customers adopt public cloud applications without compromising the decades of controls, management and governance they put into place for their enterprise data. Oracle's announcement only gets them residency, not privacy or security control, with the additional risk introduced by the hosting provider. The PerspecSys solution addresses all of this - provides public cloud data privacy, residency, and security to the customer for applications such as salesforce.com, without the additional risks.

Who's Next?
As more public cloud vendors acknowledge that data residency is a barrier to adoption, they will need to address it if they intend to grow beyond their borders. To those vendors, I say "Call me - we need to talk."

To those customers and prospects of salesforce.com, PerspecSys can help you today - enjoy the benefits of a cloud solution like salesforce.com, and have the same controls and data governance that a private cloud or on-premise solution offers for managing your sensitive data. Apps in the cloud - data at home!