Cloud or Your Own Server: What Makes Sense for Small Businesses

Why the question of cloud or server keeps coming up

Sooner or later every small business faces the same decision. Its own server is getting old, the warranty is expiring, and a replacement costs several thousand euros. At the same time, email and office software have long been running on subscriptions. So why not move everything to the cloud? The answers vary widely depending on whom you ask, and they often depend on what that person sells.

This leads to the guiding question of this comparison: when is the cloud the better choice for a small business, when its own server, and when a mix of both? To answer it, we clarify the terms, present a thinking model from organizational economics, compare both options on cost, security, and dependency, review the findings, weigh two perspectives, and derive a decision per task.

The right question is not cloud or server, but which task goes where.

Terms: cloud, own server, hybrid operation

A widely used definition by the US institute NIST describes cloud computing as a model for enabling convenient, on-demand network access to a shared pool of computing resources, meaning networks, servers, storage, applications, and services, that can be rapidly provisioned and released (Mell and Grance, cited in Guo, Tafti, and Subramanyam 2025). Three levels are distinguished: software as a service, such as an office or accounting program in the browser, platform as a service, and infrastructure as a service, meaning rented servers and storage.

An own server, or on premises, stands in the business or in a data center, belongs to the business, and is looked after by it or its IT service provider. Hybrid operation combines both, for example email and office software in the cloud and industry software on the company's own server.

How widespread the cloud is can be seen from official statistics, analyzed in the article on digitalization in the Mittelstand in figures. In 2025, 54 percent of German companies with ten or more employees bought paid cloud services, 51 percent among small companies with 10 to 49 employees and 86 percent among large ones. The cloud was used mainly for email, data storage, and office applications.

The thinking model: three questions of transaction cost theory

The decision between cloud and own server is a make-or-buy decision. The guide on making or buying presents transaction cost theory for this, which goes back to Ronald Coase and was developed by Oliver Williamson. Its basic idea: every exchange on the market causes costs beyond the price, namely for searching for a partner, for negotiating and concluding the contract, and for checking whether delivery is as agreed.

It asks three questions. How specific is the task to the business? How uncertain is it? And how frequently does it occur? The higher the answers, the more doing it in-house pays off. For IT, a term that Williamson emphasizes is added: the danger of dependency, or lock-in. Whoever has invested a lot in a provider, for example in data, processes, and training, finds it hard to switch and loses bargaining power.

An everyday analogy makes this tangible. Almost every business buys electricity from the utility, because electricity is the same everywhere. A workshop with sensitive machines nevertheless keeps its own protection against voltage fluctuations, because an outage is particularly expensive there. IT is the same: buy what is general, protect what is special.

Cloud and own server compared

A worked example shows the costs over five years for a business with 15 workstations. The own server costs 8,000 euros for hardware and setup, plus annually 3,600 euros for support by the service provider, 1,500 euros license share, 1,200 euros for off-site backup, and 600 euros electricity. In the cloud, subscriptions cost 25 euros per user and month, migration a one-off 4,000 euros, and a separate backup of the cloud data 3 euros per user and month. In hybrid operation, a small server remains for the industry software. All figures are freely chosen.

The example shows a tendency, not a rule. The cloud is cheaper in the example because looking after the server is the largest item. It becomes more expensive when many users need expensive subscriptions or when the software only runs on a rented server. Whoever compares should calculate the total cost of all items, as with agency quotes, not the quoted price.

What studies show about choosing the cloud

Guo, Tafti, and Subramanyam (2025) studied 457 companies from various industries and countries, small, medium, and large. They defined small and medium-sized enterprises broadly, as having 2 to 999 employees. Perceived benefits encouraged the use of cloud software, while high internal IT spending and concerns about quality and risk slowed it, for small and large companies alike. Small and medium-sized companies that developed many of their own web services in-house used fewer rented servers. And those who had structured their own IT into independent modules were able to integrate cloud services more easily.

This fits transaction cost theory, on which the authors explicitly rely. Whoever has built a lot of specific things themselves faces higher switching costs and tends to stay with their own solution. Whoever structures their IT into clearly separated parts reduces this specificity and keeps the choice open.

Which criteria matter when selecting a cloud provider was compiled by Lang, Wiesche, and Krcmar in an expert survey reported by Könning, Westner, and Strahringer (2019). Among 13 criteria were two that earlier work had overlooked: compliance with the customer's legal requirements, for example through the provider's location and policies, and transparency about security, data protection, data access, and promised service levels. The same review names hidden costs, for example for additional control or a later switch, as a risk to the success of outsourced IT.

Control or relief? Two perspectives

The first perspective puts control at the center. The data stays in-house, nobody changes prices or terms unilaterally, and if the internet fails, work continues. This is supported by the worry about dependency, which also appears as a brake in the study by Guo and colleagues.

The second puts relief at the center. A small business rarely has someone who reliably installs updates, checks backups, and maintains access rights. A large provider has specialists for this around the clock. This is supported by the fact that attacks on small businesses usually come through outdated software, weak passwords, and unsecured remote access, as the article on cyberattacks on small businesses describes.

For most small businesses, I consider relief the more important consideration, but only for ordinary tasks. For them: an own server that is not maintained regularly is less secure than a properly managed cloud service. For specific and critical tasks, control keeps its weight. In many cases, this leads to hybrid operation, not as a compromise but as the result of the three questions.

Law and dependency: what the Data Act changes

Two legal points belong in every decision. First, data protection: if a provider processes personal data on behalf of the business, the General Data Protection Regulation requires a data processing agreement. The storage location should also be known. The guide on selecting software lists both as must-have criteria.

Second, dependency. Since September 2025, the EU Data Act has also governed switching between providers of data processing services, which include cloud services. According to Germany's Federal Network Agency, providers may no longer charge switching fees from January 12, 2027. Until then, only reduced fees are allowed that do not exceed the direct costs of switching. A switch should generally be technically completed within 30 calendar days, with the option of extension in complex cases. Changes to these rules are being discussed at EU level, so it is worth checking the current status.

• For every task, the three questions are answered: specific, uncertain, frequent.
• There is a data processing agreement, and the storage location is known.
• All data can be exported in an open format.
• Cloud data is also backed up independently of the provider.
• Accounts are registered to the business, not to the service provider.
• There is a plan for an internet outage, such as a second line or mobile data.

Conclusion: cloud, server, or both?

The question was
the cloud, when an own server, and when a mix is the better choice for a small business. The answer follows from the three questions of transaction cost theory and applies per task, not to the whole business. Ordinary tasks such as email, office software, and file storage fit the cloud, because they are the same everywhere and a large provider runs them more reliably than a small business. Specific and critical applications are often better kept close to the business.

The findings support this: benefits encourage the cloud, concerns about risk and a lot of self-built specialist software slow it down, and a well-structured own IT keeps the choice open. Dependency, long the strongest argument against the cloud, is reduced by the Data Act. What remains is a duty that is often overlooked: whoever moves to the cloud hands over the operation, not the responsibility for their data.

First steps for this week

1. List all applications currently running on your server or in the cloud.
2. Answer the three questions for each: how specific, how uncertain, how frequent?
3. Calculate the total costs of both options over the next five years, including support and backup.
4. For existing cloud services, check the data processing agreement, storage location, and export options.
5. Clarify whether your cloud data is backed up independently of the provider, as described in the guide on backup with the 3-2-1 rule.