Image: 27% voted for cloud computing in Phil Wainewright’s recent PaaS survey. This sounds like the easy option, but is everyone really clear on what they are letting themselves in for? SaaS is not going to be pretty for many ISVs.

In part one of this article I introduced Phil Wainewright’s five layer PaaS model. Phil asked readers to say which layer they would prefer to use for building a SaaS application. Readers had cast 173 votes by May 15th.

In part two I looked at layer one: do-it-yourself and layer two: managed-hosting. Neither is suitable for SaaS ISVs. In part three I move up to PaaS layer three: cloud computing. Might this be more suitable for ISVs building SaaS solutions?

Cloud computing was the most popular choice of Phil’s readers. 27% said they would prefer it to develop a SaaS application. I wonder how many of them realise that cloud computing, just like banking, relies on a simple confidence trick…

Hardware is a now an API

Cloud computing presents physical servers and storage as abstract services. You can now create a secure and reliable virtual data centre with a few simple API calls.

The market leaders have not yet revealed the size of their clouds. For the moment they just say their clouds are plenty large enough to meet whatever your needs might be.

This cannot be true, of course, because virtual resources must eventually map to finite physical hardware. We know that Google, Amazon, Microsoft, Sun, CA AppLogix (formerly 3Tera), Mosso, Joyent, Nirvanix and other providers have a lot of hardware, but it is not infinite.

The (unstated) limits are probably huge. However, there is always a risk the cloud cannot provide you with server or storage when you need them. Is the all-you-can-use confidence trick something you need to worry about, or is this more a theoretical than real problem?

Confidence tricks are not always bad

Banking could not exist without a confidence trick: that you can always get your money back when you want it. We know that this cannot be true. If too many savers want their money then no bank can honour every withdrawal.

We know what happens during a run on a bank. Even knowing this, we still accept the risk because banking is so useful to us.

The same risk and reward trade-off applies to cloud computing. We know resources are not infinite; but that they are infinite enough most of the time. As long, of course, as most users use reasonable levels of resources most of the time.

The benefits of cloud computing for SaaS ISVs more than outweigh the risk of a full cloud. You can safely ignore the cloud computing confidence trick, just as you ignore the confidence trick banking needs to survive.

Cloud computing beats managed-hosting hands-down

Cloud computing is a great hardware solution; far better that managed-hosting or do-it-yourself for SaaS ISVs. You only pay for what you need and you can easily scale as your SaaS business grows.

Your data is more secure that it would be on your own server, as the never-ending press coverage of lost and stolen data reminds us. The cloud computing provider takes care of the underlying hardware (which you never get to see or touch).

Even with these benefits, you need to cover the full application lifecycle, not just the deployment hardware. You have no time to set up test clouds, rolling-updates, active support, change control and so on.

Automation tools including RightScale and Scalr can help. But even so, this is not your core competence and you should stay well away.

The cloud is not as opaque as you might think

Providers prefer opaque clouds to better balance their workloads. Ideally it should not matter where your servers or storage are. Unfortunately, this utopia will not happen: national laws and jurisdictions from the real world have already intervened.

Data protection laws in Europe restrict how you can store and process customer’s data. As a result, the cloud is not as opaque as it might first seem. The cloud computing providers recognise this and have announced support for different jurisdictions.

Salesforce.com is adding data centres in Asia soon, with Europe to follow so customers can keep data and processing out of the US.

Amazon’s availability zones allow you to store your data in Europe today; server instances running in Europe will follow.

Coming up…

Cloud computing is too low-level for you to worry about. Focus on your domain; do not waste your time on (virtual) hardware (no matter how interesting this might be).

The next level up in the PaaS market model is level four: cloud IDEs. These build on the cloud computing platform, adding development and deployment tools. The idea is you can focus on your SaaS solution and not worry about anything else.

Next time on PaaS Talk I will take a first look at cloud IDEs. This is where PaaS starts to get really interesting; I look forward to seeing you in part four of this article.

What’s your view of cloud computing? Have you run into any problems separating test from production? How much time are you spending on operations? Are you using automation tools?

Image: Location independence is a great architectural concept but legal reality for PaaS is radically different You’ll need to keep track of what’s where in the real world if you want to stay out of trouble.

While Cuba is a popular holiday spot for Europeans, a 46-year old trade ban puts Cuba off-limits to Americans. Strictly enforced laws prevent US companies from doing direct or indirect business with Cuba.

The US trade ban became a big problem for travel agent Tour & Marketing International. Although based in Spain, the US Treasury’s Office of Foreign Asset Control (OFAC) added them to a blacklist. Why? For selling Cuban holidays to Europeans (US citizens cannot travel to Cuba).

As a result, their US-based domain register blocked about 80 of their .com domains for Cuba-related websites. The domain register gave no notice and refused to transfer the domains (they must freeze all US-based assets).

Are you breaking US law?

You might not have customers in Cuba, but what about all the subscribers of your SaaS solution:

• Do you know who and where they are?
• Are you sure your information is accurate?
• Could you prove it in a court of law?
• How will you track future changes?

Your PaaS provider could get a call from OFAC to suspend your SaaS application. You get no notice and appealing is difficult. This is not going to be good for your SLA…

Is storing data in Europe enough?

Metadata is also important, not just your application and data. For example, Amazon’s S3 storage service allows you to store your data in Europe, but what about your account data? If it is in the USA, Amazon could get a call from OFAC. While your European-data is still there, you might not be able to use it.

I am not sure that all ISVs building their business on Amazon S3 have fully considered this issue.

Wait for the law to catch-up?

It is not just the US and Cuba; cloud computing and cross-border trade disputes are an accident waiting to happen. The law will take years to catch up with cloud computing.

Until then, you need to know where your PaaS provider is storing your applications, data and metadata.

What can PaaS providers do today?

PaaS providers must make their customers aware of these potential problems. They will not convince European ISVs with an easy “Everything’s in the cloud; do not worry”; PaaS providers must be transparent and make it clear exactly where they are storing applications and data.

Splitting workloads by region could be a good differentiator. This might also open the market to non-US PaaS and utility-computing providers.

Coming up…

Next time on PaaS Talk I will look at another issue European ISVs must consider–who might be spying on your data: Is SaaS really Spying-as-a-Service?.