Hardly any small business chooses between the cloud and its own server of its own free will. Usually a date makes the choice.
Extended support for Windows Server 2016 ends on 12 January 2027. Exchange Server 2016 and 2019 have been out of support since 14 October 2025 (Microsoft Lifecycle). If one of those servers sits in your back room, you have to replace it or retire it – often with only a few months' notice.
The question "cloud or on-premises" is less technical than it sounds. It comes down to five questions: what has to run locally, who carries the operations, where the data may live, what it costs over its lifetime and how you recover from an outage.
On-premises and cloud: what the terms mean
On-premises means servers, storage and software run on hardware your business operates itself – in a server room, in the office or in a rented rack in a data centre. You buy it, maintain it and replace it.
Cloud means a provider delivers the same resources as a service, and you pay for them on an ongoing basis. As with cloud computing in general, there are three levels:
- IaaS: you rent virtual servers and run the operating system and applications yourself.
- PaaS: the provider also runs the operating system; you bring the application.
- SaaS: you use a finished application, Microsoft 365 for example.
For a small business this distinction matters more than the word cloud itself. An email server replaced by Exchange Online is a move to SaaS. A file server that keeps running as a virtual machine at a provider is IaaS – and needs almost as much care as before.
Question 1: What really has to run locally?
Not everything can move. Three cases argue for keeping part of it on site:
- Software without a cloud edition. Industry applications, machine controllers or old databases the vendor only supports on your own server.
- Dependence on the line. If the internet goes down, cloud work stops too. Where a workshop or a practice has to keep going without a connection, the critical part belongs on site.
- Large files in-house. CAD drawings, video editing or imaging data that move between workstation and storage every day are often faster locally.
Everything else – email, calendars, file storage, telephony, accounting with a cloud edition – is a candidate for the cloud today. The question is not whether it works, but whether it pays off.
Question 2: Who carries the operations?
This is where the most common misunderstanding sits. The cloud takes part of the work off your hands, never all of it.
Microsoft describes the split as a shared responsibility model: on-premises, you own the whole stack, from the data centre to the user account. In the cloud, the building, the hardware and – depending on the level – the operating system move to the provider (Microsoft Learn, "Shared responsibility in the cloud", August 2026).
What stays with you in every model
According to the same document, four things stay with you regardless of the model:
- Data: classification, protection and encryption decisions.
- Endpoints: the laptops and phones used to reach the services.
- Accounts: who gets an account and who loses it again.
- Access rules: roles, multi-factor sign-in such as two-factor authentication, and sign-in conditions.
So the cloud is not automatically more secure: the provider takes over the lower layers, the upper ones stay with you. Microsoft also gives typical examples of what goes undone on-premises: delayed patching, inadequately secured server rooms, incomplete monitoring, hardware without vendor updates and untested backups. If you cannot honestly tick that list off for your own server, you have already answered the security question – wherever the server stands.
How to lock down a cloud environment in practice is covered in Securing Microsoft 365 with Business Premium.
Question 3: Where may the data live?
Many small businesses assume personal data must not leave Switzerland. The law says otherwise.
Swiss data residency is not a legal requirement
The Swiss Data Protection Act allows you to hand processing to a service provider, but the responsibility stays with you (Art. 9 FADP, SR 235.1). Disclosing data abroad is permitted if the Federal Council has found that the destination country offers adequate protection, or if appropriate safeguards are in place, contractual ones for example (Art. 16 FADP).
For the US this has applied since 15 September 2024 – but only to companies certified under the Swiss-U.S. Data Privacy Framework. The Federal Council lists the countries it considers adequate in Annex 1 of the Data Protection Ordinance (DPO, SR 235.11) – so the list can change (Federal Council press release, 14 August 2024).
Location does not answer who may access the data
A data centre in Zurich sounds like control. All it settles is where the disk sits. The US CLOUD Act of 2018 obliges US providers to hand over data in their possession, custody or control when ordered to – whether that data is stored inside or outside the United States (18 U.S.C. § 2713).
That is no argument against the cloud. It is a reason to ask the right question: which data is sensitive enough that even this possibility must be ruled out? For patient records, professional secrets or plans under confidentiality, the answer differs from quotes and calendars. A Swiss location makes the assessment simpler. It only becomes data sovereignty together with the question of who can access the data.
Question 4: What does it cost over its whole lifetime?
The purchase price of a server is the smallest number in the comparison. An honest calculation sets the total cost over the lifetime side by side:
| Cost block | On-premises | Cloud |
|---|---|---|
| Acquisition | Hardware, replacement once vendor support ends | none, but a fee per user or per unit |
| Licences | Server and access licences, one-off or subscription | usually included in the subscription |
| Infrastructure | Power, cooling, space | included in the price |
| Operations | Updates, monitoring, backup | Configuration, accounts, backup of your own data |
| Dependency | Hardware failure on site | Internet line and provider |
The two curves run fundamentally differently. On-premises is expensive at the start and predictable afterwards – until the next replacement. The cloud is cheap at the start and grows with every user and every gigabyte. Which curve works out cheaper for you depends on your figures, not on a rule of thumb.
One item is missing from almost every comparison: the time someone in-house spends on the server. If the person who "does the IT" was actually hired for accounting or sales, that effort appears on no invoice. How to put a number on it is shown in the guide to outsourcing IT.
Question 5: How do you recover from an outage?
A backup belongs in every model, the cloud included. Microsoft 365 protects the platform against outages. That is not a complete backup of your business: the recycle bin and version history only reach back so far, and a compromised account can delete a lot, or ransomware can encrypt synced files.
Three rules apply whatever the model:
- A copy outside the system it is meant to protect. A backup on the same server is a copy, not a safeguard.
- A tested restore. A backup that has never been restored is an assumption.
- A plan for losing whole systems: who decides what comes back first. More on this under disaster recovery.
How we set up backup and recovery is described on the Backup & Cloud page.
Hybrid: the norm, not the compromise
Most small businesses do not end up with a pure solution. A hybrid cloud combines both: email, files and collaboration in the cloud, the industry software or machine controller on site.
That makes sense as long as each part has a reason to be where it is. The price is complexity: accounts, permissions and backups have to line up across two worlds. Without a central sign-in, the same file soon lives in three places – on the server, in OneDrive and on a USB stick. That is exactly what a clean modern workplace sorts out.
The move: in stages, not overnight
A move to the cloud rarely succeeds in one go. This order keeps the risk small:
- Take stock. Which applications, data and dependencies exist, and who uses them?
- Sort. What moves as SaaS, what as a virtual server, what stays on site, what gets switched off?
- Start with something non-critical. Often email and calendars, because the path to Exchange Online is well documented.
- Settle backup and the way back before the move, not afterwards.
- Switch the old server off once everything demonstrably works – instead of leaving it running "just in case".
The last point sounds trivial. But a forgotten server without updates is exactly the system on the list at the end of question 2.
What ALPENIQ does here
As your outsourced IT department, we look after servers on site or in the cloud, the network, backup and workstations – and we see the move through when a switch to the cloud is due. We document where which data lives during the inventory, so you can answer the data location question. What that looks like day to day is on the IT outsourcing page.
What we do not do: sell you the cloud where a local server is the better answer.
Conclusion
Cloud or on-premises is not decided by technology but by five answers: what has to run locally, who carries the operations, where the data may live, what it costs over its lifetime and how you recover. For most Swiss SMEs that adds up to a hybrid setup with a clear reason for each part. If you run a server with an end-of-support date, answer the five questions now rather than in January 2027.
Where to read on
- Which gaps attackers actually exploit in small businesses: Cyber security for SMEs
- What Microsoft 365 already includes: Microsoft 365 for SMEs
Frequently asked questions (FAQ)
What does on-premises mean, in simple terms?
On-premises means servers and software run on hardware your business operates itself – in your own server room or a rented rack. You buy the licences, install the updates and replace the hardware. The counterpart is the cloud, where a provider takes over that operation as a service.
What are the pros and cons of on-premises and cloud?
On-premises gives you full control over hardware, location and access and works without the internet, but it needs investment, maintenance and replacement. The cloud is available quickly, scales with you and takes hardware and data centre off your hands, but it costs money every month and depends on your connection. Data, accounts and access rules are your responsibility in both models.
What is a hybrid cloud?
A hybrid cloud combines your own servers and cloud services into one environment. Typical for a small business: email, files and Teams run in the cloud, while industry software or a machine controller stays on site. What matters is a shared sign-in and a backup that covers both parts.
Does a Swiss SME have to store its data in Switzerland?
No, the Swiss Data Protection Act does not prescribe a storage location. Data may go abroad if the Federal Council has found that the destination country offers adequate protection, or if appropriate safeguards are in place (Art. 16 FADP). Industry rules, contracts or professional secrecy can be stricter – that has to be checked case by case.
Is your own server more secure than the cloud?
Not automatically. Your own server is only as secure as its updates, its access rules and its backup. The cloud takes the data centre and hardware off your hands, but not responsibility for accounts and data. What matters is who actually runs it and whether they can prove it.