Own server or data centre: making the decision soberly

In most companies the decision is not made at a drawing board but under time pressure: a device fails, a maintenance contract expires, a vendor changes its software model. Then two quotes sit on the table that cannot be compared at first glance, because one names a one-off sum and the other a monthly amount. The comparison therefore does not start with technology but with the question of which tasks sit with whom once the decision is made.

A server on your own premises means you own the device, you decide on updates and timing, you can physically reach it — and you are responsible when it stops on a Friday evening. A server in a data centre means part of that responsibility moves into a contract, which creates a boundary where two organisations meet. That boundary is where the longest phone calls happen later. Drawing it cleanly matters more than any specification of processing power.

There is also a plain staffing question. In companies with ten to two hundred and fifty employees — small and medium-sized firms account for roughly 99 per cent (Statistisches Bundesamt, the German federal statistics authority) of all companies in Germany — there is usually no IT department, but one person who takes care of it alongside their actual job. Whether that person should look after servers or invest their time in workflows is a business decision, not a technical one.

Data centres advertise availability figures that look impressive. In almost all cases, though, the figure describes only the provider's infrastructure — power, cooling, network, often the virtual machine. It does not describe your application, your database, your internet connection or the time it takes for someone in your company to notice the outage. What matters in practice is therefore not the percentage but what it refers to and what happens if it is missed.

It helps to translate the percentage into hours. Only then does it become visible whether a commitment fits the business: a trades company that pulls job data in the morning and writes it back in the evening tolerates a different outage than a shipping warehouse where every hour of standstill costs parcels. The table below converts common commitments into time.

The values come from distributing the hours of a year across the committed share (worked example). Above all they show one thing: moving from a high commitment to an even higher one costs money but only helps if every other link in the chain keeps up. A company with a single internet connection and no fallback route will not reach the committed availability in daily operation anyway — in that case the money is better spent on a second connection than on a higher contract tier.

With a server on your own premises the location question is trivial, yet the obligations remain: physical access control for the technical room, access rights, logging, a verified backup concept and a contingency plan. The German federal information security authority describes these building blocks in detail in its baseline protection catalogue; they apply regardless of who owns the device. The most common misconception is that an own server is automatically safer. At first it is merely closer.

Operating in someone else's data centre adds contractual points. Where personal data is processed, a data processing agreement is generally required, naming purpose, scope, technical and organisational measures and any subcontractors involved. The server location belongs in the contract in writing, as does the question of whether systems can be accessed from a third country during maintenance — remote maintenance access is relevant under data protection law even when the data physically resides in Europe.

In practice it works better to approach the question from the data rather than from the provider: which data sits in this application, how sensitive is it, which retention and record-keeping obligations apply? Personnel data, health data and design documents are assessed differently from a shared calendar. The legal assessment in the individual case belongs in professional hands; the preparatory work — a list of applications and the data they hold — can be done by any company itself and is needed for process documentation anyway.

A company rarely runs one system; it runs eight to twelve. They differ in data volume, response time requirements, number of external users and record-keeping obligations. A single answer for all of them would be convenient but wrong for a considerable share of the systems. It therefore makes sense to send every application through the same grid individually.

This grid regularly produces a mixed picture — and that is not a sign of indecision but the result of differing requirements. The share of companies using computing capacity from the network is growing across Europe: for the Digital Decade the European Commission has set the target that by 2030 around 75 per cent (European Commission) of EU companies should use cloud services, data analytics or artificial intelligence. That does not mean everything moves there, but that both operating models will exist side by side.

The following points should be answered in writing before anything is signed — regardless of whether it is a rental contract for computing capacity, an application as a service or a maintenance contract for your own server. Verbal assurances from a sales conversation do not help during an incident.

If any of these questions is answered evasively in the conversation, that in itself is information about how operation will go later. Providers with orderly operations answer them without hesitation, because they have documented the answers for their own organisation anyway.