Unit 2: The cloud giants and why you probably do not need them

When someone says "cloud", many people automatically think of Amazon, Microsoft or Google. They are the three giants. Let us get to know them, and let us understand why, for your SME of 5, 10 or 20 employees, they are probably not the best option.

The three giants

AWS (Amazon Web Services): it is the world leader in cloud. It is used by Netflix, Airbnb, NASA. It offers more than 200 different services. It is like a five-storey shopping centre: it has absolutely everything, but you need a map to find what you are looking for.

Azure (Microsoft): the second in the market. Its strong point is that it integrates with the entire Microsoft ecosystem (Office 365, Teams, Active Directory). It is designed for large corporations with thousands of employees and their own IT departments.

Google Cloud: the third. Very powerful in artificial intelligence and in processing large volumes of data. Designed for technology companies that handle millions of records.

Why NOT for your SME?

Imagine you need to go to the next town, 20 kilometres away. AWS, Azure and Google Cloud are like chartering a plane to make that trip. Do you get there? Yes, of course. But the cost, the complexity and the sheer overkill make no sense.

These are the concrete reasons:

Excessive complexity: just to configure a server on AWS you need to understand concepts like VPC, Security Groups, IAM Roles, Auto Scaling Groups... You need a dedicated cloud engineer just for the initial setup.

Unpredictable bill: the three giants work on a pay-as-you-go model. It sounds good in theory ("you only pay for what you use"), but in practice your bill can vary every month. An unexpected spike in traffic, a process left running by mistake... and the surprise arrives at the end of the month. SMEs need predictability, not nasty shocks.

Over-sized: these services are designed to scale to millions of users. You need to serve 10 or 20 people. It is like hiring catering for 500 people when you are having dinner with your family.

The data sovereignty argument

And now comes a subject that many people ignore, but which is important: where is your data physically located?

GDPR (General Data Protection Regulation): if you have customers in Europe (and if you are a Spanish SME, you do), the personal data of those customers must be protected in accordance with European law. It is not optional: it is the law. And the fines for non-compliance can reach 4% of your annual turnover.

Cloud Act (USA): the part many people are unaware of. In 2018 the United States government passed a law that allows it to request access to data stored by American companies, wherever it is physically located. If your data is on an Amazon server in Frankfurt, the American government can request access. Amazon, Microsoft and Google are American companies.

Schrems II ruling (2020): the Court of Justice of the EU declared that transferring personal data to the USA without additional safeguards is problematic. This ruling invalidated the "Privacy Shield" agreement. Although a new framework has since been negotiated (the "Data Privacy Framework"), the legal situation remains unstable.

Practical conclusion: for a Spanish SME, the legally safest option is to keep the data on European servers, operated by European companies. Not because Amazon is going to spy on your invoices, but because in the face of any audit or claim, your legal position is far more solid.