Cloud computing is now the default place to run software and keep data, but the term gets used loosely. This guide explains what it actually means, the service and deployment models, how it changes data management, where the real costs and risks are, and how to get started without making expensive mistakes.
Updated October 2026: I rewrote this 2023 post. The original repeated its “future of cloud computing” section three times, claimed that public clouds are “less secure” than private ones (which is too simple to be useful), and promised that cloud costs are “dropping rapidly” without evidence. This version is built on the US National Institute of Standards and Technology (NIST) definition, explains the shared-responsibility model that actually decides who secures what, and adds the cost and regulatory points that matter for data today.
What Cloud Computing Is
The standard definition comes from NIST (Special Publication 800-145): cloud computing is “a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.” In plain terms: instead of buying and running your own machines, you rent computing, storage and software over the internet from a provider that runs them at scale, and you can start and stop using them within minutes.
NIST lists five essential characteristics. If a service lacks them, it is probably just hosting with a cloud label:
| Characteristic | What it means in practice |
|---|---|
| On-demand self-service | You can create resources yourself, with an API or console, without waiting for a human. |
| Broad network access | Services are reachable over standard network protocols from many kinds of devices. |
| Resource pooling | The provider serves many customers from shared hardware (multi-tenancy), assigning resources dynamically. |
| Rapid elasticity | Capacity can scale up and down quickly with demand. |
| Measured service | Usage is metered, so you pay for what you use and the provider can optimise resources. |
The Three Service Models
The service models describe how much of the stack the provider manages for you. The more they manage, the less you control and the less you have to run:
| Model | You get | You manage | Examples |
|---|---|---|---|
| IaaS (Infrastructure) | Virtual machines, storage, networks | Operating system, runtime, applications, data | Amazon EC2, Azure Virtual Machines, Google Compute Engine |
| PaaS (Platform) | A place to deploy code or containers, with the runtime handled | Your application and its data | Managed container and app platforms, managed databases, serverless functions |
| SaaS (Software) | A finished application used through a browser or app | Your configuration, users and data | Google Workspace, Microsoft 365, Salesforce, Slack |
NIST’s wording is that, in IaaS, the consumer can deploy and run arbitrary software including operating systems and applications; in PaaS, the consumer deploys applications using languages and tools the provider supports; and in SaaS, the consumer uses the provider’s applications. Newer terms such as “serverless” (see our serverless guide) and “containers as a service” sit on a spectrum between IaaS and PaaS rather than being separate categories.
A useful rule: pick the most managed model that still does what you need. SaaS if a product already solves your problem, PaaS or serverless if you are building something custom, IaaS only when you need control the higher levels don’t offer. Each step down the stack gives you more flexibility and more to patch, monitor and pay for.
The Four Deployment Models
- Public cloud: infrastructure open to the general public, owned and operated by a provider (AWS, Microsoft Azure, Google Cloud and others).
- Private cloud: infrastructure operated for a single organisation, on its premises or hosted by someone else.
- Community cloud: shared by a set of organisations with common concerns, such as a government or research consortium.
- Hybrid cloud: a composition of two or more of the above that remain distinct but are used together, for example sensitive workloads on private infrastructure and the rest in a public cloud.
Is public cloud less secure than private? Not as a rule. Big providers run security operations most organisations can’t match, but the model is shared: per AWS’s shared responsibility model, the provider is responsible for protecting the infrastructure that runs its services (the facilities, hardware, virtualisation and so on, “security of the cloud”), while customers are responsible for what they put on it (“security in the cloud”): guest operating system patches, application software, firewall (security group) configuration, data encryption and classification, and access permissions. How much falls to you depends on the service: more with EC2 than with a managed storage service. Many cloud security incidents trace back to the customer’s side of that line: public storage buckets, over-broad permissions, leaked keys and unpatched software. A private cloud you run badly is less secure than a public cloud configured well, and vice versa.
How the Cloud Changed Data Management
The old title of this post was about data management, so here is what actually changed for data:
- Storage became an API. Object storage lets applications store effectively unlimited data and pay for what they keep. (We compare options in choosing a cloud storage solution.)
- Databases became managed services. Relational, key-value, document, search and analytics databases run as services with automated backups, patching and replication. You still design schemas and queries, and you still need to test restores.
- Storage and compute separated. Modern data warehouses and lakehouses keep data in cheap object storage and spin up compute only when you query it, which makes large-scale analytics accessible to small teams.
- Disaster recovery got cheaper and easier. You can replicate data across Availability Zones or Regions, but replication is not backup: corruption and deletion replicate too. Keep versioned, separate backups and practise restoring.
- Data pipelines moved to the cloud. Event streams, queues and workflow tools move data between systems continuously. For a hands-on example, see our feedback-analysis workflow.
Benefits and Trade-offs, Honestly
| Benefit | The catch |
|---|---|
| No upfront hardware spend. Pay as you use, start in minutes. | Costs can grow without notice. Unused resources, forgotten test environments and data transfer fees add up. Budgets, tagging and alerts are essential. |
| Elastic scale for spiky demand. | Elasticity only saves money if your architecture can scale down too. Steady, predictable workloads are often cheaper on reserved or owned capacity. |
| Speed. New environments in minutes, global reach. | Speed without guardrails creates sprawl and security gaps. You need account structure, naming rules and policies. |
| Managed services reduce operations work. | They also deepen vendor dependence. Proprietary services and data-transfer charges raise the cost of leaving. |
| Resilience through multiple zones and Regions. | You must design for it. A single-zone setup in the cloud is not highly available, and outages do happen. |
| Security tooling from the provider. | Misconfiguration on the customer side is a common source of incidents. |
Data transfer is the classic hidden cost. Many providers charge to move data out. For example, Amazon S3’s pricing page lists data transfer out to the internet at about $0.09 per GB after a monthly free allowance. That can dominate the bill for data-heavy products and makes switching providers expensive. In the EU, the Data Act addresses this: it has applied since 12 September 2025, requires cloud providers to facilitate customers switching to another provider, and, per the European Commission’s explainer, removes switching charges including data egress charges entirely from 12 January 2027, with providers still allowed to charge during the transitional period before then.
Regulation, Residency and Sovereignty
Where data lives and who can access it matters legally. Privacy laws such as GDPR restrict transfers of personal data, sectors such as health and finance add their own rules, and governments increasingly require certain data to stay in-country. When choosing a provider and Region, check: which Regions hold your data, whether you can restrict data to them, how the provider handles government access requests, what certifications it has for your sector, and what contract terms (data processing agreements) apply. Your legal and security teams should be involved before you move regulated data.
Where to Start
- Start with SaaS for commodity needs (email, documents, chat, CRM) instead of building or hosting them.
- For something custom, start small and managed. A static site, a container service or a serverless function is far easier to run than a fleet of VMs. See how to deploy a web app on AWS for a worked example.
- Secure the account first: multi-factor authentication on the root or owner account, individual admin identities, least-privilege roles, and a budget with alerts.
- Learn one provider well before going multi-cloud. Multi-cloud adds complexity, and most teams are better served by one provider plus portable practices such as containers and infrastructure-as-code.
- Define a backup and exit plan from day one: where the data is, how it’s backed up, and how you would move it.
- Measure cost per feature or per customer as you grow. Cloud economics are a product decision as much as an engineering one.
Where Cloud Computing Is Heading
Rather than predicting, here are trends that are already visible. AI workloads are driving demand for GPU capacity and managed model services, which makes capacity, quotas and egress costs central to planning (see how large language models work for background). Higher-level abstractions keep replacing raw infrastructure: serverless functions, container platforms that set up load balancers and certificates for you, and managed data services. Regulation is pushing providers toward portability and transparency, as the EU Data Act shows. And cost discipline (often called FinOps) has become a standard practice, because pay-per-use pricing rewards teams that measure what they run. None of these makes cloud less useful; they make choosing deliberately more important.
What is cloud computing in simple terms?
Renting computing resources (servers, storage, databases, software) over the internet from a provider instead of buying and running your own hardware. You can start and stop quickly and are billed for what you use. NIST defines it as on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released.
What is the difference between IaaS, PaaS and SaaS?
They differ in how much the provider manages. With IaaS you rent virtual machines, storage and networks and manage the operating system and everything above it. With PaaS you deploy your application on a managed platform. With SaaS you simply use finished software through a browser or app.
Is the public cloud less secure than a private cloud?
Not inherently. Under the shared-responsibility model, the provider secures the underlying infrastructure and you secure your data, configuration, identities and applications. Many cloud incidents come from customer misconfiguration, so a well-configured public cloud can be more secure than a poorly run private one.
What are the biggest hidden costs of the cloud?
Data transfer out of the provider, unused or forgotten resources, over-provisioned capacity, and premium managed services running around the clock. Set budgets and alerts, tag resources, and review spending regularly.
Is cloud storage the same as backup?
No. Storing data in the cloud keeps it available, but deletions and corruption can be replicated. A backup is a separate, versioned copy you can restore from, ideally in a different account or provider.
