Cloud or your own server: compare costs, security and exit, then migrate in steps

A new server arrives as one quote with one large number on it. The cloud arrives as a monthly fee that looks modest beside it. Side by side, the cloud seems cheaper, yet over the life of that server it can just as well cost more. Deciding on the cloud or your own server means comparing the same period, the same work and the same risks, and knowing how you would get out again.

For many organisations the choice is due now: Microsoft's extended support for Windows Server 2016 ends in January 2027 (source: Microsoft, June 2024). A business unit may face it for the last application in its own server room, an accountant when a client asks which quote to sign.

In many organisations email and office software already run as SaaS, so the real decision is about what still lives on the server.

Work out the TCOTCO (total cost of ownership)Every cost of an option over the same period: purchase or migration, licences, management, energy, backup, replacement and the cost of leaving. of each option over the years you would use a new server, for example five. Server side: hardware, licences, installation, maintenance, management, backup, energy and the replacement at the end. Cloud side: migration and a period of running both, subscriptions, management, backup of cloud data, a second internet line and the cost of leaving. Count your own staff time on both sides too.

Microsoft states that in every cloud model four things stay yours: the data, the devices that connect, user accounts and access management, including multi-factor authenticationMulti-factor authentication (MFA)Signing in with a second step besides the password, such as a code or an approval in an app on your phone. (source: Microsoft, August 2026). The UK NCSC's cloud security principles make a practical checklist for questioning a provider (source: UK NCSC, June 2023).

Availability and the internet line

When the internet fails, a server in the office keeps working; in the cloud the office stops, though people at home carry on. Translate the availability in the provider's service level agreement (SLA) into time. A worked example: 99.9 percent over a 30-day month allows about 43 minutes of downtime. If the cloud becomes your only workplace, add a second internet line from another provider or over the mobile network, and check whether the provider's backup matches your needs: see backup and recovery.

The UK NCSC advises knowing where your data is and who can access it, and identifying the legal jurisdictions it could be subject to; a jurisdiction may be able to request your data from the provider (source: UK NCSC, June 2023). That is data sovereignty in practice: which government can, in the end, reach your data. Rules differ by country and sector, but they share one principle: when personal data goes abroad, your responsibility travels with it.

The EU's adequacy list includes, among others, the United Kingdom, Japan, Brazil and US companies in the EU-US Data Privacy Framework (source: European Commission, November 2026). Check your customer contracts too, because a client may require data to stay in one country. For the GDPR side, see data protection in practice.

Lock-in is partly technical, features and interfaces that differ per provider, and partly commercial: egress feesEgress feeA charge a cloud provider makes for data leaving its network, for example when you move your data to another provider or back to your own server.. The UK Competition and Markets Authority found that egress fees and barriers to interoperability limit customer choice in cloud services (source: UK CMA, March 2026).

In the EU, the Data Act, which has applied since 12 September 2025, sets minimum terms for cloud contracts and requires platform and software providers to offer open interfaces and export data in a commonly used, machine-readable format (source: European Commission, December 2025). Switching charges, including egress charges, disappear from 12 January 2027; until then providers may still charge the costs they incur (source: European Commission, December 2025). For EU financial entities, DORA, the EU regulation on digital operational resilience, adds exit strategies with mandatory transition periods (source: EUR-Lex, December 2022).

• Data export: which data, in which format, and when you last tested an export.
• Your own copy: a recent backup outside the provider, under your own accounts.
• Notice and transition: notice periods, how long the service runs during a switch, when data is deleted.
• Costs of leaving: egress and other charges, and who pays for the work.
• Dependencies: integrations, sign-in and provider-specific features to replace.
• Owner: one person who keeps the plan current at each renewal.

Microsoft's migration guidance tells you to retain workloads that cannot move because of regulatory constraints, technical dependencies or business continuity requirements (source: Microsoft, July 2025). Hybrid is then an end point rather than a phase: SaaS for office work, one small local server for what needs it. The price is double management and two backups, so keep the local part small and document the links.