Bob Hi Aurélien I recently attended a Cloud Computing conference run by Terrapinn which was actually quite good and provided much useful subject information. However, I posed the following question but didn’t receive a satisfactory answer; I’m not sure I ever would. So, I buy Software-as-a-Service (SaaS) from Company A, then Company A buys Platform-as-a-Service (PaaS) from Company B, then Company B buys the Infrastructure-as-a-Service (IaaS) from Company C, Company C buys this from say Verizon Business, how am I to know where my data is stored or processed when any of the companies could switch without my knowledge? I may be talking a load of rubbish here but it’s a question I often think about. Bob

Ben Bob, the issue of data governance and location is quite a complex issue and is often debated in the arena of cloud security. The theoretical solution is to write it in your SLA and monitor the situation as part of your on-going cloud provider audit policy. If a cloud service provider is taken over, the new owners need to honour your SLA. In practice, however it can be a legal and practical nightmare. Groups such as the Jericho Forum have a number of sound tips and strategies for dealing with issues such as these - http://bit.ly/CSMv7