We are developing a web application that will deal with highly sensitive (financial) data of clients (audience is medium to large sized businesses). Clients will be under scrutiny from regulators & auditors and, as such, we will be too. More importantly to give clients a level of comfort our application and related hosting arrangement should instill a lot of confidence with them.

We are looking into using a cloud based service like Linode, Amazon EC2, etc. To allow for maximum flexibility We are keen on putting everything on virtual servers and avoiding having to buy our own hardware.

Does a cloud based service make sense for our particular scenario? If not what type of hosting should we consider? If so what should we look out for?



It will be difficult to locate secure infrastructure without being more hands on. You will likely be unable to fully secure the data stored on a hosting environment such as Amazon EC2. Specifically in regards to credit card storage and PCI, it's generally recommended not to store data in those environments.

Even having a dedicated server will not meet PCI requirements for storing data, as you will need to physically secure the space and have controlled physical access.

To meet most security requirements, you would need your own space with access control and physical security. For example, a fully enclosed cage within a shared data center could qualify. Most lower level products such as virtual private servers and dedicated servers would be unlikely to qualify.

The regulations applicable are going to be unique to the data, which will help clarify the exact requirements. If you want to get an idea for what you are getting into, you can look at the PCI DSS.

Good luck.


If you can find an auditor that will approve putting sensitive financial data in the cloud, you probably need to stop using Dewey, Cheatem, and Howe. In all seriousness, hosting for sensitive data needs to be done by a company that is SAS 70 certified and will allow auditors to examine their procedures (Sungard comes to mind as a potential source). In the US most finiancial IT auditing forms don't like to hear the word hosting because it implies that you don't have control over the data - which is a problem. From a cost perspective I suspect you will find that using a hosted service will cost far more than getting colocated space somewhere.


I suspect that Verizon's CaaS offering would work for that, and their ROC can let you sleep at night. They are used to dealing with PCI compliance (and stricter things like HIPPA and what banks want). Not the cheapest, but they can offer a very high level of service.

Disclaimer, I am an SA in the ROC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy