How Safe Is Your Business Data When Using Cloud Software?

1. The Shared Responsibility Model

This is the single most important concept to understand. Cloud security is a partnership. If someone leaves a password on a sticky note, the most secure data centre in the world cannot protect the business behind it.

Every major provider frames it the same way, even if the exact wording differs. AWS calls it "security of the cloud" versus "security in the cloud", and Microsoft and Google Cloud describe a similar split. The provider secures the physical building; the customer secures how they use it.

What the provider secures

The physical data centres, the hardware, the cabling and the core software infrastructure. They keep the power on, patch the underlying platform and make sure the servers themselves aren't physically stolen or destroyed. This is genuinely hard, expensive work — the kind most small businesses could never fund on their own.

What you secure

Who has passwords, whether Multi-Factor Authentication (MFA) is switched on, what permissions each staff member has, and whether your team can spot a phishing email before they click it. None of that is the provider's job, no matter how good their infrastructure is.

For a cabinet shop, that "in the cloud" half of the deal usually covers the quoting and job-management software holding customer names, addresses, floor plans and pricing, the shared drive with supplier quotes and drawings, and the email account variations and invoices are sent from. Every login into any of those is a door someone else's security budget cannot lock for you.

2. Cloud vs. On-Premise: A Comparison

Many business owners feel safer with a server sitting in the office, because they can see it. In practice, that visibility is often a false sense of security — a locked room protects against fewer threats than it feels like it does.

Neither column is risk-free. The point of the comparison isn't that the cloud is invincible — it's that the failure modes are different, and the cloud shifts the odds toward risks a business can actually manage with good habits rather than expensive hardware.

3. Why Most Cloud Breaches Are Self-Inflicted

It's tempting to picture a cloud breach as a sophisticated attack on a data centre. The evidence points somewhere much more mundane.

Thales's 2025 Global Cloud Security Study found that human error and misconfiguration remained the leading root cause of cloud data breaches — around 31% of incidents — ahead of exploited software vulnerabilities and unpatched zero-days combined. In Australia, the OAIC's Notifiable Data Breaches report for January to June 2025 recorded human error behind 37% of notifications, while malicious or criminal attacks — dominated by phishing, ransomware and stolen credentials — accounted for the majority of the rest.

Put together, that means the typical breach isn't a break-in through the vendor's front door. It's a folder accidentally shared with "anyone with the link," a password reused from another site, or a convincing email asking someone to "update their payment details." None of those require defeating a data centre's security — they require one tired person clicking the wrong thing on an ordinary Tuesday.

For a small cabinet-making business, that's actually reassuring news: the risks that matter most are the ones you have the most control over.

4. Key Risks in the Cloud

While the underlying infrastructure is safe, the data sitting on top of it is still vulnerable to a handful of specific, well-understood threats.

Misconfiguration

A folder, drawing set or customer database accidentally set to "Public" or "Anyone with the link" instead of "Private." It's an easy mistake to make and, based on the industry figures above, one of the single most common causes of a breach.

Weak access controls

Reused or simple passwords ("Cabinets2024!" counts), shared logins between staff, and accounts that never get switched off when someone leaves. Shared logins are especially risky in a small team: no one can tell afterwards who actually did what.

Phishing and social engineering

A convincing email or text impersonating a supplier, bank or even a colleague, asking someone to click a link, reset a password or approve a payment. This is consistently one of the most reported incident types in Australian breach data, and it targets people, not servers.

Insider threats

A disgruntled employee downloading a customer list or pricing sheet before leaving. Rare compared with the risks above, but worth planning for — mainly by keeping permissions tight and removing access the day someone leaves, not the week after.

5. Protecting Your Side of the Deal

The good news is that the "your responsibility" half of the shared responsibility model is mostly a handful of habits, not a technical project. Here's where to start.

Turn on Multi-Factor Authentication everywhere

Microsoft's security team has reported that MFA blocks more than 99% of automated account-compromise attacks. If your quoting software, accounting platform and email provider all support it — and most do — turning it on is close to the highest return-on-effort security decision a small business can make. It takes minutes to set up per account and stops the overwhelming majority of stolen-password attacks cold.

Give people only the access they need

An apprentice or casual installer probably doesn't need admin rights to your quoting software, invoicing system or customer database. Most cloud platforms let you assign roles — admin, sales, production, read-only — so a single compromised account can't expose everything at once.

Remove access the day someone leaves

Old accounts for former staff or subcontractors are one of the easiest wins for an attacker and one of the easiest gaps to close. Keep a simple checklist for offboarding: software logins, shared drives, email forwarding rules and any API keys or integrations they set up.

Train the team to recognise phishing

Given how often phishing shows up in the breach data above, a five-minute conversation — "we'll never ask you to approve a payment by text, always call the supplier back on a known number" — genuinely moves the needle. It doesn't need to be a formal program to be effective.

Use unique passwords with a password manager

Reused passwords mean one leaked website exposes every account that shares it. A password manager makes unique, complex passwords practical for a busy team without anyone needing to remember them.

6. How to Vet a Cloud Software Provider

If you're evaluating a specific tool — a CRM, a quoting platform or a project management system — don't just take the sales pitch at face value. These are the trust signals worth asking about.

SOC 2 Type II report

A report against the AICPA's Trust Services Criteria, produced by an independent auditor. The "Type II" matters: it means the auditor checked that controls actually operated effectively over a 6–12 month window, not just that they existed on the day of a snapshot audit.

ISO 27001

An internationally recognised certification confirming a vendor runs a formal information security management system covering risk assessment, access control and continual improvement. It's common outside North America and, like SOC 2, is a genuine (if imperfect) signal of a mature security program.

Data encryption

• At rest: is data scrambled while it sits on their servers, so a stolen disk is useless on its own?
• In transit:is data scrambled while it travels between their server and your computer? Look for the padlock and "https" in the address bar.

Uptime SLA

A documented uptime guarantee — commonly 99.9% or higher — matters more than the headline number suggests. 99.9% uptime still allows roughly 8.7 hours of downtime a year; 99.99% brings that down to under an hour. Ask what the SLA actually covers, and whether you're compensated if it isn't met.

7. Questions to Ask Before You Sign Up

Certifications tell you a vendor was audited once. These questions tell you how they'll actually behave with your data day to day.

• Where is our data physically stored, and does that matter for our privacy obligations?
• Who at your company can access our customer data, and under what circumstances?
• How often are backups taken, and have you ever tested restoring from one?
• What happens to our data if we cancel — can we export everything, and when is it deleted?
• Do you support Multi-Factor Authentication and role-based permissions for our team?
• Have you had a data breach, and if so, how was it handled and disclosed?
• Is our pricing, customer and drawing data used to train any AI models, and can we opt out?

A vendor that can answer these clearly, in writing, is telling you something useful about how seriously they take the job. One that can't, or won't, is telling you something too.

The Bottom Line

Your business data is highly safe in the cloud against physical loss, hardware failure and sophisticated infrastructure attacks — risks a small workshop was never well equipped to manage on its own server anyway. It is moderately vulnerable to human error, weak passwords and phishing, and those are squarely inside your control.

MFA, sensible permissions, a clean offboarding checklist and a team that can spot a phishing email will do more for your security than any certification a vendor can show you. Check for the certifications anyway — but don't let a well-secured platform lull you into skipping the basics on your side of the deal.

Frequently asked questions