Jacobs Engineering, which needs to protect sensitive client data, reviewed Google's security last year. "At that point, 80% of our concerns were addressed by Google, but there were still those 20% where we said 'Hmm, I just don't know about that,'" Wright says. "You just don't have visibility into the cloud."
Temple University's chief information security officer and the university counsel conducted an extensive review of Google Apps' security -- and reached a different conclusion. "They came back and said their security is as good as or better than ours," says Stahler. Rentokil's Howe came to a similar conclusion. "We believe it has improved our overall security in a significant way," he says.
A related security issue for Jacobs Engineering revolves around where its data is stored. "We have some clients who are sensitive to geographic storage issues -- where is my data, per country," Wright says. Google says it can't guarantee that a given set of data stored by Google Apps will be maintained within the borders of a specific country.
Availability and uptime
With regard to availability and uptime, Google, like other cloud providers, does offer a service level agreement that guarantees "three nines" availability -- in other words, it's up 99.9% of the time. One way Google achieves that is by writing data simultaneously to multiple servers within its data center and synchronously copying that data to a second data center. If the service goes offline, however, Google's liability is limited to refunding part of the subscription fee. Business losses as a result of downtime aren't part of the deal.
Google has had its share of outages in the past year, but that doesn't seem to have dissuaded users of Google Apps for Business so far. Temple's Stahler recalls an outage in September that lasted a couple of hours. Her users noticed the problem right away, but she says her team wasn't under fire because everyone realized that it was Google's problem. "Before, we would have been scrambling and would have had to drop everything," she says. But with Gmail, people simply accepted it. "They realized that Google had thousands of people working on it and that this was unusual."
Wright says downtime hasn't gone unnoticed, but the small amount of it hasn't been a big concern for him. While e-mail is mission-critical, it's doesn't require extremely high availability. "Our environment doesn't demand five nines," he says.
The city of Los Angeles had many privacy concerns as it was considering going with Gmail, says Randi Levin, general manager and chief technology officer. But Google's approach of breaking apart data and encrypting the pieces helps to allay fears of unauthorized access. As to what Google knows about individual users, city assistant general manager Crawford says he's satisfied with Google's controls. "Google doesn't have the right to read the data ever, unless we give them that right by request," he says. In addition, he says, "We can audit to see who's touched our stuff."
Proceed with due diligence
Overall, user acceptance testing for the city of Los Angeles's pilot, which ended April 12, has been very positive, Crawford says, but he cautions that the transition isn't without its share of challenges. "I'm not going to tell you that everyone loves the product and that we're ready to make this leap. We need to brush off a couple of rough edges," he says. But he has no qualms about pushing e-mail into the cloud. "If someone else can do it cheaper I'd rather give that to them and use my staff to solve other problems."
For Rentokil, successful deployment was more about identifying and mitigating risk and managing business expectations. "If you decide to change, run it as a business change project, not an IT project," Howe says.
Jacobs Engineering's Wright doesn't discount a move to Google Apps in the future, but he advises other IT managers to carefully examine the integrations required to make internal and external environments work together before making any commitments. "I think it's viable," he says, "but only if you go into it with your eyes wide open."
Freelancer John Brandon contributed to this story.