What are Cloud Services?

Updated on 10 September 2026. The article now provides a more precise definition of cloud computing and clarifies the boundaries between IaaS, PaaS, and SaaS. Public, private, and hybrid deployment models have been added, while claims about automatic scaling, backup, availability, and guaranteed cost savings have been corrected. The article has also been expanded with the shared responsibility model, FinOps practices, data location and portability considerations, RTO and RPO, vendor lock-in risks, and the current cloud solutions offered by HostPark.

In today’s business environment, the speed of launching digital products, operational continuity, and the ability to adapt infrastructure to changing workloads directly affect operational efficiency. Cloud services provide companies with access to computing capacity, storage, networks, platforms, and ready-to-use software without requiring them to purchase their own server equipment. However, the cloud is not automatically cheaper, safer, or more reliable than on-premises infrastructure. The outcome depends on the architecture, pricing model, configuration, allocation of responsibilities, and quality of management.

A company can move its website, corporate applications, databases, development environments, backups, or individual infrastructure components to the cloud. At the same time, some systems can remain on the company’s own equipment, creating a hybrid architecture. The right choice therefore begins not with the name of a platform, but with an analysis of workloads, availability requirements, security, recovery objectives, data jurisdiction, and budget.

What are cloud services in simple terms?

Cloud services provide network access to a shared pool of configurable computing resources that can be rapidly provisioned and released. This principle forms the basis of the definition established in NIST SP 800-145, “The NIST Definition of Cloud Computing”. These resources include servers, networks, storage, platforms, applications, and related services.

Simply comparing cloud computing to renting a server explains only part of the concept. The cloud involves on-demand access, resource pooling, the ability to adjust capacity quickly, network availability, and measured consumption. Users receive the required capacity as a service, while the physical equipment and underlying components of the environment are maintained by the provider within the boundaries of the selected service model.

In Ukraine, the terminology and general principles governing the use of these solutions are also defined by the current Law of Ukraine “On Cloud Services”. For businesses, this is important not only as a legal framework. When choosing a provider, organisations should consider contractual terms, information security requirements, infrastructure location, and the rules governing the processing and storage of data.

How do cloud services work?

Cloud infrastructure is built on data centres containing physical servers, storage systems, networking equipment, power supplies, cooling systems, and physical security controls. Virtualisation and software-defined management separate logical resources from specific physical equipment. As a result, customers can use virtual machines, disks, networks, and other components without having direct access to the underlying server infrastructure.

Resources are managed through a control panel, an API, or automation tools. The customer specifies the required parameters, and the platform allocates resources from an available pool. Charges may be based on a reserved configuration, actual consumption, or a combination of these approaches. The precise terms are determined by the tariff and contract of the specific provider.

Automatic scaling is not a default feature of every cloud service. A platform may provide the necessary mechanisms, but they must be supported by the application architecture, load-balancing rules, monitoring, and predefined thresholds. Simply placing a virtual machine in the cloud does not mean that its processor capacity, memory, or number of instances will automatically increase during peak demand.

Cloud hosting is also not the same as backup. Hardware redundancy may protect against an individual physical failure, but it will not necessarily help after accidental deletion, database corruption, an application error, or data encryption by malware. These risks require a separate backup policy with defined retention periods, isolated copies, and regular recovery testing.

Main types of cloud services

The most widely used classification includes IaaS, PaaS, and SaaS. It shows which parts of the technology stack are managed by the provider and which remain the customer’s responsibility. The boundaries may differ between individual products, so the name of the model should always be checked against the technical documentation and contract.

IaaS – Infrastructure as a Service

IaaS is infrastructure delivered as a service, including virtual computing resources, disks, networks, IP addresses, and other underlying components. The provider manages the physical equipment and virtualisation layer, while the customer is generally responsible for the operating system, updates, user accounts, network rules, applications, and data.

IaaS is suitable for websites and web applications, testing environments, corporate systems, databases, and infrastructure with non-standard requirements. The customer retains significant control but also assumes more operational responsibilities. Amazon EC2 and Microsoft Azure Virtual Machines are well-known examples of global IaaS solutions. HostPark’s portfolio includes cloud infrastructure solutions in this category, particularly Atman Cloud public cloud.

Who is IaaS suitable for?

IaaS is appropriate for companies that require control over configuration, the ability to migrate existing systems, or the flexibility to build their own architecture gradually. It is useful for variable workloads, projects with multiple environments, and organisations with specialists capable of administering operating systems and applications. If the company lacks this internal expertise, it should determine in advance which tasks are included in the provider’s managed service.

PaaS – Platform as a Service

PaaS is a platform delivered as a service. The provider supplies a managed environment for developing, testing, and deploying applications. Users work with application code, configuration, and data without managing physical servers or most of the underlying system software.

PaaS may include runtime environments, databases, deployment tools, logging, monitoring, and integrations. The exact components depend on the platform. Google App Engine and Azure App Service are well-known examples, although their functions and limitations are not identical. The advantage of this model is a reduction in operational work, while the trade-off is less control and potential dependence on provider-specific interfaces.

Who is PaaS suitable for?

PaaS is suitable for teams that want to release web services, APIs, and internal applications more quickly and do not intend to manage the underlying infrastructure themselves. Before selecting a platform, companies should check the supported programming languages, runtime versions, databases, scaling methods, data export capabilities, observability tools, platform limits, and the process for migrating to another environment.

SaaS – Software as a Service

SaaS is ready-to-use software accessed through a browser or client application. The provider manages the software and infrastructure, while the customer configures user accounts, access permissions, usage settings, and the handling of its own data. SaaS includes email services, video conferencing tools, CRM systems, collaboration platforms, and other finished software products.

Gmail, Zoom, and Salesforce are examples of SaaS, but the claim that such solutions never require installation is inaccurate. Some services also provide desktop or mobile clients. The defining feature is not the absence of a locally installed application, but the fact that the core software service is operated by the provider and delivered to users over a network.

Who is SaaS suitable for?

SaaS is suitable for companies that need a ready-made tool without developing and maintaining their own system. The evaluation should consider functionality, licensing model, access management, integrations, export options, data retention periods, and the procedure for deleting or retrieving information after the contract ends.

Public, private, and hybrid cloud

The service model describes what the user receives, while the deployment model describes how the environment is organised. In a public cloud, the provider’s infrastructure serves multiple customers whose resources are logically separated. It provides rapid access to capacity and convenient scaling, but requirements related to isolation, performance, and compliance must be evaluated for the specific service.

A private cloud is intended for a single organisation. It can provide deeper control over architecture, segmentation, and policies, but it does not become secure simply because it is described as private. Its security depends on configuration, updates, access controls, logging, backup, and operational processes. For organisations that require a dedicated environment, HostPark offers a VMware private cloud.

A hybrid model combines on-premises or dedicated infrastructure with a public or private cloud. It allows sensitive or technically complex systems to remain in a controlled environment while cloud resources are used for other workloads. At the same time, a hybrid architecture requires carefully designed network connections, unified access management, monitoring, and consistent security policies. Companies that need a private connection between corporate infrastructure and external cloud platforms can consider Cloud Connect.

Advantages of using cloud services

The cloud can improve infrastructure manageability and reduce the time required to obtain resources. The actual effect depends on whether the selected model matches the workload and whether cost control, security, and recovery processes have been properly organised. The main potential benefits are as follows:

1. Rapid resource provisioning. Virtual machines, storage, and network components can usually be deployed more quickly than physical equipment can be purchased and installed. The actual time depends on internal approvals, configuration, and security requirements.
2. Scalability. A company can increase or decrease available capacity. Automatic resource adjustment requires support from the platform and an application designed for this type of scaling.
3. A shift from some capital expenditure to operating expenditure. Instead of purchasing servers, the business pays for a service. This can simplify the initial launch, but it does not guarantee a lower total cost throughout the entire lifecycle.
4. Access to managed technologies. The provider assumes a contractually defined level of responsibility for maintaining the physical infrastructure, platform, or software. The scope of this responsibility changes from IaaS to SaaS.
5. Geographical flexibility. Cloud resources can be deployed closer to users or at a separate site to improve resilience. The chosen region should be aligned with latency, jurisdiction, and data transfer requirements.
6. Support for business continuity. The cloud can simplify the creation of backup environments, replication, and recovery automation. However, these mechanisms must be designed, purchased, configured, and tested separately.

The primary value of the cloud therefore lies not in universal cost savings but in access to a flexible service model. The financial benefit appears when allocated resources match actual requirements, unused capacity is switched off promptly, and management processes do not create hidden expenditure.

Disadvantages and risks of using cloud services

The cloud model changes the risk profile but does not eliminate risk. Dependence on network connectivity remains critical. A failure affecting an internet connection, DNS, VPN, or routing can make a service unavailable even when the cloud platform itself continues to operate. Critical systems require redundant connections, alternative access routes, and tested incident response procedures.

Costs can rise because of overprovisioned resources, permanently active testing environments, unattached disks, backups with unnecessarily long retention periods, outbound traffic, or incorrectly configured automatic scaling. This has made FinOps an important practice for collaborative management of technology value and expenditure by engineering, finance, and business teams. Its core principles are described in the FinOps Framework.

Another risk is vendor lock-in, which refers to technical and economic dependence on a particular provider. The more extensively a system uses unique managed services, APIs, and data formats, the more difficult migration may become. This does not mean that organisations should avoid these capabilities, but the cost of exit, data export options, compatibility, and migration plan should be evaluated before implementation.

Performance and latency must also be considered. A cloud resource is not always faster than a local system. The result depends on processor type, storage, network design, neighbouring workloads, application architecture, and the distance between the platform and its users. Requirements should be expressed through measurable indicators and validated through load testing.

Cloud security and shared responsibility

In the original version of the article, data protection was effectively presented as the provider’s responsibility. This is incomplete. The cloud uses a shared responsibility model: the provider protects defined components of the platform, while the customer is responsible for its own configuration, access controls, data, and applications. The boundary depends on the service model. An official explanation is available in Microsoft’s documentation on shared responsibility.

With IaaS, the customer usually has the largest number of responsibilities. These may include operating system updates, closing unnecessary ports, configuring firewalls, managing keys, enabling multi-factor authentication, protecting applications, logging, and backup. With PaaS, the provider manages a larger portion of the platform, but secure code, secrets, permissions, and data remain the customer’s responsibility. With SaaS, the customer must still manage accounts, roles, integrations, and the information lifecycle correctly.

Before migrating data, an organisation should classify it and define permitted storage locations, encryption requirements, and retention periods. It should also establish who has administrative access, how events are logged, how permissions are revoked when employees leave, and how the customer can retrieve or delete its data after the relationship with the provider ends.

Backup and disaster recovery

Backup and disaster recovery address related but different requirements. Backup creates recovery points from which files, databases, or systems can be restored. Disaster recovery determines where and in what sequence critical services will operate after the primary environment fails, including how networks, access controls, and integrations will be restored.

RPO and RTO are used for recovery planning. RPO defines the maximum acceptable data loss expressed as a period of time, while RTO defines the acceptable time required to restore a service. The same values cannot be applied to every system. They should be determined according to the business impact of downtime, technical dependencies, and available budget.

Cloud backups should be sufficiently isolated from the primary environment so that one compromised account or incorrect operation cannot destroy both production data and backups. To store backup copies at a separate site, HostPark offers BaaS – Backup as a Service. If a business requires not only backup but also a prepared infrastructure recovery scenario, it should separately evaluate the principles of DRaaS, RTO, and RPO.

The existence of a backup does not prove that recovery is possible. Regular tests are required to verify data integrity, access, dependencies, actual recovery time, and compliance with the expected RPO. Test results should be documented, and the policy should be reviewed after significant architectural changes.

How cloud services transform business processes and expenditure

The cloud reduces the time between an infrastructure request and the actual delivery of resources. Developers can create standardised environments, automate deployment, and test changes more quickly. Teams in different locations receive controlled access to shared systems, while the business can launch new projects without purchasing equipment in advance for the maximum forecast workload.

The financial model shifts from large one-time investments towards regular operating expenses. This provides greater flexibility but requires discipline. Companies should allocate expenditure by project and department, use tags, set budgets and alerts, investigate anomalies, switch off unnecessary environments, and review configurations periodically.

Moving every system to the cloud is not always economically justified. A stable workload with a predictable resource profile may sometimes be more cost-effective on dedicated or company-owned equipment. Seasonal projects, testing environments, and products with uncertain demand often benefit more from cloud elasticity. Decisions should be based on total cost of ownership rather than only the monthly price of processor capacity and memory.

Current HostPark cloud solutions for businesses

As of 10 September 2026, the HostPark website presents Atman Cloud public cloud, VMware private cloud, Cloud Connect, Object Storage, Veeam Backup, BaaS, and DRaaS. These products are not interchangeable. Each addresses a different part of an infrastructure requirement, while the final architecture is developed according to workload, isolation, connectivity, storage, and recovery requirements.

Atman Cloud public cloud

Atman Cloud is a public cloud platform based on the OpenStack technology ecosystem. The current service page presents both monthly payment and PAYG models, with PAYG charging for consumed resources. The platform can be used as an independent environment or as an addition to colocation and dedicated servers. The final configuration, availability of individual functions, and financial terms should be verified in the commercial proposal.

VMware private cloud

A private cloud is suitable for organisations that need a dedicated environment with flexible allocation of virtual resources and greater control over infrastructure. The decision should be based on requirements for isolation, compatibility, licensing, performance, and administration. Comparing private and public cloud only by price is incorrect because they may be intended to solve different problems.

Object Storage, BaaS, and DRaaS

Object Storage is designed to store data as objects and may be useful for archives, media files, backups, and other workloads compatible with this model. BaaS helps organise backup at an external site. DRaaS covers the restoration of critical infrastructure following a serious incident. The choice between these services should not be treated as purely formal: businesses often require a combination of storage, backup, and a disaster recovery plan.

How to select and implement a cloud service

The process should begin with an inventory of systems and business requirements rather than the immediate migration of every server. A structured approach helps identify incompatibilities, estimate the budget correctly, and retain control over data. A practical implementation process may include the following stages:

1. Inventory systems and dependencies. Document servers, applications, databases, integrations, data volumes, peak workloads, licences, and responsible personnel.
2. Classify data and workloads. Determine criticality, confidentiality requirements, permitted deployment regions, retention periods, RTO, and RPO.
3. Select the appropriate model. Compare IaaS, PaaS, and SaaS, as well as public, private, and hybrid deployment. Different systems may require different solutions.
4. Evaluate the provider and contract. Examine the SLA, technical support, incident procedures, allocation of responsibilities, redundancy, data export and deletion processes, jurisdiction, and rules for changing prices.
5. Calculate the full cost. Include computing resources, disks, snapshots, backup, traffic, IP addresses, licences, support, migration, and the internal work of the company’s team.
6. Design security controls. Configure least-privilege access, MFA, network segmentation, encryption, secret management, logging, monitoring, and incident response.
7. Run a pilot and perform testing. Begin with a controlled workload and verify performance, integrations, fault tolerance, backup, recovery, and cost predictability.
8. Migrate in stages. Prepare migration and rollback plans, checkpoints, a maintenance window, responsible personnel, and criteria for successful completion.
9. Manage the environment after launch. Review permissions, configurations, expenditure, unused resources, event logs, recovery test results, and SLA compliance on an ongoing basis.

This approach reduces the risk of a technically successful migration creating unpredictable costs, security weaknesses, or dependence on components that are difficult to maintain. For critical systems, the solution should be supported by a technical design and agreed metrics rather than general promises of availability.

Conclusion

Cloud services give businesses flexible access to infrastructure, platforms, and software, but their value depends on choosing the right model and applying disciplined management. IaaS provides the greatest level of control while placing a significant share of administration on the customer. PaaS simplifies development but increases dependence on the capabilities of the platform. SaaS provides rapid access to a ready-made tool, although access management, data governance, and integrations remain important.

When moving to the cloud, organisations should evaluate not only the initial price but also total cost, security, SLA terms, data location, portability, RTO, RPO, and recovery procedures. Backup, disaster recovery, and automatic scaling do not appear automatically. They must be designed, configured, and tested.

To select a public, private, or hybrid cloud architecture without unnecessary resources or overlooked risks, provide HostPark specialists with a description of the current systems, workloads, availability requirements, and recovery objectives. These details can be used to prepare a justified configuration and a phased migration plan.