In many companies the ERP or accounting system, whether SAP Business One, Sage, Business Central or another package, still runs on a server in the corner of the office or, even more often, on the chief accountant’s computer, which everyone else connects to. It works until it stops working. The problems start when people need to work from home, when the computer breaks on month-end closing day, or when the auditor asks where the backups are and who has tested them.
Moving to the cloud solves these problems, but only if it is done thoughtfully. Accounting is not a website: it holds the company’s finances, employee data and customer contracts. A badly chosen provider or undefined responsibilities mean the problems simply move elsewhere, along with less control.
Below are seven questions we recommend asking every provider that offers to host your ERP or accounting system in the cloud. It is worth getting the answers in writing.
1. Where is my accounting data physically stored?
The first and most important question. “In the cloud” is not an answer: the cloud is someone’s server in a specific building in a specific country. You need to know the country, the data centre operator and whether the data can be moved to another country without your consent.
For accounting data this matters for several reasons: accounting and tax laws in most countries require that records remain available to the tax authority for years, GDPR restricts the transfer of personal data outside the EU, and companies in certain sectors (finance, energy, health) face additional requirements under DORA and NIS2.
In our ERP hosting, the primary data is stored in a data centre in Lithuania (EU). That means low latency for your accountants and a clear answer for your auditor.
2. How are backups made and where are they kept?
The second question has three parts: how often, how long they are kept and where. A correct answer involves more than one location. A copy on the same server is not a backup. A copy in the same data centre protects against a server failure, but not against a fire or a long power outage.
In our ERP hosting, backups are made daily and stored in two places: our data centre in Lithuania and an Amazon (AWS) data centre in Germany. The second copy is in another country but still in the European Union, so under GDPR it is not a transfer to a third country. Also ask whether backups are protected from deletion from the server itself: ransomware first tries to destroy the backups and only then encrypts the data.
And one more: when did the provider last actually restore your ERP database from a backup? If the answer is unclear, backup testing should be written into the contract.
3. How is access to the system protected?
Once accounting is in the cloud, it can be reached from anywhere. That is convenience and risk at the same time. A password alone, however complex, is not enough: passwords are leaked, guessed and phished.
The minimum standard we require ourselves: a VPN tunnel to the server and two-factor authentication (2FA) for every login. In our ERP hosting both are included at no extra charge, not as an add-on service. Also check whether logins are recorded, whether a departed employee’s access can be disabled within a minute, and, in the case of an accounting firm, whether clients’ data can be separated from one another.
4. Who updates the ERP and the server underneath it?
ERP vendors release updates regularly, some of them tied to tax and reporting form changes that cannot be skipped. Someone has to be responsible for installing them: the provider, your ERP reseller or you. This must be written down clearly.
A separate question is the server the ERP runs on. Operating system security updates, database maintenance and protection against malware are part of a managed server. Our servers run Bitdefender GravityZone, managed centrally, and updates are installed outside working hours after taking a snapshot. If something goes wrong, we return to the previous state within minutes.
Ask for a responsibility table in which every activity is assigned to one side. We described what it looks like in our article on managed servers.
5. What is the service level and what happens when something breaks?
For accounting, downtime has a clear cost: invoices not issued, payments not made, tax returns filed late. The SLA should answer three questions: how quickly the provider starts to respond, how quickly the service is restored, and how much data can be lost in the worst case.
Separate response time from resolution time, and check whether the SLA applies at month-end and before filing deadlines, when accounting is needed most. Our helpdesk responds from 30 minutes, and we publish the full service level description so that you can compare before you talk to us.
6. How will the migration go and will there be downtime?
A well-planned ERP migration happens without losing a working day. A typical process in our practice:
- Audit of the existing system: version, database size, integrations (banks, e-invoicing, warehouse equipment, point-of-sale terminals), number of users.
- Preparing the cloud server and moving a full copy. Users work as usual in the meantime.
- Trial logins from several workstations, and checking integrations in a test environment.
- Final switchover in the evening or at the weekend: only the difference since the first copy is transferred, which takes hours, not days.
- The first working day with an engineer on standby.
Ask the provider how many migrations they have done, how they will handle the integrations and what they will do if a problem appears after the switchover. The right answer to the last question is “we go back to the old server, which stays untouched for at least another month”.
7. How do I go back or move to another provider?
A question that is rarely asked, but which separates a reliable provider from a trap. Your accounting data is yours. You must be able to get the full ERP database and a server image at any time, in a format that can be run elsewhere, within a defined time and without an exit fee.
Check the contract for: the deadline for returning data, the format, how long the provider keeps the data after the contract ends and how they confirm its destruction. This is, incidentally, also a requirement of ISO 27001 and DORA: a company must have an exit strategy from every critical service provider.
Compliance requirements for accounting
If your company falls within the scope of DORA (the financial sector and its IT providers) or NIS2 (energy, transport, health, digital infrastructure and other important sectors), the accounting system is a critical system and its provider is a third party that you must assess and document. That means the answers to the seven questions above need to be not in a conversation but in the contract and its annexes.
We work to ISO 27001 requirements and prepare our services so that they can be presented to a DORA or NIS2 audit: with a responsibility matrix, SLA, and documentation of backups and access.
Where to start
- List who connects to your ERP today, from where, and which integrations are running. This will be the basis of the migration.
- Check when someone last restored ERP data from a backup. If you do not remember, do it this week, before the migration.
- Send the seven questions to providers and ask for the answers in writing.
- Schedule the migration away from month-end closing and filing deadlines.
- If you want to see how we answer these questions, start with the ERP hosting description or get in touch, and we will prepare a migration plan based on your current system.
