Temple University's chief information security officer and the university counsel conducted an extensive review of Google Apps' security -- and reached a different conclusion. "They came back and said their security is as good as or better than ours," says Stahler. Rentokil's Howe came to a similar conclusion. "We believe it has improved our overall security in a significant way," he says.
A related security issue for Jacobs Engineering revolves around where its data is stored. "We have some clients who are sensitive to geographic storage issues -- where is my data, per country," Wright says. Google says it can't guarantee that a given set of data stored by Google Apps will be maintained within the borders of a specific country.
Availability and uptime
With regard to availability and uptime, Google, like other cloud providers, does offer a service level agreement that guarantees "three nines" availability -- in other words, it's up 99.9% of the time. One way Google achieves that is by writing data simultaneously to multiple servers within its data center and synchronously copying that data to a second data center. If the service goes offline, however, Google's liability is limited to refunding part of the subscription fee. Business losses as a result of downtime aren't part of the deal.
Google has had its share of outages in the past year, but that doesn't seem to have dissuaded users of Google Apps for Business so far. Temple's Stahler recalls an outage in September that lasted a couple of hours. Her users noticed the problem right away, but she says her team wasn't under fire because everyone realized that it was Google's problem. "Before, we would have been scrambling and would have had to drop everything," she says. But with Gmail, people simply accepted it. "They realized that Google had thousands of people working on it and that this was unusual."
Wright says downtime hasn't gone unnoticed, but the small amount of it hasn't been a big concern for him. While e-mail is mission-critical, it's doesn't require extremely high availability. "Our environment doesn't demand five nines," he says.
The city of Los Angeles had many privacy concerns as it was considering going with Gmail, says Randi Levin, general manager and chief technology officer. But Google's approach of breaking apart data and encrypting the pieces helps to allay fears of unauthorized access. As to what Google knows about individual users, city assistant general manager Crawford says he's satisfied with Google's controls. "Google doesn't have the right to read the data ever, unless we give them that right by request," he says. In addition, he says, "We can audit to see who's touched our stuff."
Proceed with due diligence