In another instance, Oracle dictates that it is taking responsibility for cloud security, including system hardening, Scavo said. "But it then turns around and grants itself an exception to its service level agreement in the event of 'a hacker or virus attack.'" The vendor is also more than capable of thwarting a denial-of-service attack, and therefore such attacks should not be grounds for Oracle to fall short of its availability promise, Scavo added.
Scavo also took issue with Oracle's apparent reluctance to allow customers to perform independent monitoring of its cloud services. "Exceptions to this are the Oracle Database Cloud Service and Oracle Java Cloud Service or if otherwise expressly permitted in the ordering document," the policy sheet states.
"Oracle's stated reason here is to ensure that any such monitoring tools do not adversely impact the cloud services," he said. "However, it would seem to also preclude a low-impact automated script running in the customer's own data center to merely ping the cloud system, say, once a minute, to ensure that the system is available and to notify the customer if it is down. This [policy] seems to me to go beyond what is necessary." Customers should push for the right to independent monitoring during contract talks, Scavo added.
Another eye-opener for Scavo was the fact that Oracle reserves the right to perform "major changes" to its cloud infrastructure up to twice a year. "Each such change event is considered planned maintenance and may cause the Cloud Services to be unavailable for up to 24 hours," the document states. Customers with the most stringent high-availability needs should take special heed of this clause, Scavo said.
Customers would be wise to make sure they get in writing that Oracle will suffer some agreed-upon penalty for falling short of its service availability pledge, according to Scavo.
Many early adopters of Oracle's Fusion Applications are going with the cloud deployment option, at least in part because of the complexity involved with installing them on-premises.
Oracle is taking a careful approach to selling Fusion, telling customers now running its E-Business Suite, JD Edwards and PeopleSoft applications that they can adopt the new software at their own pace.
But given the monumental effort Oracle put into developing Fusion Applications, it seems apparent that over time, it hopes to move the bulk of its installed base over to them. Thus, the way Oracle defines its cloud services policies could get even closer scrutiny over time.
An Oracle spokeswoman declined to comment for this story.