It is the question that comes up most often in the final stage of any energy platform evaluation, and the one that is usually answered worst — because it is answered out of habit (‘we run everything in the cloud’ or ‘nothing leaves our premises’) rather than on the basis of criteria. With IT/OT convergence now the main challenge in industrial cybersecurity, the average cost of an incident in the sector at five million (in Spanish) and NIS2 inspections under way, where your company’s energy data lives is no longer a procurement detail but a security, compliance and business decision. This guide provides the method — not the answer, because the right answer depends on your case.
The three options, myth-free
Public cloud (the platform hosted on the vendor’s infrastructure, in European data centres). What you get: immediate deployment, scaling without capital investment, continuous updates, and a level of physical and operational security that a medium-sized company rarely matches on its own. What it demands: contractual trust in the vendor — data jurisdiction, encryption, access, incident notification — and outbound connectivity from the plant.
Your private cloud (the platform deployed in the cloud environment your company already contracts and governs — your tenant, your policies, your IT team in charge). What you get: the governance and compliance control of the previous option without giving up elasticity. What it demands: an IT team capable of operating that environment and a vendor whose platform can be deployed there — not all of them can.
Your own servers (on-premises). What you get: the data never leaves your perimeter, no dependence on external connectivity for plant operations, and the simplest answer to sovereignty audits or critical-infrastructure requirements. What it demands: hardware, maintenance, backups, patching and continuity, all your responsibility — and the honesty to admit that a well-run in-house server room is more expensive and more demanding than it looks.
The myth to debunk is that one of the three is ‘the secure one’. Security is not about location: it is about management. An unpatched on-premises system is more vulnerable than a well-run cloud; a cloud without access control is more vulnerable than a well-locked-down in-house server.
The five deciding criteria
- Data classification. What is on the platform? Load profiles and costs are one thing; if it also integrates process data from SCADA, recipes or production parameters, sensitivity rises and the decision leans towards keeping control in-house.
- The regulatory framework that applies to you. If your company is an essential or important entity under NIS2, critical infrastructure, public administration or in the defence sector, sovereignty and continuity requirements usually decide the answer for you. If not, you have more leeway.
- Your IT team’s real capacity. On-premises and private cloud mean running infrastructure; public cloud means governing a contract. The option your team can sustain in year three is better than the one that is perfect on paper.
- Plant connectivity. If your sites have poor connectivity or policies that isolate the OT network, the architecture needs local (edge) components regardless of where the central platform lives.
- Growth horizon. One plant today, five sites in three years, gas and thermal integration further down the line: the option you choose must be able to scale and, if it comes to it, migrate without redoing the project.
Questions to ask the vendor
Whichever way you lean, four questions separate the vendors you can build with from those you can’t:
- Can the same platform be deployed in all three modes? If it only exists in one, you are not choosing: the choice is being made for you.
- What contractual guarantees does it give on jurisdiction, encryption, access and incident notification? — the four questions that we already raised in June (in Spanish) are still the test.
- How does it integrate the OT network without exposing it? On-site gateways, encrypted outbound communication, segmentation.
- What happens if I want to change deployment mode in two years’ time? The answer says more about the vendor than any brochure.
The PowerCloud view
PowerCloud’s position is the one the method above calls for: the same platform, deployable wherever your security requirements demand — in a European public cloud, in your private cloud or on your own servers — with plant integration solved in any of the three cases. Companies that start in the cloud and grow into their own private cloud as their IT team matures; organisations with sovereignty requirements that start on-premises and add sites without changing tools. The whole organisation’s energy data in a single view — hosted wherever it needs to be. We grow with you, not the other way round.
Are you clear on where your company’s energy data should live — and whether your current platform could move if it needed to? We help you work through the five criteria for your specific case: the data you handle, regulatory framework, IT capacity, plant connectivity and growth horizon. You come away with a reasoned recommendation, not a preference. Diagnostic session: 30 minutes, no obligation.
Sources: CyberSecurity News and S2 Grupo (IT/OT convergence and security in IIoT/edge environments); enerTIC (Smart Energy Congress 2026 agenda: OT cybersecurity, data governance); NIS2 framework (INCIBE, Spain’s National Cybersecurity Institute); previous posts in this series at powercloud.es/noticias/.
