Private Cloud vs. Public Cloud: What Two Regulated Companies Actually Chose, and Why

Every vendor has a private-vs-public cloud article. Most of them are a list of abstractions: “data commingling”, “noisy neighbors”, “shared security boundaries”. This one is about two companies that have each run on dedicated hardware for more than ten years, what pushed them there, and what they would have given up on a hyperscaler.

Neither chose private cloud for ideological reasons. They chose it because of an audit, a closing data center, and a monthly bill that needed to stop moving.

Sigma Underwriting Managers: the audit decides

Sigma Underwriting Managers is an insurance underwriter in Fort Lauderdale, owned by Brown & Brown, a publicly traded company with its own security policies and its own security team. Fifteen years ago, after two changes of ownership in quick succession, Sigma was failing a regulatory audit. In insurance that is not a paperwork problem; the license was at risk.

The environment was rebuilt on dedicated hardware in a month, and the re-audit passed. That is the origin story, but the reason Sigma is still on private cloud today is what happens every year since.

Sigma gets audited more often, and more deeply, than most companies its size, because corporate IT at a public company asks questions. When the packet arrives, the section about servers, backups and user access is ours. We fill it in from the systems we run: the data center’s SOC 2 Type II report, the backup and replication records, the list of who can log in and when that list was last reviewed. Then we sit down with Sigma’s office manager, go through every answer, and it goes back.

Try to answer “who has access to the physical hardware your policy data sits on?” on a hyperscaler. The honest answer is a link to someone else’s SOC 2 report and a paragraph about shared responsibility. It is accepted, but it is indirect, and every indirect answer is a follow-up question. On single-tenant hardware, the answer is a list of names.

That is the real private-cloud advantage in a regulated business. Not security in the abstract; the audit answers are short.

Armellini Express Lines: the closing data center decides

Armellini Express Lines moves refrigerated freight, flowers and produce, across Florida, Georgia and California. Ten years ago, its third-party host was shutting down and told the company, in effect, to come and collect its hardware. Nobody on staff did virtualization.

Public cloud was an option on paper. In practice it would have meant re-platforming a set of legacy Windows and SQL workloads under a deadline set by someone else’s business failure, and then living with a usage-metered bill for a company whose compute need is flat and whose data flow is anything but small.

What Armellini bought instead was what we call Phoenix in a Box: a block of dedicated compute, run as many workloads inside it as fit, pay one fixed number. The Windows environment and the SQL workloads were copied across as they were. Today that is a four-host cluster with 64 vCPU, 2 TB of memory and 50 TB of production storage, replicated to a second location, connected to nine sites by dual-carrier fiber.

Two things that matter in the private-vs-public decision came out of that:

Egress. A freight company’s dispatch, EDI and document traffic moves between nine terminals all day. On a hyperscaler, that is a per-gigabyte egress line that grows with the business. On private fiber to a data center, it is a port, priced once.

A fixed number. Armellini has doubled in size since the move. The monthly figure is set by the compute block and the term, not by how busy the trucks are. Its finance team can forecast IT for the length of the agreement.

Where public cloud is still the right answer

We would be lying if we said everything belongs on dedicated hardware.

• Workloads that genuinely spike. If your compute need varies by ten times across a day or a season, you will over-provision private hardware to meet the peak. Pay the hyperscaler’s elasticity premium.
• Short-lived projects. A two-year amortization curve on hardware does not suit a six-month project.
• Software that only exists as a managed cloud service. If your application is built on a hyperscaler’s managed database or queue, moving it means rebuilding it.
• Public-facing websites and marketing systems. Nothing regulated, nothing that needs an audit answer.

Both Sigma and Armellini use cloud services where they make sense. The regulated core, the systems whose names appear in an audit packet, sit on hardware they can point to.

The honest decision test

Three questions settle most cases:

1. Does the workload run flat, all day? A Windows domain, a SQL database, an underwriting system, a dispatch app. If yes, you are paying for elasticity you will not use.
2. Will someone ask you to prove where it is and who can touch it? An insurer, an auditor, a regulator, a parent company. If yes, single-tenant hardware makes that a one-sentence answer.
3. Do you need the bill to be the same number next year? If yes, pick the model where usage does not change the invoice.

Three yeses is private cloud. Three noes is a hyperscaler. Anything in between is a hybrid, and worth a conversation rather than an article.

Phoenix runs dedicated hardware for Sigma, Armellini and others inside a SOC 2 Type II data center in Fort Lauderdale. What is inside the monthly number, including the audit paperwork, is on the managed hosting page. If you want the three questions above answered for what you actually run, book a thirty-minute review with a senior engineer.