"There is no cloud. It's just someone else's computer."
(Unknown)

Key points and recommendations

1. There is no general statement to the effect that “this or that cloud application” may be used at the UOL. The ICBM’s IT department is not responsible in this regard, but does offer advice.
2. In this sense, modern AI applications should be regarded as cloud applications. The points listed below therefore also apply to chatbots such as ChatGPT, Claude, etc.
3. Where possible, we should use internal resources at the University of Oldenburg (e.g. https://cloud.uni-oldenburg.de).
4. If the University does not offer a particular resource, the Academic Cloud (https://academiccloud.de) is a good alternative. AI services, for example, are also available there (https://chat-ai.academiccloud.de).

General

‘Cloud applications’ are now an integral part of everyday life in many areas, for example as useful apps in our personal lives, as collaborative project platforms spanning organisational boundaries, or as scalable infrastructure available at short notice in the day-to-day operations of education, business and administration.

They enable simple, effective and efficient collaboration, provide fast and flexible solutions, and support mobile working.

Countless cloud services are now available both as so-called ‘public cloud’ solutions and as so-called ‘private cloud’ solutions across a wide variety of business models.

One of the most important cloud applications today is generative AI. This primarily refers to chatbots such as ChatGPT, Claude, Gemini and others. However, it also refers to applications that implicitly access services from OpenAI, Anthropic and other providers (e.g. agent-based AI).

It must not be forgotten, however, that ‘the cloud’ is an abstract term which ultimately simply means that the data and information it contains are processed in a Data Centre somewhere in the world by an operator. The issue of access and ownership is therefore very important when it comes to cloud applications.

Cloud applications are divided into various categories and fields of application, for example:

We distinguish between different types of cloud services:

There are a few others (‘FaaS’). These are considered too specialised to be listed here. The various categories (SaaS, PaaS, IaaS, etc.) are not decisive when assessing whether external cloud storage or processing is permissible. The data categories determine the assessment; see below.

Data

The question ‘am I allowed to use a cloud application or not?’ generally does not go far enough. The type of data to be processed must also be taken into account. The question must therefore be ‘am I allowed to use this or that cloud application for this or that type of data?’. We broadly distinguish between four different categories:

Risks and countermeasures

The risks to the ICBM can be broadly divided into three overlapping categories:

Before using external cloud services, the relevant applicant must, in consultation with the responsible data controllers, carry out a preliminary assessment comprising a cost-benefit analysis and a risk assessment. This assessment includes a comparison with internal cloud services.

Users are advised to carry out tests of external cloud services using test data.

External cloud services should only be considered if a preliminary assessment initiated by the relevant applicant concludes that no suitable solution exists within ICBM/UOL, or that no such solution can be implemented that meets the relevant functional and non-non-functional requirements or the relevant contractual, legal, financial or time-related specifications. The use of external cloud services must not contravene statutory and contractual requirements, the ICBM/UOL IT Framework Policy or the ICBM/UOL IT Security Regulations, as amended from time to time.

Various countermeasures should be taken to mitigate the above-mentioned risks:

IMPORTANT: The decision on the use of cloud services must be made by the data controller. This means that the data controller also bears the corresponding responsibility for their use. The ICBM IT department will be happy to advise.