Cloud Business Software: Benefits, Limits and Questions to Ask

Cloud software means you use the product through a browser, and the vendor runs the servers. For most Nigerian SMEs that's now the default, and for good reasons. It also comes with limits that are rarely mentioned in a sales call. This guide sets out both, then gives you the questions to ask.

What the cloud does well

No server in the back office. You don't buy hardware, run backups to an external drive, or depend on the one person who knows the admin password. The vendor patches and backs up the system.

One version, everywhere. Your accountant in Ikeja, your MD travelling to Abuja and your HR officer working from home all see the same invoice, the same pay run, the same approval queue. Nobody emails "the latest file".

Approvals that don't wait for a desk. An approver can review a ₦2,750,000 voucher on a phone between meetings, and the record shows when they did it.

Updates arrive without a project. When VAT reporting formats or payroll rules change, a well-run vendor updates the product for everyone. On-premise software needs someone to install the change.

Cost you can see. A monthly or yearly subscription replaces a large upfront licence, and you can usually start with one module.

Where it falls short

Connectivity. If the internet is down, so is your access. In practice, most teams handle this with mobile data as a backup, but ask how the product behaves on a slow connection. Pages that load in two seconds on fibre can take twenty on a weak 3G signal.

Your data lives on someone else's servers. That's a trade you're making deliberately, so make it with your eyes open. Who can see it? Where is it stored? What happens if the vendor closes?

Less control over change. The vendor decides when features change. That's usually good, but a button moving during month-end is unwelcome. Ask how changes are announced.

Exit is harder than entry. Signing up takes minutes. Leaving with all your invoices, customers, payroll history and attachments in a usable format can take weeks if nobody planned for it.

Data rules you can't ignore

The Nigeria Data Protection Act 2023 applies to personal data, which covers your employees' records, payslips and bank details, and your customers' contact information. When you use cloud software, the vendor generally processes that data on your behalf, and you remain responsible for choosing a vendor who protects it.

Two points matter most when you assess a cloud vendor:

1. Transfers outside Nigeria. Sections 41 to 43 of the Act restrict transferring personal data out of the country unless the recipient offers adequate protection, or another lawful basis applies, and the Nigeria Data Protection Commission has issued further guidance on how that's assessed. Many cloud products store data abroad, so ask where yours will be and what basis the vendor relies on.
2. Security and breaches. The Act expects appropriate technical and organisational measures, and sets out duties when a breach happens. Ask what the vendor does and how quickly it would tell you.

Commentary on how the cross-border rules apply in practice is still developing, and summaries differ in detail. Treat this section as a prompt for questions, and confirm your own obligations with a data protection adviser.

Questions to ask any vendor

Put these to every vendor in writing, and keep the answers.

A vendor who answers these clearly is usually a vendor who has thought about them. Vague answers on location, exit or breaches are worth more weight than any feature you saw in the demo, because those are the questions that matter on the worst day, not the best one. For the security side in more detail, see our guide to API security basics.

How Flux helps

Flux is cloud software built for Nigerian finance teams: browser-based, naira first, with roles, approvals and an audit log so you can see who did what. Customer documents use signed links that expire, and the integration API uses scoped keys and signed webhooks. Read more about how the product is built on the platform and control page.