Cloud or local monitoring: how to choose, and why you do not have to choose once and for all
This is not a choice between secure and insecure. It is a choice about which risks you want to manage yourself and which you would rather delegate to a provider. Both routes are legitimate, and EnviSensor lets you run them side by side.
EnviSensor Team
In short
- The cloud gives you remote access, multi-site visibility and push notifications without maintaining your own server, backups and updates.
- Local operation keeps data inside your network, avoids subscriptions and works without internet — at the cost of owning backups and maintenance yourself.
- Cloud security is not a matter of faith but of verifiable properties: encryption in transit, access control, a known server location, a processing agreement and accountability. The GDPR requires measures appropriate to the risk (Article 32), a contract with the processor (Article 28) and regulates transfers outside the EEA (Chapter V).
- Provider maturity is evidenced by a valid ISO/IEC 27001 certificate covering the service; ENISA is developing the candidate EUCS cloud certification scheme, which is not yet operational.
- You need not decide permanently: the same device can answer locally and send data to the cloud at the same time.
Table of contents
Three operating modes, one decision
EnviSensor is a flexible monitoring platform, not a cloud service with a sensor attached. The way it runs is your decision, and you can change it without replacing hardware.
| Mode | Where data lives | Typical reason to choose it |
|---|---|---|
| Locally on the LAN | In the device and in whatever polls it | Data must not leave the network, or there is no permanent link |
| On-premise with your own system | On a server in your infrastructure | Monitoring should feed an existing supervision platform |
| CE MonitorApp cloud | With the provider, reachable via browser and app | Remote access, many sites, no infrastructure of your own |
It is worth stating plainly: none of these modes is inherently more secure in every situation — under a specific threat model one option can be clearly better. Each moves the burden of responsibility somewhere else. The rest of this article breaks that down.
What the cloud genuinely delivers
The cloud solves problems that a local deployment leaves you to solve yourself — and that, rather than any marketing claim, is its real value.
- Remote access without exposing your network. Viewing measurements from outside does not require publishing the device to the internet or configuring VPN for every user.
- Many sites in one place. Across a dozen facilities this is the difference between one dashboard and a dozen IP addresses to remember.
- Push notifications and mobile access. Alerts reach a phone without your own mail server or SMS gateway.
- Backups and availability handled by the provider. No need to design retention or check whether last night backup actually ran — confirm backup parameters and guaranteed availability in the terms of service.
- Security updates. Application-layer vulnerabilities are patched by the provider rather than by your team when time allows.
- Low entry cost. No server and no administrator hours to deploy. The Free tier is permanent but limited (2 devices or 6 sensors, 60 days of history); larger deployments require a subscription.
That last point is routinely underrated, and it matters: a local system nobody updates, whose backups nobody verifies, is not safer than the cloud — it is simply risk transferred onto you.
Is the cloud secure? Yes — when specific conditions are met
Cloud security is not about trust but about verifiable properties, and European law states them directly. Article 32 GDPR requires technical and organisational measures appropriate to the risk, naming among others the encryption of data and the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems, together with the ability to restore availability and access to data in a timely manner after an incident. The contract with the processor is governed separately by Article 28, and transfers outside the EEA by Chapter V of the GDPR.
In practice this turns into a set of questions worth asking any provider — including us:
- Is the transmission encrypted? The reference point is TLS 1.3, currently defined in RFC 9846; properly configured TLS 1.2 is often retained for compatibility. Check the user-to-application and device-to-cloud channels separately.
- Where are the servers physically located? Hosting inside the EU/EEA simplifies transfer questions. Ask also about sub-processors and whether every service tier uses the same location.
- Who can access the data, and is it accountable? User roles, authentication and an event log.
- Is there a data processing agreement? Required wherever personal data appears in the system.
- How do retention and export work? Whether you can download the full history in an open format if you change provider.
- How does the provider evidence process maturity? ISO/IEC 27001 describes an information security management system — ask for a valid certificate and check that its scope covers the service. ENISA is developing the candidate EUCS cloud certification scheme; it is not yet an operational certification programme.
When the answers are concrete and backed by documents — a contract, certificates, test results — the cloud can be a secure choice, often more secure than a server under a desk that one person remembers. The NIS 2 Directive adds context by raising supply-chain risk management requirements — but its scope depends on the type and size of the organisation, so confirm with the provider whether and how it is covered.
What else the cloud side can offer
CE MonitorApp offers an optional SecurityHUB module with additional data encryption — just ask us about the configuration details and the scope of protection for your deployment. It is also worth remembering that using the cloud need not be exclusive — measurements logged locally in parallel remain yours regardless of what happens to the service.
What local operation genuinely delivers
Local mode answers different needs, and in several situations nothing replaces it.
- Data never leaves your network. Sometimes a security policy, a customer contract or the nature of the site requires exactly that.
- It works without internet. Plant rooms, warehouses and basements are often out of reach — a device on the LAN keeps running.
- No subscription. A one-off cost rather than a recurring one, which simplifies multi-year budgeting.
- Integration with what you already run. A readout over SNMP or JSON and XML puts temperature on the same dashboard as the rest of the infrastructure.
- Full control of retention. You decide how long data is kept and where the copies live — provided your own system actually records the history, since the device itself mainly exposes current readings.
SNMP is a convenient entry point here, because practically every infrastructure supervision platform speaks it. The device exposes values under object identifiers, and the system polls them at a set interval, handling thresholds, history and alerting exactly as it does for switches or servers. One good-practice note: as with any device using SNMP v1/v2c, traffic is not encrypted at the protocol level — keep SNMP on a trusted, segmented LAN, use a unique read-only community string and access lists, and use a secure tunnel wherever encryption is required.
The drawbacks of both — stated plainly
An honest comparison has to name the cost of each decision as well.
| Cloud | Local / on-premise | |
|---|---|---|
| Dependency | On the provider and on the internet link | On your own team and its availability |
| Cost | Recurring, subscription based | One-off hardware plus hidden maintenance effort |
| Backups | Handled by the provider | You must design and test them yourself |
| Security updates | Handled by the provider | Your team, and in practice often deferred |
| Remote access | Built in | Requires VPN or publishing the service |
| Formalities | Processing agreement, provider assessment | GDPR duties, access policy, backups and retention stay on your side |
| Continuity risk | Service discontinued or terms changed | Server failure, administrator leaves |
Note the last row. Both scenarios are real; they differ in who has to anticipate them. In the cloud the safeguard is the ability to export data; locally it is a tested restore procedure.
How to choose: four typical situations
- One site, an IT team on the premises, sensitive data. Local operation, or on-premise with your own supervision platform.
- A dozen locations without local IT at each. Cloud — otherwise nobody will open a dozen separate devices.
- A multi-year retention obligation. Either mode, provided history can be exported in an open format.
- A site without a permanent link. Local, with e-mail alerts sent directly from the device to a mail server reachable on the local network.
Most often the best answer is "both at once"
In practice the split between cloud and local is artificial, because the same device can run in both modes simultaneously. A local supervision system polls it over SNMP while the data also reaches CE MonitorApp for people who need access from outside the network.
That arrangement has three advantages. First, you get two partially independent observation and alerting channels — a failure of one need not mean silence, though both share the sensor, the logger and the power supply, so full redundancy requires independent hardware and periodic alarm tests. Second, the data stays with you regardless of what happens to the service. Third, the decision is not final: the cloud can be switched off or on later, without replacing hardware or rebuilding the installation.
CE MonitorApp Free access is included with every EnviSensor logger indefinitely, so enabling the cloud is not a new purchasing decision — it is simply there when it turns out to be useful.
Frequently asked questions
Is cloud monitoring secure?
Yes, when it meets verifiable conditions: encryption in transit, access control and accountability, a known server location, a data processing agreement and the ability to export data. The GDPR requires measures appropriate to the risk (Article 32) and a contract with the processor (Article 28). Provider process maturity is evidenced by a valid ISO/IEC 27001 certificate covering the service; ENISA is developing the candidate EUCS cloud certification scheme, which is not yet operational.
Cloud or local monitoring — which is better?
Neither is better in the abstract. The cloud wins with many sites, no in-house IT team and a need for remote access. Local operation wins when data must not leave the network, there is no permanent link, or monitoring should feed an existing supervision system.
Can I use the cloud and local monitoring at the same time?
Yes. The same device can answer a local supervision system over SNMP or a JSON and XML readout while also sending data to the CE MonitorApp cloud. This gives two partially independent alerting channels and keeps a copy of the data in your own infrastructure.
Does monitoring work without internet access?
Yes. The logger serves data on the local network through its built-in web page, SNMP and a JSON or XML readout, and can send alerts by e-mail directly, provided a mail server is reachable on the local network.
What about GDPR when using the cloud?
Where personal data appears in the system, a data processing agreement with the provider is required (Article 28 GDPR), and the security measures applied must match the risk (Article 32 GDPR). It is worth establishing server location as well as retention and export rules.
Is the choice of operating mode permanent?
No. The cloud can be enabled or disabled without replacing hardware or rebuilding the installation. CE MonitorApp Free access is included with every EnviSensor logger indefinitely.
Sources
- Regulation (EU) 2016/679 (GDPR) — Article 32 „Security of processing”
- Directive (EU) 2022/2555 (NIS 2) on a high common level of cybersecurity
- ENISA — EUCS, candidate European Cybersecurity Certification Scheme for Cloud Services (in development)
- ISO/IEC 27001:2022 — information security management systems
- RFC 9846 — The Transport Layer Security (TLS) Protocol Version 1.3, IETF
- RFC 1157 — A Simple Network Management Protocol (SNMP), IETF
- RFC 3414 — User-based Security Model (USM) for SNMPv3, IETF
Need monitoring at your site?
We will help you choose sensors and the way they run — locally on your LAN, in your own monitoring system or in the CE MonitorApp cloud.