Case study

Introduction1

On a warm summer evening in Northeast Ohio, Albert Michaels, the Chief Technology

Officer (CTO) of local software company eLoanDocs, was enjoying his evening drive

home. Though his eyes were on the road in front of him, his mind was stuck on the topic

of the day behind him: the “cloud.” How could eLoanDocs take advantage of this

emerging and exciting new technology platform? Cloud computing held the promise of

greatly reduced costs and nearly unlimited scalability for a company like his and seemed

like it might be the wave of the future for hosted software providers. But the barriers to

his customers’ adopting the cloud were potentially high. And if those barriers were

overcome, the competitive landscape in which eLoanDocs operated might shift in

unfavorable ways. As a technology professional, adopting the cloud seemed to him to

be a forgone conclusion. But his years of experience had shown him that it’s rarely easy

to be one of the early adopters.

Inefficiencies in the Mortgage Industry

The home mortgage closing process in the early 1990s was slow, paper intensive, and

ripe for innovation. Realtors, mortgage lenders, title companies, and borrowers met and

collaborated in primarily local marketplaces. The myriad documents required to support

the mortgage approval process were exchanged through a combination of fax, mail,

courier, and in-person reviews. Realtors, mortgage brokers, and escrow officers worked

together to ensure that all of the necessary documents were generated, supporting

services such as appraisals were ordered and performed, and required documents were

signed by the borrower. The average time between a consumer application for a

mortgage loan and the final closing was about 90 days. Closings were often delayed or

rescheduled when late-breaking changes in the loan terms or associated costs required

the lender to generate new documents. The majority of documents required for the

mortgage closing were generated by the mortgage lender, but these documents were

traditionally reviewed and signed by the borrower at the place of settlement (closing),

generally at the title company. Mortgage lenders sent documents to the title company

and to the borrower through mail, overnight express delivery, or courier. A successful

closing required that the mortgage lender generate final documents and send them to

the title company at least one day before the scheduled closing.

Technology to the Rescue

In 1994, a Cleveland-based title and settlement services company, Premium Title, was

determined to reduce their costs and differentiate their service to the market by adding

technology to the mortgage-closing process. Premium Title’s owners created a separate

company, eLoanDocs, to connect the various parties involved in the process by using

technology. eLoanDocs’ founders wanted to improve the speed and accuracy of the

mortgage-closing process while increasing market share for Premium Title and other

connected business partners. The founders believed that they could create a company

that would grow quickly and that would generate significant return for their investors.

In industries where larger companies with dedicated IT staff existed, standard

protocols had been developed to exchange information electronically. For example, in

the automotive industry, Electronic Data Interchange (EDI) had been used for years to

exchange purchasing and billing information between manufacturers and their

suppliers.2 There were no standards for electronic communication between business

partners in the mortgage industry, and since the Internet was not being used broadly for

commercial purposes, intercompany data exchange was dependent on proprietary

communication networks.

eLoanDocs launched a proprietary electronic interchange in 1995 that connected

Premium Title with several mortgage lenders in the Cleveland area along with a few

local service providers such as appraisal vendors and surveyors. Proprietary data

formats were defined for title insurance and appraisal orders, and mortgage documents

were delivered electronically using the common HP Printer Command Language (PCL)

print stream data format. The PCL3 is a page description language (PDL) that allows a

document’s appearance to be described at a high level. This allowed Premium Title,

using equipment commonly available at the time, to define the documents needed in

their industry and share them with the necessary business partners.

eLoanDocs purchased off-the-shelf communications software and customized it to

their needs; they also purchased computer servers, network equipment, and modems to

run their electronic interchange. The computer equipment and telephone lines were

hosted in their modest office space in Cleveland, Ohio. The small network of

participating companies each installed modems, standard communication software, and

eLoanDocs’ proprietary software application to exchange documents that represented

orders for services and the delivered real estate products such as appraisals, flood search

certificates, and surveys. The electronically delivered documents replaced slower,

lower-quality, or less-reliable courier and fax deliveries. eLoanDocs was successful in

building a network of local mortgage service providers but struggled to extend the

technology and business model outside of Northeast Ohio.

Right Technology, Right Place, Right Time

In the late 1990s, eLoanDocs realized that the emergence of the Internet as a driver of

commerce would present both a threat to their network and an opportunity to extend

their mortgage data interchange to more parties across the country at a lower cost. In

2000, eLoanDocs re-launched their mortgage industry electronic collaboration network

on the Internet with the debut of their new software product, Document Posting Service

(DPS). DPS used standard communication protocols such as HTTPS and SFTP over

the Internet, which eliminated the need for modems and proprietary communications

software. DPS also featured HTML web user interfaces for settlement agents to avoid

the need for software to be installed at each customer location. DPS was a multitenant

application (Figure 3.1) that provided software as a service (SaaS) to the mortgage

industry.

SaaS allows customers to use software that is owned, delivered, and managed

remotely by one (or more) providers.4 This model allows the provider to maintain one

set of code and data for many different customers. In essence, SaaS allows customers

to rent software rather than buy it. The advantages of SaaS for customers include cost

savings, scalability, accessibility, upgrades without disruption, and resilience. Some

disadvantages also exist, the primary one being security.5

Market acceptance for DPS was tremendous, with several major mortgage lenders

signing contracts to deliver all of their closing documents to settlement agents using

eLoanDocs. As a small company facing growth challenges brought on in part by a

boom-or-bust mortgage industry, eLoanDocs took a pragmatic approach to new product

development. Product development investments were guided by immediate

opportunities with existing customers that would lead to short-term revenue and

possible broader market appeal. Following this model, eLoanDocs extended their

product line beyond closing-document delivery to include borrower-disclosure delivery

and electronic-signature capability.

Figure 3.1. Multitenant Architecture

Supportive Regulatory Changes

Federal and state legislation in 1999 opened the market for electronic signatures in the

real estate industry, and eLoanDocs developed services to take advantage of this

legislation. The Uniform Electronic Transaction Act (UETA) was first adopted by

California and Pennsylvania in 1999.6 At the time of writing in 2015, 47 of the 50 U.S.

states have adopted this act. The remaining three states (New York, Illinois, and

Washington) have not adopted the act but have statutes pertaining to electronic

transactions. The UETA’s purpose is to bring into line the differing state laws over such

areas as retention of paper records and the validity of electronic signatures to support

the validity of electronic contracts as a viable medium of agreement. The Electronic

Signatures in Global and National Commerce Act (ESIGN) is similar to the UETA with

the exception that it pertains to the validity of electronic signatures on the federal level

instead of the state level.7 It also brings validity to signatures for foreign commerce.

The Changing Business Tides

eLoanDocs’ business was growing fast, but the computers that hosted eLoanDocs’

services were still run out of a small office computer room. On a hot summer day in

late July 2000, Cleveland faced scattered power outages due to heavy draw on the power

grid for air conditioning. Power was lost in eLoanDocs’ office for over eight hours, well

beyond the two-hour battery backup that was in place to support the computer systems.

Dave Griffith, data center manager for eLoanDocs, said, “We tried to find portable

generators for rent but there was nothing available big enough and we couldn’t even get

the generators close enough to our computer room to run extension cords” (personal

communication). eLoanDocs’ electronic services were unavailable to customers for

most of the day. Customers suffered costly business delays due to this extended system

outage on one of the busiest days of the month for mortgage closings.

It was clear that eLoanDocs needed to improve their computer hosting infrastructure

in order to maintain a leadership position as a provider of electronic services to the

mortgage industry. Up until this time, eLoanDocs did not have the necessary financial

strength or the technical management experience to bring their computer infrastructure

up to the needed levels of scalability and reliability. With major new customers ready

to sign contracts and the memory of the 2000 power outage fresh in their minds,

eLoanDocs management raised the needed capital and engaged a technology consulting

firm to prepare for the next level of capability. In early 2001, eLoanDocs moved their

computer servers to a private cage in a dedicated third-party co-location data center in

Chicago, Secure Hosting. The Secure Hosting facility in Chicago featured redundant

power feeds, on-site generators, multiple Internet providers, and state-of-the-art

physical and network security. Secure Hosting quickly became eLoanDocs’ most

important and most expensive vendor.

Security Considerations

By 2004, eLoanDocs was doing business with seven of the top 10 mortgage lenders in

the U.S., and documents and data for over 50% of the mortgages in the country flowed

through eLoanDocs’ systems. eLoanDocs had become a critical part of the mortgage

industry, but with fewer than 50 employees and under $15 million in annual revenue,

the company was hundreds of times smaller than most of its giant financial institution

customers.

Given the sensitive nature of the information that eLoanDocs was handling, the

attention given to cybersecurity breaches at well-known companies (like Apple, JP

Morgan Chase, Target, and the Home Depot), and the consequences of these

breaches,8 many of eLoanDocs’ largest customers began to demand that it demonstrate

the reliability and security of their computer hosting facility through extensive load

testing, system failure testing, and third-party security audits. Some customers sent their

own security teams to the eLoanDocs office in Cleveland and to the Secure Hosting

data center in Chicago to review eLoanDocs’ policies, procedures, and capabilities.

Paul Hunter, eLoanDocs CEO, was excited to show off Secure Hosting to the top

mortgage companies:

The first time the National Mortgage security team visited the Secure Hosting facility

they were thrilled to see the biometric security, diesel generators with 3 days of fuel on-

site, and our private cage that was secured on all sides. eLoanDocs finally looks like

the big player that we are. (personal communication)

By 2007, demands for additional capacity in the network and customer requirements

to maintain an active disaster recovery data center drove eLoanDocs to make several

significant investments. First, eLoanDocs acquired a competing mortgage technology

company based in Seattle, WA, FastForms. eLoanDocs then moved their primary data

center from Secure Hosting in Chicago to FastForms’s co-location provider in Seattle,

SunGuard. Finally, eLoanDocs built an identical redundant hosting facility in Cleveland

using another co-location provider. In late 2009, eLoanDocs completed implementing

a highly scalable and virtualized computer hosting infrastructure in Seattle with real-

time replication of all customer documents and data to the backup site in Cleveland.

The Cleveland facility could automatically take over all of eLoanDocs’ services in the

event of an extended outage in the Seattle data center (Figure 3.2). The time and expense

required to build and maintain their services in secure and redundant data centers gave

eLoanDocs a significant advantage in the market because few technology providers

could make the necessary investments in infrastructure and software required to

compete. In addition, eLoanDocs implemented best practices for disaster recovery (DR)

planning including risk assessment and business impact analysis and training for and

testing of the DR plan.9

With the new infrastructure in place, eLoanDocs met customer service–level

agreements (SLAs) for 99.9% uptime of services in 2011 and 2012. eLoanDocs had

developed a mature set of policies and procedures around information security and had

published results of a third-party SSAE 16 Type II compliance audit twice a year to

customers. The organization had six full-time staff dedicated to data center operations

and a full-time information security officer. Their internal staff had accumulated

significant expertise in data center operations, but the company experienced, on

average, a 20% annual turnover rate due to an active job market for their staff members’

highly sought-after skills. One eLoanDocs employee was recruited to manage networks

for Microsoft’s hosting facilities in Washington. Michelle Fletcher, eLoanDocs’

Director of Technical Operations, complained, “I’m having a hard time keeping my best

people working here at eLoanDocs. We just don’t have enough scale to keep these

people challenged and there is no way that eLoanDocs can match the pay of the big

guys” (personal communication).

Figure 3.2. Existing Infrastructure

eLoanDocs’ annual vendor expenses for data center hosting, data networks, computer

hardware maintenance, and software support subscriptions were nearly USD2 million

per year. Employee costs and third-party audit expenses brought the overall cost of

eLoanDocs’ data center hosting, security, and compliance to about USD3.5 million

annually.

Clouds Ahead?

Just as the rise of the Internet enabled eLoanDocs’ explosive growth in the 2000s,

technological changes beginning in 2010 led to new opportunities and competitive

challenges for the company. Giant technology vendors such as Amazon began to offer

comprehensive computer hosting services with a new model: cloud computing

(see Figure 3.3). Amazon, Microsoft, Google, and other companies built data centers at

massive scale that were designed to allow them to sell computing capacity to the market

at prices significantly below what companies could achieve on their own.10 Cloud

computing vendors offered a model where a company could simply purchase the needed

amount of processing power, memory, disk storage, and Internet bandwidth on a

monthly subscription model. Customers could increase or decrease their usage on

demand. Public cloud providers also offered high availability, multisite data replication,

and full disaster recovery capabilities as optional or standard services.11

Using a cloud hosting service such as Amazon Web Services (AWS), a small

software vendor could launch a new service with twice the computing capacity of

eLoanDocs in a matter of days. Matt Pittman, VP of Sales for eLoanDocs, said,

I can’t compete on price with mortgage technology competitors like EchoSign that

launched their products hosted at Amazon. Their costs are so low that they are giving

away basic services with a freemium model. I just hope that companies like this don’t

start cutting into our core client base. (personal communication)

Services like AWS were examples of the “public cloud”—inexpensive computing

capacity that can be purchased on demand, with many different customers’ workloads

and information intermingled on the same computer servers and storage devices. Cost

advantages available to customers of public cloud services were enhanced by aggressive

competition in the industry, which sparked an ongoing price war between providers.

Amazon reduced its prices a total of 41 times between 2008 and late 2013. CFO Marty

Buckley had calculated that, by switching to a public cloud provider for all of their data

center needs, eLoanDocs’ annual technology costs (including expected staff reductions)

would be $750,000 less than current spending levels.

Figure 3.3. Cloud Infrastructure

Public cloud providers also maintained strict security policies and published third-

party security audit results, but large financial institutions were not ready to trust their

most critical information and systems to the public cloud as of 2013. eLoanDocs’

security officer Randy Wallace had his doubts about the viability of cloud hosting for

eLoanDocs:

I just finished another grueling vendor audit from a giant mortgage lender’s security

team. These guys want visibility into all of our processes and they want to make sure

that eLoanDocs has control over every aspect of our systems. I just don’t know how we

could ever convince them that a cloud service is secure. (personal communication)

Concerns regarding the security of data stored in the cloud continue to be an ongoing

challenge for many IT executives.12

Recognizing the need for more secure and more flexible cloud computing options,

computer hosting vendors such as Rackspace began to offer private cloud solutions to

the market. Rackspace provisioned and supported a set of dedicated hardware to any

customer that wanted to keep its applications and information segregated from other

customers. The private cloud offerings used the same technologies as public cloud

providers and still provided cost advantages due to economies of scale. Buckley had

calculated a USD350,000 annual savings should eLoanDocs move to a private cloud

solution. However, Albert Michaels was concerned about service availability and

uptime with a third-party private cloud solution:

With our services hosted in our data centers I know 100% for certain that my team can

find the source of any problem and fix it within minutes, helping us to meet our

customer SLAs. How do I know that a cloud provider will have the same ability and

motivation to get things back up and running when there’s a problem? (personal

communication)

A third cloud hosting model appeared called hybrid cloud (Figure 3.4). This model

allowed customers to take a measured approach to moving some of their computing to

outsourced cloud providers. With a hybrid cloud offering such as VMware’s vCloud, a

software company could easily host some of its applications and data on its internal

servers while moving its development, test, or disaster recovery systems to the cloud.

Hybrid cloud solutions offered many of the security benefits of internally hosted

systems while also providing scalability on demand. Arlene Christianson, eLoanDocs’

VP of operations, felt that hybrid cloud was not a good fit for eLoanDocs because “if

we go with a hybrid cloud solution, we will need two separate security and compliance

audits and sets of controls” (personal communication). Buckley estimated that moving

to a hybrid cloud solution would reduce eLoanDocs’ technology costs by about USD

200,000 per year.

Figure 3.4. Hybrid Cloud Infrastructure

A Necessary Decision

By the middle of 2014, the computer systems that eLoanDocs had installed in 2009

were nearing the end of their useful life and had no more capacity for expansion. As

eLoanDocs prepares for their next generation of data center hosting architecture for

2015 and beyond, the choices they face are complex and will have significant

implications for the future of the company.

• • Should eLoanDocs continue with their current model of designing, building,

and managing their own computer hosting infrastructure using their co-

location partners?

• • Would eLoanDocs’ financial institution customers accept a move of

eLoanDocs’ services to a public or private cloud provider?

• • How should eLoanDocs go about choosing a cloud hosting provider?

As Albert Michaels considered his options, his mind was roiled by a number of

questions:

• • Will eLoanDocs’ customers—with their focus on data security—accept a

cloud-based solution? If so, to what degree? And how many customers would

accept some form of cloud-based solution?

• • If customers do accept one of the cost-saving cloud services solutions, what

barriers exist to prevent new competitors from rapidly entering the market and

eroding eLoanDocs’ market share?

• • What is the value that customers believe they are receiving from eLoanDocs?

• • Could it be that customers actually value the secure environment that they

can visit and audit in person? If so, might convincing those customers to adopt

a cloud-based solution to their document delivery problems actually be a

damaging move to eLoanDocs in the long term?

• • Speaking of security, which solution actually provides better protection of

customers’ data? Though ownership of the hosting hardware enables

eLoanDocs to literally pull the plug if a breach is detected, how does that

compare to the security benefits associated with outsourcing to a cloud

provider? Is one solution more likely than the other to be targeted for attack?

Is either solution better able to detect and prevent intrusions?

• • Assuming that the system will be attacked at some point, what ability will

eLoanDocs have to identify the compromised data? How might that ability

change if hosting services are outsourced to a cloud provider?

• • How robust is the existing disaster recovery strategy? Which solution best

fits the redundancy needs of eLoanDocs?

• • How might the eLoanDocs employees react to adoption of a cloud-based

hosting solution?

As Albert considered these and other questions, the only answer he felt sure about

was that it was an exciting time to be alive and working in the technology industry.

Glossary

Cloud computing: Using network resources to perform computations without the need,

or often the ability, to determine the exact resources used at any time.

Co-location facility: Physical location that provides reliable power, secure physical

facilities, and networking services to clients for a monthly operating fee. Clients

provide their own hardware to run in the co-location facility.

Disaster recovery: Alternative to normal system operations intended to be used in case

of catastrophic events (e.g., widespread power outages, local natural disasters).

High availability: High rate of system uptime, typically in excess of 99%. Also refers

to technologies required to achieve a high rate of system uptime, such as redundant

hardware components.

Hybrid cloud: System configuration in which some combination of public cloud,

private cloud, and dedicated server solutions are mixed and used together to form the

complete system.

Infrastructure as a service (IaaS): A type of cloud computing where the cloud

provider provisions and maintains the computer hardware, storage, and networking

for their clients, while the client is responsible for maintaining the operating systems

and software.

Multitenant: Software configuration in which a single instance of the system serves

multiple clients. Clients typically have no visibility or awareness of the data (or even

the existence) of other clients.

Private cloud: Ownership and management of cloud computing resources within an

organization’s firewall or optionally dedicated equipment managed by a cloud

hosting provider on behalf of a customer.

Public cloud: Computing resources that are hypothetically available to any user

connected to the same cloud service provider.

Recovery point objective (RPO): Amount of time for which data may be lost due to

catastrophic events.

Recovery time objective (RTO): Amount of time that a system may be unavailable

due to unexpected circumstances (e.g., a catastrophic event that prevents the function

of the system).

Replication: Act of making exact copies of systems. Disaster recovery plans often use

replication in order to minimize the RPO of a running system by using identical

hardware located at geographically remote sites and synchronizing the data storage

in real time.

Software as a service (SaaS): Licensing software solutions such that the hardware and

the software are typically remote to the licensees and administered and maintained

by the licensors.

SSAE 16 Type II: Statement on Standards for Attestation Engagements (SSAE) 16 is

the professional standard used for issuing reports in accordance with the American

Institute of Certified Public Accountants’ Service Organization Control (SOC)

reporting framework, which consists of SOC 1 (SSAE 16) along with SOC 2 and

SOC 3 (AT 101) reporting. Additionally, the SSAE 16 standard effectively replaced

the aging and antiquated SAS 70 auditing standard that had been in use for

approximately 20 years.

Virtualization: Creating a logical instance of a real system in such a way that it appears

to an end user as a real system. A virtual machine—configurations of powerful

servers so that multiple operating systems can be run with their own disk storage

partitions—is a common example of virtualization.

1. This case w