Cloud Migration Services for SMBs
PlatOps moves small and mid-sized businesses out of server rooms, colocation racks and VPS hosts into AWS, Azure or Google Cloud. Most of our clients have 10–200 employees and no in-house IT team: clinics, law firms, accounting practices and funded SaaS startups.
We decide what moves and what doesn't, build a secure landing zone first, then migrate in rehearsed waves with a rollback path for each one. You see the run cost before anything moves.
What a migration includes
Everything lands in accounts you own
- Inventory and a 7 Rs decision for every workload
- A secure landing zone, built as code in your accounts
- A wave plan with rehearsed cutovers and rollback
- HIPAA-ready setup for patient data
- A run-cost estimate before anything moves
- Hypercare, then a handover to your team or ours
Targets: AWS, Microsoft Azure and Google Cloud, including cloud-to-cloud moves.
What we usually migrate
Most of our migrations start small: a few servers, one or two business-critical applications and a lot of undocumented history. These are the four starting points we see most.
A server room or closet
A few physical or virtual servers in the office running file shares, a line-of-business database, a domain controller or practice management software, often near the end of a hardware warranty.
A colocation rack
Your own hardware in someone else's data center. The usual trigger is a contract renewal or a hardware refresh nobody wants to fund again.
VPS and shared hosting
Applications on DigitalOcean, Linode, OVH or a reseller host that outgrew it: no private networking, no audit trail, backups you have never restored.
Another cloud, or a messy first cloud account
Cloud-to-cloud moves, and the more common case: a single AWS, Azure or GCP account that grew by hand and needs rebuilding properly before the next customer audit.
It fits if this sounds familiar
- A server, storage array or colocation contract is due for renewal in the next 6–12 months
- One person, often an outside contractor, is the only one who knows how the servers fit together
- A customer, insurer or auditor is asking for backups, encryption and access logs you can't produce today
- You are a clinic, law firm or accounting practice and want to leave on-premises hardware without breaking HIPAA or client confidentiality
- Your SaaS product runs on a VPS host and enterprise customers now ask about your infrastructure
Probably not a fit if
- Mainframes, AS/400 or other non-x86 systems. These need specialist migration teams.
- Hundreds of applications to move on an enterprise program timeline. AWS's own large-migration programs and their partners are built for that scale.
- You only need desktop, email and Microsoft 365 support. That is IT support, not a cloud migration.
The 7 Rs of cloud migration, in plain English
AWS names seven strategies for moving a workload. Every server and application in your inventory gets one of them, with the reason written down. Not everything has to move, and not everything that moves has to change.
| Strategy | What it means | Small-business example | How we use it |
|---|---|---|---|
| Retire | Switch it off. | The old intranet nobody has opened in a year, or a reporting server replaced by a SaaS dashboard. | Every retired server is one less thing to migrate, secure and pay for. Discovery usually finds a few. |
| Retain | Leave it where it is, for now. | Lab equipment tied to a local PC, or an application whose vendor is releasing a SaaS version next year. | A valid answer. We document why, and how it connects to what moved. |
| Rehost | Lift and shift: move the server as it is. | A Windows file server or a line-of-business application replicated to a virtual machine in the cloud. | The fastest route out of a server room. AWS recommends moving first and modernizing afterwards for most workloads. |
| Relocate | Move a whole platform without changing it. | A VMware environment moved to a cloud-hosted VMware service, or a database moved to another AWS account. | Rare for small businesses, but useful when you are rebuilding a messy cloud account into a clean structure. |
| Repurchase | Replace it with a SaaS product. | On-premises Exchange to Microsoft 365, or a self-hosted practice management system to the vendor's cloud edition. | Often the cheapest outcome. The work is data migration, single sign-on and access controls. |
| Replatform | Move it and swap in managed parts. | A SQL Server or PostgreSQL database moved onto Amazon RDS or Azure SQL instead of a self-managed VM. | The sweet spot for many SMBs: less patching and built-in backups, without rewriting the application. |
| Refactor | Re-architect it for the cloud. | Breaking a monolith into containers or serverless functions. | AWS calls it the most complex and costly strategy. We rarely recommend it during a migration; do it later if the business case holds. |
AWS's own guidance is to rehost, relocate or replatform first and modernize after the move, because refactoring during a migration is the most complex and costly route. We follow the same rule: get out of the server room safely, then improve what earns it.
Source: AWS Prescriptive Guidance: About the migration strategies. For a longer walk-through with decision criteria, read our cloud migration strategies guide.
AWS, Azure or Google Cloud?
We migrate to all three. The choice usually follows what you already run:
- Azure often fits businesses built on Microsoft 365, Active Directory and Windows line-of-business applications, which describes many law firms, accounting practices and clinics.
- AWS is where many SaaS teams already are, and has the widest choice of managed services for Linux and container workloads.
- Google Cloud suits teams already invested in its data and analytics tools, or in Google Workspace identity.
During discovery we price your actual workloads on the shortlisted providers rather than comparing list prices. Background reading: AWS vs Azure vs GCP for SMBs, which cloud is best for HIPAA and managing AWS and Google Cloud together.
How a migration runs: discovery to hypercare
Five phases, each ending with something you can inspect. The schedule comes out of discovery, because it depends on how many workloads move and how they depend on each other.
1. Discovery
We inventory what you have and decide, server by server, what happens to it. Nothing moves yet.
- Server, application and data inventory, including the things only one person knows about
- Dependency map: which systems talk to which, and which ones break if moved alone
- A 7 Rs decision for every workload, with the reason written down
- Data that is regulated (PHI, client files, card data) identified and tagged
- Target cloud chosen with you, and a run-cost estimate in the provider's own pricing calculator
You get: A written migration plan and run-cost estimate you can take to any provider.
2. Landing zone
The secure foundation everything lands in, built as code before the first workload arrives.
- Separate accounts or subscriptions for production, non-production, logging and security
- Single sign-on with MFA for every person, and no shared administrator logins
- Organization-wide audit logging, encryption defaults and threat detection switched on
- Private networking, and a VPN or private link back to the office while both sides run
- Backup policies and budget alerts in place from day one
You get: Infrastructure as code in your repository, in accounts you own.
3. Wave plan
Workloads grouped into waves so related systems move together and the riskiest go last.
- A low-risk pilot wave first to prove the tooling and the runbook
- Dependent systems grouped so nothing is stranded on the wrong side
- Cutover windows agreed around your business, such as clinic hours or month-end close
- Go and no-go criteria, and a named decision-maker for each wave
You get: A dated wave schedule and a cutover runbook per wave.
4. Cutover
Data replicates continuously ahead of time, so the cutover window only covers the final sync, testing and DNS switch.
- Servers replicated with AWS Transform MGN (formerly AWS Application Migration Service), Azure Migrate or Google Cloud Migration Center
- Databases moved with native replication or AWS Database Migration Service
- A rehearsal of every cutover in a test window before the real one
- Row counts, checksums and application smoke tests before sign-off
- A written rollback path: the source stays intact until you approve the move
You get: Each wave signed off by you, with the validation results attached.
5. Hypercare
Closer watch for the first weeks after each wave, while real usage shows what needs tuning.
- Monitoring and alerting on every migrated workload
- Performance issues and missed dependencies fixed as they surface
- Right-sizing once there are a few weeks of real usage data
- Old hardware, hosting and colocation contracts decommissioned on a checklist
- Runbooks and an architecture diagram handed over
You get: A handover to your team or into a managed cloud retainer.
Rehosting on AWS uses AWS: When to choose AWS Transform MGN, which supports physical servers, VMware vSphere, Microsoft Hyper-V and other clouds as sources. Landing zones are built in Terraform or the infrastructure-as-code tool you already use.
Migrating patient data under HIPAA
Clinics, dental groups and healthcare SaaS teams carry extra obligations when PHI changes location. These are the points we build into the plan from discovery onward.
Sign the cloud provider's BAA first
AWS customers review and accept the AWS Business Associate Addendum in AWS Artifact. Microsoft and Google Cloud offer their own BAAs. This happens before a single file with patient data moves.
Keep PHI in HIPAA-eligible services
AWS says customers may use any service in a HIPAA account, but should process, store and transmit PHI only in the HIPAA-eligible services defined in the BAA. We check every target service against that list during discovery.
There is no 'HIPAA-certified' cloud
AWS states plainly that there is no HIPAA certification for a cloud provider. Compliance depends on how your environment is configured and run, which is the part we build and document.
Encryption doesn't remove the provider's obligations
HHS guidance treats a cloud provider that stores electronic PHI as a business associate even when the data is encrypted and the provider holds no key. Plan for BAAs with every provider and subcontractor in the chain.
Update your risk analysis
The HIPAA Security Rule requires an accurate and thorough risk analysis. A migration changes where PHI lives, so the analysis and your asset inventory need updating as part of the project, not after it.
Audit logs, backups and access from day one
The landing zone for a healthcare migration turns on organization-wide audit logging, encryption with managed keys, tested backups and per-person access before patient data arrives.
PlatOps signs a Business Associate Agreement with healthcare clients. If you have not done a risk analysis recently, the HIPAA Risk Analysis Sprint is a sensible first step, and our AWS vs GCP vs Azure for HIPAA comparison covers provider differences.
Sources: AWS: HIPAA compliance; HHS: Guidance on HIPAA and cloud computing; eCFR: 45 CFR 164.308 Administrative safeguards.
What it costs to run afterwards
A migration is a one-off project; the cloud bill is permanent. We estimate the run cost in the provider's own calculator during discovery, using your real server sizes and data volumes, so the decision to move is made on numbers you can check.
Compute and storage
Virtual machines, managed databases and disks, billed by size and hours. Servers copied as they are tend to be oversized, which is why right-sizing comes after a few weeks of real data.
Data transfer out
Moving data into the cloud is usually free; moving it out to the internet or another region is not. Large file shares and backups to an office are the usual surprise.
Licensing
Windows Server and SQL Server can be license-included or bring-your-own. The choice can change the bill more than instance size, so we price both during discovery.
Backups, logging and security services
Snapshots, log retention and threat detection all bill separately. They are worth paying for, but they belong in the estimate, not in month three's invoice.
Running both sides during the move
Old hardware and hosting keep running until the last wave is signed off. A shorter, well-planned wave schedule shortens that overlap.
Someone to operate it
Patching, monitoring, backup tests and cost reviews don't stop after cutover. Either your team owns them or a managed service does.
How the work is priced
The migration itself is scoped and quoted as a separate project once discovery has shown what is moving. Operating the result afterwards fits our monthly retainer plans: Essential at $3,500–$7,500 a month, Professional at $8,000–$15,000 a month, and Enterprise priced to scope. If part of your estate is already on AWS, the Cloud & DevOps Audit Sprint ($5,000, 30 days) maps cost, security and reliability risk before you move more.
What about the AWS Migration Acceleration Program?
AWS describes MAP as a program offering tools, training, expertise from AWS Migration Competency Partners and financial investments, organized in assess, mobilize and migrate-and-modernize phases, and built on enterprise migrations. If you think your project might qualify, ask your AWS account team early; we will plan around whatever they confirm, and we won't build a business case on funding nobody has approved.
Sources: AWS: Migration Acceleration Program; AWS Pricing Calculator.
What is not included
Application rewrites
We move and re-platform applications. Rewriting your own software for the cloud is a separate development project.
Desktops, laptops and helpdesk
End-user devices and day-to-day IT support are outside a cloud migration. Our managed IT plans for small businesses cover them, with a helpdesk up to 24/7.
Your cloud bill
Workloads run in accounts or subscriptions you own, and you pay the provider directly. You keep full control if we part ways.
Software vendor fees
Some line-of-business vendors charge for re-installation, license transfers or their cloud edition. We flag these in discovery so they are budgeted.
Before and after the move
Migration is the project in the middle. These services cover what comes before and after it.
Managed Cloud
Patching, backups, monitoring and cost reviews for what we migrated, run as a monthly service.
Learn moreDisaster Recovery
Recovery targets, cross-region backups and tested failover once you are in the cloud.
Learn moreWell-Architected Review
An independent review of an environment you already run in the cloud, against the AWS Well-Architected Framework.
Learn moreCloud Cost Optimization
Right-sizing, commitments and cleanup when the post-migration bill is higher than planned.
Learn moreCloud & DevOps Audit Sprint
Already partly on AWS? $5,000 and 30 days to find cost, security and reliability risk before you move more.
Learn moreCloud migration FAQ
What are cloud migration services?
Cloud migration services move your servers, applications and data from an office server room, a colocation rack, a VPS host or another cloud into AWS, Azure or Google Cloud. At PlatOps that covers discovery, a secure landing zone, a wave plan, rehearsed cutovers and a hypercare period, followed by a handover to your team or to a managed service.
What are the 7 Rs of cloud migration?
AWS Prescriptive Guidance names seven migration strategies: retire, retain, rehost (lift and shift), relocate, repurchase (move to SaaS), replatform (move and swap in managed services) and refactor (re-architect). Every workload gets one of these during discovery. For most small businesses the answer is a mix of rehost, replatform, repurchase and retire.
How long does a cloud migration take for a small business?
It depends on how many workloads move, how much data there is and how tangled the dependencies are, so we give you a dated wave plan after discovery rather than a number up front. A handful of servers with a clear inventory moves much faster than dozens of interdependent applications with undocumented integrations.
Will there be downtime during the cutover?
Usually a short planned window for each wave. Data replicates continuously beforehand, so the window covers the final sync, validation and the DNS switch. Its length depends mainly on database size and how the application handles a final sync. We agree the window and the rollback criteria in the runbook and rehearse it first.
Can we move to the cloud and stay HIPAA compliant?
Yes, if it is planned that way. Sign the cloud provider's Business Associate Agreement before any PHI moves, keep PHI in the provider's HIPAA-eligible services, build the landing zone with audit logging, encryption and per-person access, and update your HIPAA risk analysis as part of the project. PlatOps signs a BAA with healthcare clients.
Should we choose AWS, Azure or Google Cloud?
It depends on what you already run. Businesses built on Microsoft 365, Active Directory and Windows applications often fit Azure well; SaaS teams frequently start on AWS; Google Cloud suits teams already invested in its data and analytics tools. We compare the run cost of your actual workloads on the shortlisted providers during discovery.
How much does it cost to run our systems in the cloud afterwards?
The main drivers are compute and database sizing, storage, data transfer out, Windows and SQL Server licensing, backups and security services. We build the estimate in the provider's own pricing calculator during discovery, then right-size after a few weeks of real usage. Ongoing management is a separate retainer, starting at $3,500 a month on our Essential plan.
Can AWS fund part of our migration?
AWS runs the Migration Acceleration Program, which it describes as providing tools, training, expertise from AWS Migration Competency Partners and financial investments, based on thousands of enterprise migrations. Ask your AWS account team whether your project qualifies before you count on any funding.
What happens after the migration is finished?
After hypercare, everything we built stays in your accounts and repositories, with runbooks and an architecture diagram. Your team can run it, or our Managed Cloud service takes over patching, monitoring, backups and monthly cost reviews.
Related Articles
Guides and resources to help you go deeper
Plan the move before you sign the next hardware quote
On a 1-hour call we'll ask what you run, what is driving the move and what deadline you are working to, then tell you honestly whether a migration makes sense now.