Enterprise in the Cloud: Q&A with Google's Rishi Chandra

Many people are familiar with Google Apps such as Gmail, Google Calendar and Google Docs, but can you explain the underlying Google App Engine platform and your plans for the enterprise market?

The App Engine platform gives you the option of allowing third parties to use your data. Maybe you want to take the data that's inside a Google Spreadsheet, for example, and expose it to another application that can do more in the way of intelligence than Google Spreadsheets can handle. We can go the other way as well, because the Spreadsheets API lets us pull data from different sources. The App Engine platform layer gives us a very compelling opportunity. We can use it across CRM applications, ERP applications — whatever it might be — and third parties are going to be able to work with the data in the apps.

Your partnership with Salesforce.com is probably the best example of what you're talking about. Can you describe that integration?

The Salesforce.com integration is at the application layer. We have a variety of APIs that allow Salesforce.com to integrate with our systems, and we can go both ways because Salesforce.com exposes APIs as well. It makes it a fairly seamless experience for customers to navigate between the two products. The great thing about that integration is that it was all done working with the existing, publicly available APIs, although they also helped us improve those APIs so they can do a lot more than third parties could do previously.

Will we see enterprise apps actually running on the App Engine rather than just drawing data from it?

The App Engine is still in preview release, but the basic intension is that any third-party provider can build onto Google infrastructure and gain the same capabilities and scalability. For enterprises the story will be, "you have tons of custom applications. Rather than hosting inside your company, why not take advantage of our scalability and build it on top of Google App Engine?"

Do you expect to be an underlying platform for SaaS vendors as Amazon is with EC2?

The App Engine only came out a couple of months ago, and it's going to be interesting to see where we can take it. We're providing the entire stack, whereas Amazon provides pieces of the stack. We've built our infrastructure so it's particularly tuned for Web applications. Right now we support Python. As we support more languages, which we plan to do, you'll see the platform extended to non-Web applications including more enterprise apps.

Is that one area where Google Gears might come into play?

Absolutely. The gap in Web applications has always been in providing an offline as well as online experience. Our goal in introducing Google Gears and releasing it in open source is to drive adoption of cloud computing as a whole. We think the right model is having your data in the cloud and enabling people to build applications that can use it online, offline or however and wherever users need access. We have no intention of locking that technology up only for Google because we want to see the entire industry move over to cloud computing. We've already done it in the consumer world, and we think there's a huge opportunity to do the same thing in the business world.

Amazon has described developers as the customer whereas SaaS vendors like salesforce.com are very in touch with business constituents. What's Google's approach to the market, and how will you address enterprise needs?

Our approach will follow the model we've taken with gmail, Google Calendar and all our applications, which is to go from consumers to the enterprise. We'll initially start with developers, particularly developers who are building consumer applications, and then as we build out the platform and increase the scalability, we'll roll the App Engine into more enterprise deployments. Enterprise requirements are going to require higher levels of security, higher levels of control and higher levels of reliability.

Even with robust security, managing data in the cloud seems to fly in the face of the Sarbanes-Oxley Act and other regulations that require process transparency and certain knowledge of where your data resides. How can you meet these requirements?

The idea of data location is a challenge for us, because you don't want to lose the benefits of the scale that Google is providing with cloud computing. At the same time, there are regulatory requirements and perception issues we have to deal with. Due to the Patriot Act, for example, many European companies refuse to host data in US-based data centers. We're looking at ways to address that. For example, we may not be able to let you specify the exact data center in which your data resides, but we're evaluating whether we could let you specify in which continent your data resides.

At June's Enterprise 2.0 event in Boston, Google executive Jeff Keltner said SAS 70 compliance would help address security concerns. So where does Google stand on that front and what does it mean to customers?

SAS 70 is an accepted certification program that has been in place primarily for outsource vendors like IBM, CSC and other companies that run data centers for companies. Most enterprise customers will ask you immediately where you stand in term of SAS 70, because it's something they've looked for as part of the trend toward managed services and data centers being outsourced to third-party providers. It's a very long certification process. For Type 1 certification you spend several months clarifying what controls you are going to specify. You get to Type 2 when an auditor comes in and spends about six months auditing everything to make sure you comply with what you promised.

Google has different products at different phases of SAS 70 certification. Our security and compliance tools, including archiving, spam filtering and message archiving [acquired in the September 2007 Postini acquisition], are already Type 2 certified. We have moved through SAS 70 Type 1 with the Google Apps themselves, and we're in the process of getting to Type 2.

Any final thoughts on what it will take to spur enterprise adoption?

The notion of cloud computing is still fairly nascent, but people are starting to clearly understand the benefits. They understand the scale benefits, the economic benefits and even the product and application benefits, but we're still in the early stages. Google Apps is less than 18 months old, and we're still learning how you can take these applications and innovate in applying them to the enterprise market. For example, we had a request to add an auto-fill feature to Google Spreadsheets because spreadsheets all over the world have that feature. We said okay, fine, but one of our engineers asked, "what if we could also pull information from the Web?" Let's say I started filling in California, New Jersey, Arizona and so on, and the application could figure out that I was pulling all the states. So now we can connect to Google Search and Google Sets as a way to make that happen, and that's part of the auto-fill feature that we released.

That's just one of the little things that will change going forward as we rethink all these features inside existing products and ask, "how can we use the cloud to make this more powerful and relevant?" You're going to see a lot of innovation, so the product you see two or three years from now is going to be very different than what you see today.