Most South African cloud shortlists have three names on them, and the same three every time. That is understandable. Microsoft, AWS and Google run the largest global platforms, and the skills market, the partner ecosystem and most of the reference architectures follow them. But a shortlist built from habit is not an assessment. It quietly excludes options that are sometimes the better fit for a specific workload.
The opposite mistake is just as common. An alternative provider is invited into the process late, scored generously, and then used to extract a discount from the incumbent. The alternative never had a real chance, the incumbent knows it, and the organisation has spent weeks of evaluation effort on theatre.
This part looks at three kinds of alternative: Huawei Cloud, Oracle Cloud Infrastructure (OCI), and South African and specialist providers. The rule for all three is the same as for the hyperscalers in Part 2 and Part 3. The alternative must win for a workload, on evidence, not for novelty or negotiating leverage.
Mopane Group is fictional, and its workloads and figures are illustrative. Mopane is the diversified South African group we have followed through this series: a retail chain, a packaging plant, a small regulated financial services arm, and group functions that run Microsoft 365, a SaaS payroll product and Oracle E-Business Suite on hardware due for refresh in 18 months.
Huawei Cloud: when the specific advantage is real
Huawei Cloud runs a region in Johannesburg, AF-Johannesburg. Huawei says it has operated cloud services in South Africa since 2019 and that the region has three availability zones, and it states that it will not move customer data out of the region the customer selects without express authorisation. Those are the provider's own statements, and like every provider's description of its own footprint, they should be confirmed in the contract and the service documentation for the services you will actually use.
Huawei should enter the shortlist when one or more of these conditions are true:
- The organisation already has substantial Huawei telecommunications, networking or industry technology, and the integration or support relationship is a genuine advantage.
- A local Huawei service, partner or commercial arrangement materially changes the economics of a specific workload.
- The exact Johannesburg service catalogue meets the workload's functional, resilience and data requirements.
- Procurement, risk and the board are comfortable with the support model, supply-chain questions and any policy or geopolitical considerations that apply to the organisation and its customers.
- The organisation can source enough engineering and operational capability to run the platform properly, not just to deploy on it.
Huawei should not win merely because the quoted infrastructure price is lower. A lower virtual-machine rate says little about the total cost of a platform that the team has to learn, secure, integrate and support for several years.
The assessment needs to go beyond the region list. Check the third-party marketplace and integration ecosystem for the tools the organisation already uses. Check whether the global regions the business needs are available. Test incident support with realistic scenarios. Read the contractual exit terms and export mechanisms. And trace the precise location of the management plane, security services and any AI processing, because a local region does not by itself mean that every part of the service runs locally.
Geopolitical and procurement constraints deserve a specific word. They are real for some organisations, irrelevant for others, and the worst way to handle them is as an unspoken assumption or a slogan. Write them down as explicit governance inputs: which customers, contracts, regulators or group policies impose a constraint, what the constraint actually says, and who has authority to interpret it. Then apply the same rule to every provider, because no hyperscaler is free of jurisdictional questions.
Oracle Cloud Infrastructure: when Oracle technology has gravity
OCI is most compelling where Oracle technology dominates the workload. At the time of writing (October 2026), Oracle runs one public cloud region in South Africa, South Africa Central (Johannesburg), with a single availability domain. Oracle Interconnect for Microsoft Azure links that region with Azure South Africa North, which matters for organisations whose Oracle systems feed Azure workloads. Oracle also offers the Cloud@Customer family (Exadata Cloud@Customer, Compute Cloud@Customer and OCI Dedicated Region Cloud@Customer), which places Oracle cloud and database services inside a customer's own data centre for latency, residency or operational control requirements.
OCI should lead when:
- Oracle Database or Exadata performance, support and licensing dominate the economics of the workload;
- Oracle Fusion applications or another Oracle platform is central to the business;
- a measured dependency between Oracle systems and Azure workloads is simplified by interconnection;
- a specific OCI managed service is the clear technical fit;
- Cloud@Customer solves a requirement that public cloud cannot, such as a hard locality or latency need for a regulated database.
OCI should not win merely because the organisation runs a few Oracle databases. A handful of small databases can usually move to a managed database service on whichever platform hosts the applications that use them, and the licensing conversation is separate from the platform decision.
The single South African region has a direct consequence for disaster recovery. An architecture that needs an independent second public region has to look outside the country, or to another recovery platform such as Cloud@Customer, a local provider or a different hyperscaler, and make the legal and operational implications explicit. Fault domains and the availability domain protect against different failure scopes from a geographic disaster. They are not a second region, and a design document should not imply that they are.
Mopane's Oracle question
Mopane's finance division runs Oracle E-Business Suite on Oracle Database in the Midrand data centre, on hardware due for refresh in 18 months. That deadline is what forces the decision.
Three paths are on the table. Refresh the on-premises hardware and keep running as today. Move the database and application to OCI in Johannesburg. Or keep the application close to Azure, where the rest of Mopane's group systems live, and connect it to an Oracle-managed database service in OCI Johannesburg over Oracle Interconnect for Microsoft Azure.
The deciding evidence is not the infrastructure rate. It is the licence position under each path (Oracle's licensing rules differ by platform, and the difference can outweigh every other cost line), the recovery design, and the latency between E-Business Suite and the Azure systems that consume its data. Because OCI has one South African region, Mopane's recovery design for the OCI path has to name where the second copy lives. The finance team's recovery objectives (a recovery time of eight hours and no more than one hour of data loss for month-end processing) are achievable with a cross-border recovery region or a local recovery platform, and each choice has a different legal and cost profile. That is the gate Mopane is still working through, with its legal advisers, before scoring anything.
South African and specialist providers
Local providers are often left out of strategy documents because they do not appear in global analyst reports. That is a mistake for some workloads. A South African or specialist cloud provider can be the right home for conventional virtual machines, managed hosting, backup and immutable recovery copies, sector-specific arrangements, local contracting and hands-on operational support. Some offer data-centre locations, support hours and commercial flexibility that a hyperscaler does not package.
The trap is the assumption that local means secure, or that local means compliant. It means neither. A local provider should be assessed with the same rigour as any other:
- Audited controls and evidence, not a "local equals secure" assumption.
- Ownership, subcontractors and the complete data path, including where backups, support access and management tooling sit.
- Power, carrier and site diversity, which matters more in South Africa than almost anywhere else.
- Service catalogue, automation, APIs and infrastructure-as-code support, because a platform that can only be changed by ticket will slow every team that uses it.
- Recovery location and tested restoration, with evidence of an actual restore, not a policy document.
- Financial durability, capacity growth and support staffing, since a small provider's failure is your outage.
- Export formats, the data-egress process and contractual exit assistance.
Mopane's financial services arm used exactly this checklist when it looked for a second, independent home for immutable backup copies of its policy administration data. The primary system runs on Azure (Part 2). A local provider offering immutable object storage in a different facility gave it an independent recovery copy inside South Africa, held by a different company on different infrastructure, which addressed a concentration-risk question its board had asked. The provider passed on controls evidence and restoration testing. It scored lower on automation, which the team accepted because backup copies change on a schedule, not by hand.
Government: policy, mandate and procurement route
Public-sector programmes add a layer of their own. The National Policy on Data and Cloud, published in the Government Gazette on 31 May 2024, sets national direction for government. It adopts a cloud-first approach to new government ICT procurement, makes the State Information Technology Agency (SITA) responsible for sourcing data infrastructure and cloud services from industry for government, and requires that government data pertaining to national security and sovereignty be stored only in digital infrastructure inside South Africa. That last requirement covers a specific category of government data, not all of it. SITA describes itself as running a government private cloud and mediating access to existing cloud providers.
Neither of these is a universal technical rule that applies identically to every public body and every workload. A public-sector programme needs to map its own mandate, its procurement route, and the classification of the information it handles, then decide what the policy actually requires of that workload. Treating a policy aspiration as a blanket prohibition can rule out sound options. Ignoring it can produce a design that procurement will not approve. This is a question for the programme's legal and policy advisers, not a conclusion to draw from a slide. For private organisations handling personal information, POPIA's conditions on cross-border transfer are a separate question again, covered in POPIA does not require your data to stay here.
Common mistakes
- Inviting an alternative only to pressure the incumbent. The evaluation costs real effort, and the platform chosen for bargaining power still has to be operated for years.
- Treating "local" as a security or compliance credential. Location is one fact; controls, evidence and the data path are what matter.
- Counting fault or availability domains as disaster recovery. They protect against different failures from a regional disaster.
- Comparing virtual-machine rates. Licensing, skills, support and exit costs routinely outweigh them, especially for Oracle workloads.
- Leaving geopolitical constraints unspoken. Write them down, name who interprets them, and apply them consistently to every provider.
- Reading national policy as a technical specification. Map the mandate and classification of the actual workload instead.
A decision you can defend
Mopane's working statement for its finance platform, still waiting on the recovery gate:
We will choose between OCI in Johannesburg and an Azure-hosted application with an Oracle-managed database for Oracle E-Business Suite, because Oracle licensing and database support dominate this workload's economics and both paths remove the hardware refresh. The main risks are licence non-compliance during migration, recovery outside South Africa for the OCI path, and latency to the Azure systems that consume finance data. We will control them through a licensing review before contract, a legal opinion on the recovery location, and a measured latency test with production-shaped queries. We will reconsider if Oracle's South African footprint or interconnection options change, or if the finance division moves off E-Business Suite.
Notice that it does not yet name a winner. That is the honest state of a decision with one unknown gate, and an unknown is not a pass.
What to take from this part
An alternative must win a workload on evidence. Novelty and negotiating leverage are not reasons.
Huawei, OCI and local providers each have a real niche. Telecommunications and local relationships, Oracle gravity, and local operational support respectively.
One South African region shapes the recovery design. Name where the second copy lives before scoring.
Local is a location, not a control. Assess every provider with the same evidence checklist.
Next in the series: When on-premises and private cloud remain the right answer.
How CloudNala can help
We run like-for-like platform assessments that include the options a shortlist usually leaves out, test them against the same gates and evidence as the hyperscalers, and write down the constraints, such as licensing, recovery geography or procurement policy, that will actually decide the outcome.
Work with CloudNala
CloudNala helps organisations move from technology ambition to practical execution across cloud, AI, data, platform engineering and digital services.
Whether you are exploring AI, modernising your cloud environment, building a public-sector digital service, or turning an idea into a working MVP, we can help you shape the roadmap and deliver the next step.
Book a Cloud Platform Decision Review or write to us at consult@cloudnala.co.za