Adidas Canada’s headquarters in Concorde, Ont., just north of Toronto, supports a head office of about 120 staff; a high-tech distribution facility serving 4,000 retail outlets from Brantford, Ont., with a staff of about 100; a 30-seat call centre in suburban Montreal; a small showroom in Burnaby, B.C.; about 50 sales reps flogging the Adidas and Taylor Made Golf lines across the country, and a fast-growing owned-retail arm operating 12 stores, with a flagship store still to open at Yonge and Dundas in Toronto – “The Times Square of Toronto,” as CIO Paul Leone puts it.
It’s a lot of data to back up, not just from its IBM AS/400 running Active Directory Exchange Server, but also from its complement of Wintel desktops and servers. There’s also a high level of automation in the Brantford warehouse and in-house developed supply chain and customer- and employee-facing Web applications.
“At the middle of everything we do for the most part from an application standpoint is an AS/400 platform and an Active Directory Exchange platform that we’ve implemented through the global Adidas Group standard,” Leone says. “There’s a lot of other servers and technologies that we have, but the AS 400 really drives the order fulfillment supply chain side.”
With an IT staff of 13 – most at head office, with lone support people at the warehouse and call centre – it made sense to Leone to job out the headache of keeping data backups up-to-date to an external supplier. About four years ago, the company gave that job to Toronto-based Storagepipe.
“We’ve been able to set up with Storagepipe the ability for these people to come into our infrastructure at a given time interval and back up whatever we ask them to back up,” he says. “That data is backed up over the Internet, and they basically manage the offsite backups for us.”
While Adidas opts for the Internet to connect to Storagepipe’s data centre, customers also have the option of a dedicated connection, says Steve Rodin, the storage provider’s president. The data is secure on the SSL-encrypted Internet connection, Rodin insists, but it’s a question of cost and quality of service.
“It depends a little bit on the customer,” he says. “If you have a very large Internet connection, you pay more for that than you would for a large direct connection, because Internet traffic tends to be more expensive. But the way things are changing, you now have non-dedicated, burstable Internet pipes that some companies are selling for quite reasonable prices. Since many of our customers, when they’re using our service, they’re using it off hours … they can use an Internet pipe and be fully satisfied that will traffic the appropriate amount of data.
“But there are situations where customers don’t want their data back up over the Internet, regardless of the encryption and everything else. They’d rather have a LAN or WAN equivalent. That’s when they look to the direct connections.”
Adidas runs three backup cycles through Storagepipe: daily, weekly and monthly. The year-end backup is handled inhouse. “We focus on the things that are critical at a daily level, then weekly, then monthly,” Leone says. “We’ve chosen to do year-end backups in-house, just because of the frequency of it. We’re doing special year-end processes anyway, so for us to do a backup in-house and secure it somewhere is actually better than trying to get the guys at Storagepipe to get into a routine for something we do once every 12 months.”
Leone says that because of the company’s growth, the original business case numbers for the outsourcing don’t apply anymore, but the company isn’t approaching it from a cost-savings perspective.
“(Storagepipe) provides us with really a simple, no-worry offsite backup strategy that allows us basically to have piece of mind and not worry about things like grandfathering tapes or worrying about who’s got the backup, when’s the backup running, are we sure it’s being scheduled,” Leone says.
“Quite honestly, we’re coming out of two audits, an internal audit through Adidas Group and an external audit right now,” he says. “And they’re very excited to hear that the backups are offsite, we can access them if we need it, it’s timely, it’s secure.
“The value here is in knowing our data is secure and we don’t have people running around flogging tapes or doing backups manually.”
Increasing regulatory compliance demands are driving business for suppliers like Storagepipe. “As compliance requirements increase, people are recognizing they don’t necessarily want to do that in house, they don’t have the expertise, so they look to specialists like ourselves, then they realize they can take advantage of a service without building all that expertise,” Rodin says.
And while Storagepipe is looking to build a data centre in the U.S., Rodin says there’s an advantage to a stored-in-Canada option, even for U.S. companies.
“For the most part, actually, we’ve found our U.S. customers to like the fact that we’re located in Canada because we’re not subject to the Patriot Act,” American legislation that can force suppliers to hand over confidential data held for their customers in the interest of national security, Rodin says.
“And that’s actually very important for Canadian customers because anybody using a U.S. provider in Canada is subject to the Patriot Act. And that’s not necessarily in compliance with PIPEDA, where you want to make sure your data is private and not subject to these other acts.”
He feels there’s a fundamental conflict between the Patriot Act and Canadian privacy legislation. “When you read PIPEDA and you look at what is supposed to happen, the Patriot Act contravenes all those privacy acts. It would be hard to argue that it wouldn’t contravene it,” he says. “We make the point to Canadian companies that, if you want to be covered, you’re better off storing your data in Canada.”
James Kosa, an associate with law firm Deeth Williams Wall in Toronto, agrees. “There are a lot of disconnects between (the Patriot Act and PIPEDA),” he says. “They’re philosophically completely different.” The Patriot Act is designed to put the state’s interest first, Kosa says, while PIPEDA is oriented toward protecting individuals’ privacy.
As to whether data stored in Canada is safe from the long arm of FBI-issued national security letters, Kosa’s not so sure.
“I don’t know if that’s been settled yet,” he says.