Let's dive into some technical weeds for just a moment, shall we? Stay with me, my friend, I need you to understand this part. "Hosted in the cloud", "web hosted", or "cloudy web stuff" (don't go with that last guy's software, by the way - that terminology is a giant red flag) are terms that are used liberally in the software space, especially in the debt collection software market.
Here's the point: if you are responsible for the data center server that the software is hosted within, that is NOT cloud-based software - nor is it "web-based". That is merely "off-premises" and no bueno. You are still responsible for paying for the server even though the software provider is telling you you are inheriting "Tier III", "SSAE16", or whatever other acronym the data center puts on their marketing brochure. Those inherited certifications are very limited in scope and many of your clients will not be satisfied with them if you are not doing more auditing on top of them. They are just housing your box that could just as easily be parked down your hallway.