Operators in online gambling are beginning to rethink their reliance on hyperscale cloud providers as costs rise and privacy concerns intensify. Ilkari‘s CTO, James McLeod, explained to SiGMA News why control is the new currency in iGaming infrastructure.
For more than a decade, the online gambling sector has leaned heavily on the likes of Amazon, Google, and Microsoft to run its platforms. But according to James McLeod, Chief Technology Officer at Ilkari, operators are now realising that the promise of the public cloud has come at a price many can no longer justify.
“Over the last 10-15 years or so, there’s been a huge push for iGaming operators to move to the public cloud,” McLeod told SiGMA News in an interview. “And I think now they’re seeing that it’s not all it was cracked up to be. The hidden costs are often a challenge.”
Cost shocks and hidden risks
The financial strain of hyperscalers, McLeod argues, is one of the key drivers pushing operators back towards private infrastructure.
“I’ve been on projects where we expected the spend to be around $25,000 to $30,000, and then when we got the monthly bill, it was three or four times that,” he said. “It’s very difficult to control budgets.”
But costs are only part of the equation. The bigger threat, according to McLeod, is uncertainty over where data resides and who ultimately controls it.
“There’s no guarantee where your data is being hosted and where it resides,” he explained. “Often copies of that data are transferred to other locations that may be in jurisdictions that could violate an iGaming regulator’s licence, or it may be in a jurisdiction you’re just not comfortable with.”
He pointed to US law as a particular concern: “With a lot of the bigger players, they’re all US companies. You’re at the mercy of the US government and their laws. Things like the Patriot Act or the Cloud Act would allow the US government to force these hyperscalers to hand over details about the customer or the data.”
For operators whose survival depends on protecting player information, McLeod believes the risk is too high. “Protecting your player base’s privacy is usually quite paramount,” he said. “That’s where we see our differentiator. We can give assurances that perhaps a hyperscaler can’t.”
McLeod, who has spent 25 years in the industry, says his company’s pitch is simple: sovereignty, privacy and control. Ilkari runs data centres, a private cloud platform and a domain registrar business with privacy tools. “We don’t specifically target iGaming, but most of our customers are in iGaming,” he said. “That’s where our leadership team’s experience lies.”
Security as a baseline, not a bonus
McLeod insists that sovereignty goes hand in hand with robust cybersecurity. “It’s no longer really a case of it might happen, it’s a case of when it might happen,” he said of cyber attacks. “We need to mitigate as many cybersecurity threats as possible and also help our customers minimise the attack surface.”
For McLeod, one of the dangers of using larger cloud providers is their complexity. “They have a wealth of products, and if you’re not familiar with them, it can be tempting to tick the box to enable them,” he said. “But if you don’t fully understand how it works, it can actually cause more damage than good. It can lull you into a false sense of security.”
Instead, he argues, the value of a specialist hosting provider lies in its people. “You get to speak to people that have been in the trenches,” he said. “They’ve got the battle scars. They can work with your teams to build solutions that work for your business.”
Cyber threats
The iGaming industry has long been a prime target for cybercriminals. Ransomware and distributed denial-of-service (DDoS) attacks are almost a fixture, McLeod said.
“I’ve been experiencing those for the last 20 years or so, so they’re nothing new,” he explained. “What we do offer is the experience to help customers plan for those scenarios, so if something does happen, they’ve at least got a strategy in place.”
Regulatory pressure across borders
Regulatory pressure remains a headache. Businesses operating across multiple jurisdictions often face contradictory demands on data handling, forcing them to duplicate systems and ramp up costs.
“That becomes expensive,” McLeod said. “Again, that’s where specialist hosting providers can help, advising on what bits need to be separate and what bits could be shared.”
Asked whether hosting providers might one day face the same licensing requirements as iGaming operators and software suppliers, McLeod was pragmatic. “As far as I’m aware, there’s no push for infrastructure suppliers to get gaming licences,” he said. “But if that was the case, then we would certainly look towards that. A lot of people at Ilkari have gone through licensing and certification before.”
Not yet a marketing tool
While some industries now sell privacy as a consumer-facing advantage, McLeod is sceptical that players care where their data is stored, at least for now.
“Candidly speaking, players generally don’t really care where their data is stored as long as the operator is adhering to local or regional data protection laws,” he said. “I don’t think the average player would be too concerned whether it’s on Microsoft, Google or a private hosting provider.”
But he added a warning: “Where it will become a marketing point is when—and it’s not a case of ‘if‘, it’s ‘when‘—there is some big event, and the US seizes data. When that happens, players will start to care, and the operators who have already invested in tailored data-protection services will be the ones with a clear advantage.”
Control above all
For McLeod, everything comes back to control, whether through colocation, private cloud, or hybrid models that allow operators to retain sovereignty where it matters most.
“Colocation is like a hotel for your servers,” he explained. “You own the infrastructure, the servers. All we’re doing is providing the power and a place to store them.”
Some operators, he explained, prefer to keep specialised servers in colocation while running more standardised platforms on Ilkari’s private cloud. “That way they get the best of both worlds,” he said.
And that word, control, remains the cornerstone of McLeod’s pitch. “What we’re talking about is control,” McLeod said. “By going to some of those hyperscalers, you’re forfeiting some of that control.”
A question of gaps
When asked what mistakes operators most often make, McLeod pointed to complexity and poor communication.
“The infrastructure is so complex, there’s no longer a single person that has it all in their head,” he said. “That’s where the vulnerabilities get exposed. You’ve got teams that don’t work together, they don’t communicate, and they don’t identify the gaps. That’s something we often see when we come in.”
As regulators tighten, attacks evolve, and costs spiral, McLeod is betting that operators will see value in returning to infrastructure they can truly own and understand.
“Some things work very well in the public cloud,” McLeod conceded. “Content delivery networks are ideal. But your transactional history, where bets are struck, wagers are placed—that really should be somewhere where you have complete control and you know exactly who has access to it.”
Domain protection
Another part of the infrastructure puzzle lies in domain management and the question of keeping ownership details private. “If you register a domain, it’s quite often that the registrar will offer you to hide your details so somebody can’t go and look them up in a public registry,” McLeod explained. “But it’s very easy to circumvent that”. He said Okens — a registrar business Ilkari acquired last year — takes a different approach by adding an extra layer of protection: even if registry details are disclosed, they do not point back to the customer.
That matters in the iGaming world because domains themselves can be valuable assets. Affiliates in particular depend on high-ranking domain names to drive traffic, which makes them a target for competitors or buyers. Protecting who owns those domains, McLeod argued, helps reduce unwanted attention and shields businesses from attempts to acquire or hijack their digital storefronts.
