Cloud delivery is now the default for time tracking, so the phrase no longer narrows a shortlist. What it should prompt is a different set of questions about a record that is reachable from anywhere and held by somebody else: what happens offline, who can read it, how long it is kept and how you get it back.
Offline behaviour
A product that cannot queue entries offline will lose time whenever the signal does, and the reconstruction is done from memory afterwards. Ask how much it can hold locally and how it reconciles when the connection returns. For anybody working in basements, vans or rural sites this is the question that decides whether the product is usable at all.
Who can read the record
Inside your organisation, permissions should separate viewing a team from viewing everybody, and editing from viewing. Inside the vendor, ask whether support staff can view records, whether that access is logged, and whether you can see the log. Both answers should be available in writing without escalating to a sales engineer.
Retention and getting it back
Your retention duties do not transfer to the vendor. If the service keeps two years and you owe longer, the gap is yours. Ask whether exports can be scheduled automatically, because a manual monthly export is a task that survives roughly four months in any organisation before somebody forgets.
Questions people ask about cloud based time tracking
Is cloud time tracking secure enough?
From a serious provider, generally more secure than a self managed server. The residual risk sits with your own accounts and permissions.
What if the service is down at shift start?
Ask before signing. The good answer is a local queue; the common one is a supervisor writing names on paper.
Can we keep our own copy?
You should, on a schedule. Confirm the export includes full history rather than the current period.