Other meanings of Software as a service
Cloud computing
Software as a service is a software licensing and delivery model providing applications over the internet. A provider operates the application and underlying infrastructure, while customers access it through a web browser, mobile client, or application programming interface and usually pay by subscription or usage. It is commonly classified as one of the three principal cloud-service models, alongside platform as a service and infrastructure as a service.1
Software as a service shifts responsibility for running an application from the customer to the service provider. The provider manages servers, storage, networking, operating systems, application code, maintenance, and often security controls; the customer generally manages users, permissions, content, and configuration. NIST defines software delivered in this way as a cloud capability in which the consumer uses the provider’s applications running on cloud infrastructure.
Access does not necessarily mean that every SaaS product is a simple website. Services may expose browser interfaces, mobile applications, desktop synchronization tools, or APIs. The defining feature is the provider’s operation and delivery of the application as a continuing service, rather than the customer’s purchase of a copy for local installation.
SaaS providers commonly serve many customers from shared cloud infrastructure while separating their data and administrative boundaries. This arrangement, often called multitenancy, can reduce operational costs and let providers deploy improvements centrally, although isolation and configuration controls must be designed carefully.
Commercial arrangements vary. Plans may be priced per user, by feature tier, by transaction volume, or through a contract with negotiated service levels. Centralized operation enables automatic patches and frequent releases, but it also means that customers depend on the provider’s availability, roadmap, authentication choices, and support practices. Service-level agreements can specify availability or remedies, yet they do not eliminate operational risk.
Enterprise administration typically includes identity federation, role-based access control, audit logs, retention settings, usage reporting, and integration with other services. APIs and webhooks make SaaS applications components of larger workflows rather than isolated programs.
The principal benefits of SaaS are reduced local installation, elastic capacity, rapid provisioning, and access from multiple locations and devices. Customers can often begin with a small deployment and expand without buying servers or performing major version upgrades. Providers can also apply fixes and security updates across their managed environments more consistently than separately maintained installations.
The trade-off is dependency on connectivity and on a third party’s technical and organizational controls. Cloud environments introduce concerns about confidentiality, integrity, availability, legal jurisdiction, and the division of responsibility between provider and customer.1 A customer may have limited control over release timing, infrastructure location, outage recovery, and the handling of telemetry. Due diligence therefore commonly examines encryption, incident response, subcontractors, backup and restoration, audit evidence, data export, deletion procedures, and contract termination terms.2
SaaS adoption creates governance issues that are easy to overlook because purchasing may occur outside an organization’s traditional information-technology process. Employees can create unsanctioned accounts, a pattern often called shadow IT, leaving sensitive information in services that have not been assessed or connected to centralized identity controls.
Portability is another practical edge case. Exporting records may preserve basic data but lose permissions, audit history, formulas, relationships, or application-specific metadata. A customer may therefore face migration costs even when a provider offers an export function. Shared responsibility also varies by service: the provider may secure the platform, while the customer remains accountable for weak passwords, excessive privileges, misconfigured sharing, or unlawful content.
SaaS is not synonymous with public access or a particular payment method. A privately hosted, contract-based application can still be delivered as SaaS if the provider operates it for customers; conversely, a downloadable program with a recurring license is not automatically SaaS.
Terminology follows the NIST cloud-computing model; commercial products may combine SaaS with other delivery and hosting arrangements.
Help improve the encyclopedia. Reports go straight to the site manager.