SaaS Security: What Actually Protects Your Data
An employee connects a free PDF converter to the company Google account. It asks for permission to read and send mail. She clicks allow, because the alternative is not finishing the report. No password…
An employee connects a free PDF converter to the company Google account. It asks for permission to read and send mail. She clicks allow, because the alternative is not finishing the report. No password was stolen. No firewall was breached. A third party now reads every message in that mailbox.
That is what modern breaches look like. Not a hooded figure cracking encryption, but an ordinary person granting ordinary access to something that asked politely. The perimeter you used to defend is now a hundred vendor logins spread across departments.
This guide explains what SaaS security covers, who is responsible for which part, what actually goes wrong, and which controls deserve your first budget. Opinions here are stated plainly rather than hedged.
What is SaaS security?
SaaS security is the practice of protecting data held in software you do not host. It covers who can sign in, what they can reach, how the vendor stores and separates your records, which third parties you have connected, and how quickly you would notice misuse. The vendor secures the platform. You secure the way your organisation uses it.
The confusion starts with that split. Buying from a large provider genuinely does improve your infrastructure security. It transfers almost none of your configuration risk, and configuration is where the incidents happen.
Who is responsible for what?
The vendor owns physical security, the network, the operating system, the application code and platform patching. You own user accounts, permissions, sharing settings, connected applications, and the data you choose to upload. Every major provider publishes this split, and almost every customer skims it.
| Layer | Owned by | Typical failure |
|---|---|---|
| Data centre and hardware | Vendor | Rare, and usually well handled |
| Application code | Vendor | Unpatched dependency or logic flaw |
| Tenant separation | Vendor | Data leaking between customers |
| User accounts and passwords | You | Reused credentials, no second factor |
| Permissions and sharing | You | Files shared to anyone with the link |
| Connected apps and tokens | You | Broad grants nobody reviews |
| Offboarding | You | Leavers keeping access for months |
| Your own backups | You | Assuming the vendor holds them |
Read the bottom half of that table again. Every row is a decision your team makes, not a product you buy.
What actually goes wrong in practice?
Four causes dominate. Stolen or reused credentials without a second factor. Over permissive sharing links. Forgotten third party integrations holding valid tokens. Accounts belonging to people who left. Sophisticated exploits exist, but they are rare next to these four.
- Credential reuse. One password, used at work and on a hobby forum that leaked in 2019.
- Token sprawl. An integration approved for a trial two years ago still reads your customer records.
- Public links. A spreadsheet shared as anyone with the link, then indexed or forwarded outward.
- Ghost accounts. A contractor finished in March and could still sign in at Christmas.
The OWASP Top Ten remains the clearest free summary of the application side, and broken access control has sat at the top of it for years. That ranking is not an accident.
Which controls pay for themselves first?
Enforce phishing resistant multi factor authentication, use single sign on for every tool that supports it, review connected applications quarterly, and automate offboarding. Those four cost very little and remove most of the realistic attack paths. Everything else is refinement.
Here is the controversial part. Security awareness training is oversold. People still click, because clicking is their job. Spend the money on hardware keys and conditional access instead, and design systems that survive a mistaken click.
Where you go next depends on your data. Firms holding regulated records should read NIST Special Publication 800-207 on zero trust architecture, then apply the parts that fit rather than the whole framework at once.
What do SOC 2 and ISO 27001 really prove?
They prove a vendor documented controls and an auditor checked them against a defined scope. They do not prove the product is secure, and they say nothing about how you configure it. A SOC 2 Type 2 report covering a period is meaningfully stronger than a Type 1 snapshot.
Ask for the actual report rather than the badge on the marketing page. Read the scope section and the list of exceptions. A vendor that hesitates to share either has told you something useful.
How should you vet a vendor before signing?
Ask six questions and judge the answers by their specificity. Where is data stored. Is it encrypted at rest and in transit. How is my tenant separated from others. What is the breach notification window in hours. Can I export everything without help. Who are your subprocessors.
Tenant separation deserves particular attention, because it is the risk unique to shared platforms. Our explainer on multi-tenant software covers how that isolation works and where it strains. Data location matters for regulated sectors, and how SaaS stores user data goes deeper on residency.
What does SaaS sprawl cost you?
Sprawl means tools bought by teams without central oversight. A company of fifty people commonly runs well over a hundred SaaS accounts. Each one holds data, issues credentials, and expands the surface an attacker can reach. Most of them are invisible to whoever is meant to be protecting the company.
Start with discovery, not policy. Export the list of approved applications from your identity provider and the expense report from finance. The gap between those two lists is your actual risk register, and it is usually longer than anyone expects.
How much should security cost?
For a small team, far less than vendors imply. Hardware security keys cost roughly 30 dollars per person once. Business identity tiers with conditional access run about 6 to 12 dollars per user per month. Dedicated posture management tools start around 4 dollars per user per month and are hard to justify below a hundred staff.
Prices are as of September 2026 and move constantly, so confirm with the vendor. The honest sequence is identity first, backup second, monitoring third. Buying monitoring before identity is like installing an alarm and leaving the door open. Backup belongs in that list too, which is why SaaS data backup is a security topic and not a storage one.
What should you do in the first thirty days?
Do five things in order. List every application in use. Turn on multi factor authentication everywhere it exists. Revoke third party app grants nobody recognises. Remove accounts for people who have left. Confirm you hold an independent backup of your two most critical systems.
None of that requires a new product or a consultant. It requires an afternoon and someone with administrative access who is willing to be unpopular for a week. If you also run public facing systems, pair this with the operational side covered in how SaaS handles system downtime and our ongoing website maintenance work.
What should you read next?
- How SaaS hosting works
- Compliance tracking software for GDPR and CCPA
- What is SaaS uptime
- Case study: Lattice website security and uptime
Frequently asked questions
Is SaaS more secure than software installed on our own servers?
The infrastructure usually is, because large providers patch faster and hire specialists most firms cannot. Your overall risk may still rise, because access moves to the open internet and configuration becomes your job. The platform gets safer while the way you use it gets riskier.
What is the single most valuable control to enable first?
Phishing resistant multi factor authentication on your identity provider. It blocks the credential attacks that cause most incidents, and hardware keys cost around 30 dollars per person once. Enable it on email and your identity provider before anything else.
Does a SOC 2 report mean a vendor is safe to use?
It means an auditor tested described controls within a defined scope during a defined period. Ask for the full report rather than the badge, then read the scope and exceptions sections. A Type 2 report covering several months carries far more weight than a Type 1 snapshot.
Who owns the data we put into a SaaS product?
You do, in almost every reputable contract, but ownership and access are different things. Check the export terms, the deletion timeline after cancellation, and whether export includes attachments and history. Test the export while you are still a paying customer.
How often should we review connected third party apps?
Quarterly is enough for most organisations, and it takes under an hour. Open the third party access page in your identity provider, revoke anything unrecognised, and note what broke. Almost nothing breaks, which tells you how much of that access was unnecessary.
Do we still need our own backup if the vendor has redundancy?
Yes. Redundancy protects against hardware failure, not against deletion, malicious insiders or a compromised admin account. Vendor recycle bins are controlled by the same credentials an attacker would target. Keep an independent copy of anything you cannot rebuild.
What should a small company do about SaaS sprawl?
Start with discovery rather than a policy nobody reads. Compare the application list in your identity provider against card spending from finance. The difference is your unmanaged surface, and consolidating even five overlapping tools reduces both cost and risk.
Need a hand shipping this?
Our team builds high-traffic platforms for fintech, commerce and SaaS.
