SaaS (Software as a Service)

SaaS stands for Software as a Service. The US standards body NIST, in its definition of cloud computing (SP 800-145, 2011), describes SaaS as the capability to use the provider's applications running on a cloud infrastructure. The customer does not manage servers, network, operating system or the application itself, apart from user-specific settings.

The model took off with fast internet access. One of the pioneers was Salesforce, founded in 1999, which sold CRM through the browser under the slogan "No Software". Today SaaS is the norm: most new business applications are sold as a subscription rather than a boxed licence.

SaaS is one of three basic cloud service models. They differ in how much the vendor manages and how much is left to you:

• IaaS (Infrastructure as a Service): you rent computing power, storage and networking. The operating system, database and applications are your job. Example: virtual servers in Azure, AWS or Google Cloud.
• PaaS (Platform as a Service): the vendor manages servers and the runtime, and you deploy your own application on the platform. Used mainly by developers.
• SaaS (Software as a Service): you get a finished application. You look after your data, users and settings only.
• On-premise: software installed on your own computers or servers. Everything from hardware to updates is up to you.

Even with SaaS, responsibility does not move entirely to the vendor. Microsoft's shared responsibility model is clear on this: data, devices, user accounts and access always remain the customer's responsibility. A weak password without two-factor authentication is your risk, not the vendor's.

Advantages:

• Fast start with no installation and no servers of your own.
• Low upfront cost: a monthly plan instead of a licence costing thousands of euros.
• The vendor rolls out updates and security patches automatically.
• Access from anywhere with an internet connection, and adding users takes minutes.
• Most SaaS tools offer an API, so they can be connected to other tools and automated.

Disadvantages:

• The subscription never stops. After a few years the total may exceed a one-off licence or a custom application.
• The vendor decides the features. If your process does not fit their logic, you are the one who adapts.
• Vendor dependency: a price change, an outage or a discontinued service hits you directly.
• Your data sits with a third party, which affects GDPR compliance and how easily you can get it out.

For routine work such as email, invoicing, accounting or document sharing, SaaS is almost always the better choice. These processes look similar in most companies, and an off-the-shelf tool handles them faster and more cheaply than anything you could develop.

A custom web application makes sense where the process is your competitive advantage, or where you would otherwise combine three SaaS tools and retype data between them. A practical middle path is common: connect existing SaaS tools through automation (see our comparison n8n vs Zapier vs Make) and start any custom development with a small MVP.

1. Total cost: calculate costs over 3 years including all users, higher plans and add-ons. Per-user pricing grows with your company.
2. SLA and availability: find out what uptime the vendor guarantees in its service level agreement (SLA). 99.9% per month still allows roughly 43 minutes of downtime a month.
3. Personal data: a SaaS vendor acts as a data processor, so you need a data processing agreement under Article 28 of the GDPR. Also check where the data is stored (inside or outside the EU).
4. Data export: test whether everything can be exported in a machine-readable format (CSV, JSON, via API). Without it, leaving the vendor becomes expensive.
5. Backups: find out how long the vendor keeps deleted data and whether you can run your own backups.
6. Security and access: two-factor authentication, user roles and permissions, sign-in with a company account.
7. Integrations: does the tool have an API or ready-made connections to your accounting, online shop and CRM?

Since 12 September 2025 the EU Data Act (Regulation (EU) 2023/2854) has applied, and it covers SaaS providers too. A customer can request a switch with a maximum notice period of two months, and the switch itself, including data transfer, should normally be completed within 30 days. The provider must not obstruct the switch and must publish its procedure and data formats.

Switching charges are currently limited to the provider's actual costs, and from 12 January 2027 they are banned altogether. Fixed-term contracts and early termination fees may still exist, so read the terms before you sign.

Outside help pays off when you are choosing a core system such as an ERP or CRM, when your SaaS tools no longer fit and data is retyped between them by hand, or when you are considering a custom application. At Weboptim we start by mapping your process and then recommend what an off-the-shelf SaaS covers, what is worth automating and where custom web application development makes sense.