What Is SaaS (Software as a Service)?

SaaS Under the Hood: The Full Stack and the Real Costs

Let's dig into the technical architecture behind SaaS and the business realities that the marketing pages don't mention.

SaaS vs. PaaS vs. IaaS: The Cloud Stack

SaaS is just the top layer of a three-tier cloud model:

• IaaS (Infrastructure as a Service) — The foundation. You rent raw computing resources: virtual servers, storage, and networking. You manage everything on top of that — the operating system, the software, the security. Examples: AWS EC2, Google Compute Engine, DigitalOcean. This is what developers use to build things from scratch.
• PaaS (Platform as a Service) — The middle layer. You get a platform to build and run applications without managing the underlying infrastructure. The provider handles servers, networking, and scaling. You just write code and deploy. Examples: Cloudflare Workers, Heroku, Google App Engine. This is what powers many modern web applications.
• SaaS (Software as a Service) — The top layer. Everything is managed for you. You just use the software. Examples: Gmail, Slack, QuickBooks. This is what most business users interact with.

As a business owner, you mostly care about SaaS. But understanding the stack helps you understand what your developer means when they talk about where your website lives. A site on Cloudflare Pages, for example, runs on Cloudflare's infrastructure (IaaS) using their platform (PaaS) — and you interact with it as a service (SaaS).

Multi-Tenancy: Sharing Without Knowing

Most SaaS applications use a multi-tenant architecture — meaning your data and other customers' data live on the same servers and often in the same database. Your account is logically separated, not physically separated.

Think of it like an apartment building. Everyone has their own unit, but you share the building structure, the plumbing, and the electrical system. You can't see into other apartments, but you're all in the same building.

This is how SaaS companies keep costs low — sharing infrastructure is much cheaper than giving each customer their own server. But it means:

• A bug in the application could theoretically expose data between tenants (rare, but it has happened)
• Performance for one customer can be affected if another customer is using excessive resources (called the noisy neighbor problem)
• You're trusting the vendor's security practices to keep your data isolated

Data Portability and Vendor Lock-In

Vendor lock-in happens when switching away from a SaaS tool is so difficult that you feel trapped, even if the service isn't great anymore. Common lock-in tactics:

• Proprietary formats — Your data is stored in a format that only works with their tool
• No export options — Or export options that only give you a partial, mangled version of your data
• Workflow dependencies — Your business processes are so intertwined with the tool that switching would require redesigning everything
• Integration ecosystems — You've built connections between this tool and five others, and those integrations only work with this vendor

How to protect yourself:

• Before adopting a tool, test the export feature. Download your data and see if it's usable.
• Prefer tools that use open or standard formats
• Keep your own backups of critical data, independent of the SaaS provider
• Document your workflows so they can be replicated in another tool

SOC 2 Compliance: What It Actually Means

When a SaaS company says they're SOC 2 compliant, it means an independent auditor has verified their security controls meet certain standards. SOC 2 covers five areas:

1. Security — Is the system protected against unauthorized access?
2. Availability — Does the system meet its uptime commitments?
3. Processing integrity — Does the system process data correctly?
4. Confidentiality — Is confidential information properly protected?
5. Privacy — Is personal information handled according to the company's privacy policy?

SOC 2 doesn't guarantee a company won't get breached, but it means they take security seriously enough to pay for an independent audit. When evaluating a SaaS tool that will handle sensitive business data, ask for their SOC 2 report.

SaaS Sprawl: The Hidden Cost

Here's a sobering number: the average small business uses over 40 SaaS tools. And many of those were adopted ad-hoc — different employees signing up for different tools without coordination.

The result is SaaS sprawl:

• Redundant tools doing the same thing (one team uses Asana, another uses Monday.com)
• Orphaned subscriptions nobody uses anymore but still gets billed for
• Data scattered across dozens of platforms with no central management
• Security risks from forgotten accounts with old passwords

How to fight it:

• Audit your SaaS subscriptions quarterly. Check what you're paying for and whether it's still being used.
• Centralize purchasing — one person approves new tool subscriptions
• Use a SaaS management tool like Torii or Productiv if your stack gets large
• Consolidate where possible — choose platforms that handle multiple needs

Self-Hosted Alternatives

For some tools, self-hosting is an option. Instead of paying a monthly subscription, you run the software on your own server:

• Nextcloud instead of Google Drive/Dropbox
• Plausible or Umami instead of Google Analytics
• Ghost instead of Substack or Mailchimp for newsletters
• Mattermost instead of Slack

Self-hosting gives you complete data ownership and no per-user fees. The tradeoff: you're responsible for updates, security, backups, and uptime. For most small businesses, the SaaS version is the right call. But if data sovereignty is a priority or you have the technical ability, self-hosting is worth considering.

Want help auditing your SaaS stack or evaluating new tools? Reach out to us — we'll help you find the right balance between capability and cost.