SaaS (Software as a Service) is software you use over the internet instead of installing on each computer. If your business runs on Microsoft 365 or QuickBooks Online, you're already using it, whether or not anyone called it that.
SaaS is one of those acronyms that sounds more complicated than the idea behind it. Here is what it means, how it changed the way businesses buy and manage software, and what it means for your security and backups.
Software as a Service. The vendor hosts the software and delivers it over the internet. You reach it through a browser or a lightweight app instead of installing it on each machine from a disc or download.
Before SaaS, you bought a license, installed the software on each computer and managed updates yourself. When a new version came out, you bought it again. When your server died, nobody could use the software until it was restored. Every new hire meant another installation.
With SaaS, the software runs on the vendor's servers. You pay a subscription, usually per user per month, and anyone with credentials and an internet connection can use it from any device. Updates happen automatically, the vendor keeps its own infrastructure redundant, and adding a user takes a few clicks in an admin console. That's why so much business software has moved from one-time purchases to monthly subscriptions.
SaaS made some things simpler and others more complicated.
Simpler: no local servers to maintain for those applications, no manual patching, easier scaling up or down, and access from anywhere, which helps remote and multi-location teams.
More complicated: your data now lives with several vendors instead of one place you control, and security settings differ on every platform. "The vendor handles security" is only partly true.
This is called the shared responsibility model. The SaaS vendor handles physical security, infrastructure uptime and the security of the application itself. You handle who can sign in, what permissions they have, how sharing is configured and what happens to the data inside. Many SaaS data exposures come from the customer side: overly open sharing settings, weak passwords or no multi-factor authentication (MFA).
One of the most common misunderstandings in small business IT is "it's in the cloud, so it's backed up." Not necessarily. Most SaaS vendors protect against their own infrastructure failing. They generally don't protect you from accidental deletion, a departing employee wiping files, ransomware that syncs into cloud storage, or data lost when an account is closed. Backing up your data remains your responsibility.
Microsoft 365, for example, keeps deleted items for a limited window, which is not a substitute for a real backup. NerdSquad recommends a dedicated SaaS backup for any business-critical cloud application, especially where HIPAA or financial recordkeeping rules require you to retain data. Our backup and disaster recovery service can include cloud applications as well as on-site systems, and our BDR and BCDR explainer goes into more detail.
Because signing up for a SaaS tool takes two minutes and a credit card, many businesses end up with "shadow IT": employees adopt a project management app here and a file-sharing service there, and business data ends up in platforms nobody is managing or auditing.
For businesses that handle sensitive data, that is a real concern. Data in unvetted tools may not meet the security or contract requirements your industry expects, such as a Business Associate Agreement for patient information. Knowing which tools are in use, which are approved and which should be shut down is a normal part of IT governance.
NerdSquad Managed IT Services is a Managed Service Provider (MSP), and managing SaaS is part of our managed IT services. We inventory what's in use, apply single sign-on (SSO) and MFA across business-critical platforms, configure sharing and access settings, and make sure backup coverage exists where the vendor's built-in retention falls short. For healthcare and financial services clients, we also check that any tool touching regulated data has the right Business Associate Agreement or data processing terms in place.
Already a client? Call (239) 465-0079 or submit a ticket. If something is down, call so we can start right away.
Not a client yet? NerdSquad Managed IT Services is a Managed Service Provider (MSP) based in Naples, Florida. We support businesses onsite across Southwest Florida and remotely nationwide. Book a discovery call or call (239) 465-0079.
Related: Microsoft 365 support