You’ve seen the term everywhere and want to know what is SaaS. In short, it is software you use through a browser or program interface while the provider runs the infrastructure underneath.
This guide is part of our wider look at technology in business, and it sticks to plain-language definitions.
| Item | Value |
|---|---|
| Reference definition | NIST SP 800-145, “The NIST Definition of Cloud Computing” |
| Date published | September 2011 |
| Essential characteristics of the cloud model | Five |
| Service models in the cloud model | Three |
| Deployment models in the cloud model | Four |
| What a SaaS user does not manage | The underlying network, servers, operating systems and storage |
These figures come from NIST’s publication page for SP 800-145 and its glossary entry for software as a service. Sources can be revised, so check them before you rely on the figures.
SaaS in plain language
With software as a service, you don’t install and run the program on servers you look after yourself. You reach the provider’s application over a network, most often in a web browser. The definition used throughout this guide even names web-based email as its example of a browser interface.
The simplest way to picture it is a division of labour. The provider keeps the application running on its cloud infrastructure, and you use it.
- You use the provider’s application rather than running your own copy.
- You reach it from various client devices, through a browser or a program interface.
- You don’t manage the network, servers, operating systems or storage behind it.
That split is the heart of the answer. Everything else people say about SaaS is a consequence of it.
How NIST defines SaaS
A clear reference point is the document The NIST Definition of Cloud Computing, written by Peter Mell and Tim Grance and published in September 2011, according to NIST’s publication page. NIST’s glossary then carries the SaaS wording from that document.
The definition has two halves. First, the capability given to the consumer is to use the provider’s applications running on a cloud infrastructure, reached from client devices through a thin client interface such as a web browser or through a program interface.
Second, the consumer does not manage or control the underlying cloud infrastructure. That covers network, servers, operating systems, storage and even individual application capabilities. The one possible exception is limited user-specific application configuration settings, so you can still adjust the things that are yours, such as your own preferences.
Because that text dates from September 2011, treat it as a definition of the idea rather than a description of any one product on the market today. Provider documentation tells you what a specific tool actually does.
Where SaaS fits in cloud computing
NIST describes cloud computing as a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources. Those resources include networks, servers, storage, applications and services. The model is composed of five essential characteristics, three service models and four deployment models, as the NIST publication page summarises.
SaaS is one of the service models. The publication’s keyword list places SaaS next to PaaS (platform as a service) and IaaS (infrastructure as a service), which are the other service-model names you will meet when people discuss cloud services.
The same keyword list names several of the cloud model’s characteristics. You will often see these terms in vendor material:
- On-demand self service, where you can get what you need without a long hand-off.
- Rapid elasticity, where capacity can grow or shrink with demand.
- Measured service, where usage can be metered.
The publication itself gives the formal wording, so read it if you need precise definitions rather than these shorthand descriptions.
What you manage and what the provider manages
In SaaS the line between your job and the provider’s job sits high up the stack. The provider covers the technical layers, and you focus on how the tool is used in your work.
- Provider side: the cloud infrastructure, network, servers, operating systems, storage and the application’s own capabilities.
- Your side: using the application, adjusting the limited user-specific settings it allows, and deciding who gets access and what information goes in.
That last point is advice rather than part of the definition, but it matters in practice. If the provider hosts the application, your data still needs a plan of its own, and our guide on how to create a data backup plan is a sensible next read.
Questions to ask before you pick a SaaS tool
The NIST definition explains what SaaS is, but it says nothing about price, contracts or security terms. Those details come from each provider, so ask before you commit.
- What job must the tool do, and who will use it every day?
- Can people reach it from the devices they already use?
- Which settings can you change yourself, and which are fixed by the provider?
- Can you take your data with you if you decide to leave?
- What does the provider’s own documentation say about where data is held and how it is protected?
If you are comparing one category in particular, our walkthrough on how to choose project management software applies the same thinking to a common SaaS purchase.
Frequently asked questions
Is SaaS the same as cloud computing?
Show answer
No. In NIST’s framing, SaaS is one of the service models inside the wider cloud computing model, alongside platform and infrastructure as a service.
Do I have to install anything to use SaaS?
Show answer
Not necessarily. The NIST definition says the applications are accessible through a thin client interface such as a web browser, or through a program interface. What a given product requires is up to its provider.
Do I control the servers behind a SaaS tool?
Show answer
No. Under the NIST definition the consumer does not manage or control the underlying infrastructure, with the possible exception of limited user-specific application configuration settings.
Is the NIST definition still accurate?
Show answer
The text was published in September 2011, per NIST’s publication page. It describes the core idea well, but check each provider’s current documentation for the details of any product.
