Definition
Software as a service (SaaS) is a delivery model in which a provider runs an application on cloud infrastructure and customers use it over the internet, usually in a web browser. The provider handles servers, updates and operations. Customers manage only their own users, data and settings. They usually pay on a recurring basis.
Key takeaways
- With SaaS, the provider runs one shared version of the software for all customers. Custom versions for single customers don’t fit the model.
- An MVP is the version that teaches you the most about your customers for the least effort. Business customers still need it to be reliable.
- SaaS is above all a business model: recurring payments fund the product as long as customers stay. Pricing and metrics belong in your plan.
- Decide on tenant isolation early. A login with roles doesn’t by itself stop users from seeing other customer companies’ data.
- Customers in Germany choose cloud providers mainly on security and data protection. Many also check the provider’s origin and data location.
How does SaaS work?
With SaaS, the provider runs the application, including servers, database and updates, and makes it available over the internet. Customers work in a web browser or connect their own software through an API. Each customer company is a tenant with its own users and data. All of them use the same version and usually pay on a recurring basis.
Under the definition from the US National Institute of Standards and Technology (NIST), SaaS customers use a provider’s applications that run on cloud infrastructure (NIST, September 2011). They don’t control the network, servers, operating systems or storage, or even individual features of the application. They’re left with limited settings for their own users.
Germany’s Federal Office for Information Security (BSI) based its earlier definition on NIST’s and now uses the ISO/IEC 22123 standard (BSI, as of Sep 18, 2024). The various definitions are similar in most cases but differ in the details, the BSI notes. For SaaS, it sums up that the customer hands practically all control over to the provider.
An API (application programming interface) is a defined way for programs to exchange data. Your accounting software, for example, can pull invoices from a SaaS application without anyone having to retype them.
What are the essential characteristics of SaaS?
NIST lists five essential characteristics of cloud services. Applied to SaaS, they mean:
- On-demand self-service: Customers set up accounts and resources themselves, without anyone at the provider having to step in.
- Broad network access: The application works on many kinds of devices, from smartphones to workstations.
- Resource pooling: Many customers share the provider’s infrastructure. They usually don’t know exactly where their data is. But they can often specify the location at the level of a country or data center.
- Rapid elasticity: Capacity grows and shrinks with demand, sometimes automatically.
- Measured service: The system measures consumption, such as storage or active user accounts. Billing can be based on that.
The ISO/IEC 22123 standard used by the BSI lists multi-tenancy as a separate characteristic. It means that the processes and data of different tenants are separated and inaccessible to each other (BSI, as of Sep 18, 2024).
How is SaaS different from hosted software?
Software isn’t SaaS just because a service provider hosts it. When a provider runs a separate installation for each customer, often in different versions, AWS calls that a managed service (AWS, Aug 3, 2022). With SaaS, the provider onboards, manages and bills all customers through the same shared processes and rolls out new versions to all of them at once. AWS rules out one-off customizations for individual customers.
Dedicated servers for a single customer are still possible. AWS also counts a separate environment per customer as SaaS, as long as all customers are managed through the same services and run the same version.
The BSI’s examples of SaaS are contact management, financial accounting, word processing and collaboration apps. The example in the NIST definition is web-based email.
How does SaaS differ from IaaS, PaaS and on-premises software?
The models differ in how much you run yourself. With on-premises software, everything runs on servers at your own site. With IaaS, you rent computing power, storage and networks. With PaaS, you rent a platform for your own applications, and with SaaS, the finished application. In every model, you remain responsible for your data, users and settings.
IaaS stands for infrastructure as a service, and PaaS for platform as a service. Together with SaaS, they’re the three service models of cloud computing (NIST, September 2011). The table summarizes how NIST, the BSI and Microsoft describe them.
| Model | What the provider supplies | What you control | Examples | Sources |
|---|---|---|---|---|
| On-premises | the software to install, but no operations | the whole stack, from the data center to the application | software on servers at your own site | 4 |
| IaaS (infrastructure as a service) | computing power, storage and networks | operating systems, storage and applications, sometimes network components such as firewalls | virtual servers, storage space, virtual networks | 1, 2, 4 |
| PaaS (platform as a service) | a platform with programming languages, libraries and services for your own applications | your own applications and their settings | environments for web apps, databases as a service | 1, 2, 4 |
| SaaS (software as a service) | the finished application, including operations | users, data and limited settings | web-based email, financial accounting, collaboration apps | 1, 2, 4 |
Microsoft shows in more detail who is responsible for what in its own cloud services (Microsoft, Aug 24, 2026). In every model, data, accounts and settings remain the customer’s responsibility. Microsoft explicitly calls the overview “illustrative guidance” that doesn’t change any contract terms. Where the lines fall with your provider is set out in its contract.
| Area | On-premises | IaaS | PaaS | SaaS |
|---|---|---|---|---|
| Customer data | You | You | You | You |
| Configuration and settings | You | You | You | You |
| Identities and users | You | You | You | You |
| Client devices | You | You | You | Shared |
| Applications | You | You | Shared | Shared |
| Network controls | You | You | Shared | Provider |
| Operating system | You | You | Provider | Provider |
| Physical servers | You | Provider | Provider | Provider |
| Physical network | You | Provider | Provider | Provider |
| Data center | You | Provider | Provider | Provider |
Is custom software the opposite of SaaS?
No, the two terms answer different questions. Custom software describes whom the software is built for: a single client. SaaS describes how it’s delivered: as a service that the provider runs for many customers together. That gives four combinations.
| Who runs it | Built for many customers | Built for one client |
|---|---|---|
| A provider runs it as a service | SaaS, such as accounting software in the browser | custom software that a service provider runs for you |
| You run it yourself | off-the-shelf software that you install | custom software on your own servers or in your own cloud account |
For your own internal processes, first ask whether an existing SaaS product will do. Our comparison Build vs. buy software weighs the options. Our page on custom business software covers software for your back office, and our page on customer portals covers portals for your own customers. You build your own SaaS product when you want to sell the same software to many companies as a service.
How do you build a SaaS product, from idea to MVP?
A minimum viable product (MVP) is the version of a new product that lets you learn the most about your customers with the least effort. You get there through conversations with potential customers, a clearly limited core feature, a prototype you can show and an architecture that keeps customer companies’ data separate from the start.
Eric Ries defined the term in 2009: an MVP allows a team to “collect the maximum amount of validated learning about customers with the least effort” (Ries, Aug 3, 2009). Despite the name, Ries writes, an MVP “is not about creating minimal products.” For SaaS aimed at business customers, we take this to mean that the MVP solves one task reliably enough for early customers to work with it and pay for it.
What are the steps to build a SaaS MVP?
The development process for a SaaS MVP has seven steps:
- Validate the problem. Talk to potential customers before you have any code written. Ask which task costs them time or money today and how they deal with it now.
- Define the core feature. Describe the one task the MVP solves for one target group. Everything else goes on a list for later. Our how-to on writing a software requirements specification shows how to write it down.
- Sketch the pricing model. Decide what customers will pay for. That determines what the software has to count and bill. The section What business models are common in SaaS? describes the usual models.
- Show a prototype. A clickable prototype shows the user flows before anything is programmed. Show it to the same people you spoke with in the first step. Our article What is vibe coding? explains when a prototype written by an AI is good enough.
- Decide on the architecture. Now settle the tenancy model, login, billing, data export and data locations, as described in the section How is a SaaS application structured?
- Build in short cycles. Ask to see the latest version every week. Make sure the code is in your own repository (where your source code lives) from the start. What else keeps you independent is covered in our how-to Avoiding developer lock-in.
- Launch with your first customers and measure. Track revenue, cancellations and usage, and expand what customers actually use. If you took deliberate shortcuts to launch, our article on technical debt shows when cleaning them up pays off.
Our SaaS development page explains how we start these steps with a discovery sprint.
What should a SaaS MVP for business customers include?
The table shows our assessment. It follows from the shared services every SaaS product needs to manage its customers (the control plane, described below) and from the questions business customers ask before they buy.
| Area | From the start | Can wait |
|---|---|---|
| Tenants | separate data for each customer company, verified with dedicated tests | a separate environment for individual large customers |
| Login | accounts and roles for customers and for your team | login through the customer company’s own system (single sign-on) |
| Billing | fixed plans, invoicing through a payment provider | usage-based pricing, rule-based discounts |
| Data | export of each customer’s own data, backups with tested restores | integrations with other systems |
| Operations | logs, monitoring, updates for all customers at once | per-tenant reports, self-service sign-up |
What drives the cost of a SaaS MVP?
The cost depends mainly on the scope, so we don’t give any figures here. The main price drivers are the number of roles and core features, the billing model and the tenancy model. Other factors are integrations with other systems, migrating existing data, the security and data protection evidence your customers ask for and the languages of the user interface.
After launch, you’ll have ongoing costs for hosting, for services such as email delivery and payment processing, and for maintenance and further development. Don’t budget too tightly for them. In the Cloud Report 2026 by the German digital industry association Bitkom, 64% of companies using cloud services said their cloud operating costs rose in 2025 (Bitkom, Sep 30, 2026).
Market prices in euros and worked examples are in our cost guide SaaS development cost, and costs for software in general in Custom software cost. The pricing section of our SaaS development page explains how we arrive at a fixed price for your MVP.
What do you need besides the software?
- Contracts: Terms of use, a service description that covers availability and support, and your data protection documents. Have a lawyer review them.
- Operations: Decide who responds to incidents, who answers customer questions and how you announce updates.
- Sales: A product website explains who the software is for, what it costs and how to try it. Our page on website development shows how we build such websites.
Availability belongs in the service description because customers look for it. Of the companies that use or are considering cloud services, 91% call performance and stability a must-have when choosing a provider (Bitkom, Sep 30, 2026).
What business models are common in SaaS?
A SaaS product usually bills on a recurring basis, by subscription or by usage. Common pricing models are a flat rate per plan, a price per user, tiered pricing by volume and usage-based pricing. You can combine them. Which model fits depends on what your customers measure the value by: the number of users, transactions or the feature set.
AWS sees SaaS as a business model first and a technology question second (AWS, Aug 3, 2022). The architecture is meant to support goals such as responding quickly to the market, operating efficiently and onboarding new customers without friction. Being multi-tenant without reaching those goals would undermine the success of a SaaS product, AWS writes.
The classification of pricing models follows the documentation of the payment provider Stripe, which supports these models in its billing product (Stripe, pricing models). Stripe lets you combine tiered pricing with flat rates (Stripe, tiered pricing) and offer free or discounted trials (Stripe, trials). The column “Good fit when” reflects our assessment.
| Model | How you bill | Good fit when (our assessment) | Sources |
|---|---|---|---|
| Flat rate per plan | customers choose a tier, such as Basic or Pro, and pay a fixed amount for it | usage is similar across customers and you want a simple offer | 5 |
| Per-user pricing | each user or license costs the same amount | the value grows with the number of users, as with team tools | 5 |
| Tiered pricing | the unit price changes with quantity or usage | large customers should pay less per unit | 5, 6 |
| Usage-based pricing | a base fee plus overage, pure pay-as-you-go or prepaid credits | your own costs rise with every transaction, as with sending messages or AI features | 5 |
| Trial | free or discounted for a set period, then a regular plan | customers only see the value once they use it in their daily work | 7 |
Which metrics show whether a SaaS product is viable?
In our assessment, four metrics are enough to start with. Stripe defines them in its billing analytics as follows (Stripe, metrics):
- Monthly recurring revenue (MRR): The sum of all active subscriptions, normalized to one month. Taxes, free plans and usage-based components don’t count.
- Average revenue per user (ARPU): MRR divided by the number of active, paying subscribers.
- Churn: Subscribers whose MRR drops to zero, most often because they cancel.
- Lifetime value (LTV): ARPU divided by the churn rate. Stripe itself calls the figure an estimate.
Track these figures every month, starting with your first paying customer. That way, you’ll see early on whether new customers make up for cancellations.
Is SaaS only for startups?
No. Many established companies also sell their own services in the cloud. In Bitkom’s Cloud Report 2026, 22% of the companies surveyed, all with at least 20 employees, offer their own products or services wholly or partly as cloud services. Another 23% plan to (Bitkom, Sep 30, 2026). One possible starting point is an internal tool that other companies in your industry could use too.
How is a SaaS application structured?
Technically, a SaaS product has two parts: the application your customers work with and a control plane you use to onboard customers, sign in users, handle billing and monitor operations. Decide early on tenant isolation, meaning how you keep customer companies’ data apart. Switching to a different model later can be expensive.
AWS divides a SaaS environment into two planes (AWS, Aug 3, 2022). The application plane holds everything your customers see and use, including the business logic and data. The control plane holds the services you use to manage all tenants together:
- Onboarding: Creates the tenant, users, isolation policies and resources, through self-service sign-up or by your team.
- Tenant management: Stores the settings and status of each customer company. A tenant usually has many users.
- Identity: Links each user to their tenant. After sign-in, the token carries both the user’s identity and the tenant’s identity.
- Billing: Records usage and activity and generates invoices from them, either directly or through an external billing provider.
- Metrics: Show how tenants use the system and which resources they consume.
- Admin user management: Separate accounts for your administrators, alongside the customer accounts.
For moving existing software to SaaS, AWS advises putting these shared services in place first, even if they don’t yet have every feature. In our view, the same applies to a new MVP.
How do you keep each customer’s data separate?
AWS describes two basic forms. In the silo model, a tenant gets dedicated resources, such as its own data store. In the pool model, tenants share a resource, and a tenant ID assigns each record to its tenant. The two can be mixed: customers on a basic plan share an environment, while customers on a higher plan get their own (AWS, Aug 3, 2022).
Microsoft advises choosing the tenancy model carefully, because it shapes how the application is designed and managed, and switching later is “sometimes costly” (Microsoft, Aug 21, 2025). Our explainer Multi-tenant SaaS compares the models with their costs, advantages and drawbacks.
Why isn’t a login enough?
A login with roles establishes who someone is and what they’re allowed to do. It doesn’t by itself stop a signed-in user from retrieving another customer company’s data. That’s why AWS treats tenant isolation as a separate layer of protection on top of authentication and authorization (AWS, Aug 3, 2022).
Broken access control had the most occurrences in the data behind the OWASP Top 10:2025 and ranks first on the list. Every application tested showed some form of it (OWASP, 2025). A typical case: someone changes an ID in a request and sees other people’s records. So have the isolation verified with dedicated tests before the second customer company enters its data.
Which decisions come before the first line of code?
| Decision | Why early | Sources |
|---|---|---|
| Tenancy model | It shapes the design, operations and cost per customer. Switching later can be expensive. | 3, 10 |
| Identity and roles | Every request needs a user and a tenant. Logging, billing and data isolation build on that. | 3 |
| Billing and metering | The pricing model determines which usage the software has to count. | 3, 5 |
| Data export and APIs | For 37% of the companies surveyed, easy switching between providers is a must-have. Lock-in effects such as difficult data exports are the biggest obstacle to switching. | 9 |
| Data locations and service providers | For 57% of the companies surveyed, the location of the data centers is a must-have. Plan where your database, backups and logs will be stored. | 9 |
| One version for everyone | Updates go to all customers at once. Handle special requests through settings, not separate versions. | 3 |
The section What matters for SaaS in Germany and the EU? covers the legal questions on data export and data locations that you should clarify.
What matters for SaaS in Germany and the EU?
In 2025, just over half of companies in Germany with 10 or more employees used paid cloud services (Destatis, Nov 24, 2025). When choosing a provider, companies look mainly at security and data protection. Many also look at the provider’s origin and location. Clarify with an IT lawyer which legal obligations apply to your SaaS product.
How widely is SaaS used in Germany?
Just over half (54%) of companies in Germany with at least 10 employees used paid cloud services in 2025, according to Germany’s Federal Statistical Office (Destatis, Nov 24, 2025). The figure was 51% for small companies with 10 to 49 employees and 65% for mid-sized companies with 50 to 249 employees. Companies with cloud services use them most often for email, data storage and office applications. ERP and CRM software are comparatively rare as cloud services, at 23% each.
Across the EU, 52.74% of enterprises used paid cloud services in 2025. Of these, 96.44% bought at least one SaaS application, and 77.25% also bought infrastructure as a service (Eurostat, January 2026).
Among startups founded in Germany in 2025, software was the largest sector, with 853 of 3,568 (Startup-Verband, January 2026). The report doesn’t say how many of them offer SaaS.
What do customers in Germany expect from a cloud provider?
In the Cloud Report 2026, 95% of companies that use or are considering cloud services call trust in IT security, data protection and compliance a must-have when choosing a provider. The provider’s country of origin is a must-have for 61%, the location of the data centers for 57% and easy switching for 37%. The country of origin plays a role for 98% (Bitkom, Sep 30, 2026).
Of the companies for which origin matters, 91% would prefer providers from Germany and 68% providers from the EU. In practice, fewer use them: of all companies that use or are considering cloud services, 53% work with providers from Germany and 45% with providers from the EU. Among companies that use cloud services, 59% name lock-in effects, such as difficult data exports, as the biggest obstacle to switching (Bitkom, Sep 30, 2026). For a new SaaS product aimed at companies in Germany, we conclude: be ready to answer questions about your origin, data locations and data export clearly before the first sales call.
Which data protection questions should you be ready to answer?
Before your first sale, prepare written answers to these questions: Who processes which data on whose behalf? Which other service providers are involved? Where is the data stored, and how is it backed up and deleted? Clarify with an IT lawyer which contracts and obligations follow from this.
What if a customer wants to switch providers?
Plan data export and APIs from the start, so customers can take all their data with them and move to another provider. Before launch, check with a lawyer whether and how the EU Data Act applies to your SaaS product.
Where should the data be stored?
With cloud services, customers can often specify the storage location in the contract, such as a region, country or data center (BSI, as of Sep 18, 2024). Settle this separately for each part of your SaaS product: database, files, backups, logs, email delivery and support. In our view, an EU-based provider is a good start. Even so, you should know any exceptions, such as a globally distributed network for name resolution, and state them openly. The section From our work shows what this looks like for our own website.
This section is not legal advice. As of November 2026.
From our work: data locations and service providers at datafalke.de
For datafalke.de, we’ve published which service providers process data on our behalf, where that happens and how long data is kept. Hosted by an EU-based provider, stored in Frankfurt, delivered via a CDN. Our website has no user accounts. Even so, the questions about data locations and service providers are the same as for a SaaS product. The details are in the hosting section of our colophon and in our privacy policy.
| Data path | How it works at datafalke.de | What this means for your SaaS product |
|---|---|---|
| Page delivery | via the CDN of our host, Bunny (BunnyWay d.o.o., Ljubljana, Slovenia), only from servers in EU member states | state the regions of the database, files and delivery separately |
| Server logs | Bunny deletes them after three days; we receive them only without IP addresses | set a retention period for every type of data, including logs and backups |
| Contact form | a program on Bunny’s servers (edge script), only in the EU, which sends the inquiry to our mailbox as an email; no script runs in the browser for it | list server-side functions, queues and email delivery as data locations in their own right |
| mailbox at STRATO GmbH, Berlin, with data centers in Germany; if no contract follows, we delete inquiries six months after our last contact | add your support mailbox and ticketing system to your list of service providers, with deletion periods | |
| Name resolution (DNS) | via Bunny’s global DNS network | name any exceptions to “EU only” openly |
| Third-party services on page load | no cookies and no fonts, scripts or images from third parties | check every embedded third-party resource as another recipient of data |
Bunny processes the data on our behalf (Art. 28 GDPR). Before your first customer signs, put together an overview like this for your SaaS product and add the purpose and contract for each service provider. It answers the questions about origin and location that customers in Germany ask when choosing a provider.
Frequently asked questions
Can a SaaS product run separately for one large customer?
Yes. Even if one customer gets its own environment, it’s still SaaS. What matters is that you onboard, manage and bill all customers through the same services and that they all run the same version. AWS calls such a per-tenant environment a silo. It doesn’t get all the cost advantages of shared infrastructure, but it’s still full-fledged SaaS (AWS, Aug 3, 2022).
Does a SaaS product need a mobile app?
No. A web app also runs in the browser on smartphones and tablets. NIST counts access from a wide range of devices among the characteristics of cloud services (NIST, September 2011). Whether a native app is worth the effort is better decided after the MVP, once you see how your customers use the software.
How long does it take to build a SaaS MVP?
It depends mainly on the number of core features, roles and integrations. That’s why we only give a binding schedule once the scope is settled. You’ll find our estimate and the process on our SaaS development page.
How do customers find a new SaaS product?
One way is search, on Google and Bing and in AI assistants such as ChatGPT. To show up there, your product needs its own website that clearly states the target group, the benefits, the pricing and how to try it. Our guide to generative engine optimization (GEO) explains what matters for being mentioned in AI answers.