Due Diligence Needed with Software-as-a-Services (SaaS) apps
We all love new SaaS applications — but clicking “install” without due diligence is a major security gamble. Every new integration acts as a bridge for your data, significantly increasing your attack surface and raising security concerns.
The truth is, a single weak link can lead to catastrophic data breaches and compliance failures
The Solution? A Structured Vetting Process.
You need a rigorous, repeatable process to transform that potential liability into a secure environment. This means:
- Scrutinizing the Vendor: Check their breach history.
- Mapping Data Flow: Apply the principle of least privilege, granting access only where necessary.
- Planning the Exit: Know exactly how to get your data back and ensure its permanent deletion when the partnership ends.
Data first: what are you trusting them with?
Before anything else, be clear on:
- What data goes into the app (customer PII, financials, IP, credentials, etc.)
- How sensitive it is
- Whether it’s regulated (GDPR, HIPAA, PCI, etc.)
Security basics
At a minimum, a SaaS vendor should have:
- Encryption
- In-transit data security: (Transport Layer Security (TLS): data is encrypted using Transport Data Security (TLS) while it’s moving from one place to another. When data travels over a network (like the internet), it can potentially be intercepted. TLS wraps that data in encryption so even if someone grabs it mid-trip, they can’t read or tamper with it.
- At rest data security: Protecting data while it’s stored—not moving anywhere, just sitting on disks or backups. If someone gets access to your storage (a stolen laptop, hacked server, leaked backup), at-rest security makes the data unreadable without the proper keys.
- Strong authentication: Multi-factor authentication (MFA)
- Role-based access control (RBAC: This restricts system access to authorized users based on their defined job roles rather than individual user permissions.
- Audit logs (who did what, when)
- Are they using reputable infrastructure (AWS, Google Cloud Platform (GCP), Azure)?
- Ongoing review (not one-and-done)
- Re-review critical SaaS annually
- New features accessing new data
- Changes in ownership (acquisitions!)
- Major incidents or outages
Stop connecting blindly.
Contact us today at (201) 493-1414 to formalize your SaaS vetting process and secure your technology stack.
For more technology trends and topics, follow our LinkedIn page! 
Check Out Our Business Testimonials!
How is your state of IT? Call Us: (201) 493-1414 with any questions.
