Due Diligence Needed with Software-as-a-Services (SaaS) apps
We all love new SaaS applications — but clicking “install” without due diligence is a major security gamble. Every new integration acts as a bridge for your data, significantly increasing your attack surface and raising security concerns.
The truth is, a single weak link can lead to catastrophic data breaches and compliance failures
The Solution? A Structured Vetting Process.
You need a rigorous, repeatable process to transform that potential liability into a secure environment. This means:
- Scrutinizing the Vendor: Check their breach history.
- Mapping Data Flow: Apply the principle of least privilege, granting access only where necessary.
- Planning the Exit: Know exactly how to get your data back and ensure its permanent deletion when the partnership ends.
Data first: what are you trusting them with?
Before anything else, be clear on:
- What data goes into the app (customer PII, financials, IP, credentials, etc.)
- How sensitive it is
- Whether it’s regulated (GDPR, HIPAA, PCI, etc.)
Security basics
At a minimum, a SaaS vendor should have:
- Encryption
- In-transit data security: (Transport Layer Security (TLS): data is encrypted using Transport Data Security (TLS) while it’s moving from one place to another. When data travels over a network (like the internet), it can potentially be intercepted. TLS wraps that data in encryption so even if someone grabs it mid-trip, they can’t read or tamper with it.
- At rest data security: Protecting data while it’s stored—not moving anywhere, just sitting on disks or backups. If someone gets access to your storage (a stolen laptop, hacked server, leaked backup), at-rest security makes the data unreadable without the proper keys.
- Strong authentication: Multi-factor authentication (MFA)
- Role-based access control (RBAC: This restricts system access to authorized users based on their defined job roles rather than individual user permissions.
- Audit logs (who did what, when)
- Are they using reputable infrastructure (AWS, Google Cloud Platform (GCP), Azure)?
- Ongoing review (not one-and-done)
- Re-review critical SaaS annually
- New features accessing new data
- Changes in ownership (acquisitions!)
- Major incidents or outages
Stop connecting blindly.
Contact us today to formalize your SaaS vetting process and secure your technology stack.
Call us at 201-493-1414
For more technology trends and topics, follow our LinkedIn page! 
Check Out Our Business Testimonials!
How is your state of IT? Call Us: (201) 493-1414 with any questions.
