Software as a Service (SaaS) delivers applications over the internet on a subscription — Microsoft 365, Salesforce, accounting platforms — with the vendor operating the infrastructure. SaaS shifts upgrade burden to the vendor but not security responsibility: you still control identities, sharing links, and data classification. Canadian privacy law applies to personal information stored in SaaS regardless of where the vendor hosts. Inventory SaaS apps, enforce SSO and MFA, review third-party integrations quarterly, and ensure contracts address data location and breach notification.
