SaaS - Software As a Service - Data Security and Privacy

In one of the other articles on SaaS, Businesssimple terms, it is about data separation and
Applications, SaaS and SMB Market, we proposedapplication separation. In this article, we shall focus
that SaaS will be a mass enabler for SMB (smallon data security and privacy. There are multiple
and medium business) market. In order to providemechanisms, which can be used to ensure data
effective SaaS solutions for enabling multi-tenantseparation so that a client does not get access to
systems, it is imperative that the key issues ofanother client's data on the same SaaS solution.
data security and privacy are addressed.1. Database Separation: This solution provides a
It is important to acknowledge and identify thatvery high level of data privacy as a separate
the requirements, sensitivity to data security anddatabase is allocated to each customer. This
privacy; and pricing levels demand different levelscomes at a higher cost due to licensing and
of SaaS enabling. There may be an applicationoperational cost on the SaaS vendor side.
that can share the same database among2. Schema/Table Separation: This solution provides
different clients as the application itself is not corea medium level of data privacy as separate tables
to the company and data does not demand theare assigned to each customer.
highest level of data security. On the other hand,3. Data Separation: This solution provides the
there may be an application that requires datalowest level of data privacy as same tables are
encryption along with separate and dedicatedused to store customer data.
database as the application data demands highest4. Data Encryption: Data encryption can be used
level of data security.to provide a very high level of data privacy to
Let's look at different levels of SaaS ennoblementcustomer data. Data encryption can be used with
for business applications. The SaaS solutionany of the above solutions. Typically data
enables a multi-tenant system that can be usedencryption is done using symmetric encryption
by multiple clients. The solution enables a securewith algorithms like AES (Advanced Encryption
and trusted environment where clients canStandard).
execute business processes with completeOne should carefully evaluate application
confidence.requirements and risk profile to identify the
The critical aspect of multi-tenancy solution is dataappropriate level of data separation.
security & privacy and application security. In