November 2026
SaaS Security: Your Vendor Is Part of Your Security Boundary
Software as a Service (SaaS) makes business applications easier to adopt and operate. A subscription can provide a customer relationship management system, HR platform, ticketing service, or reservation system without the same burden of maintaining servers, planning capacity, and managing application updates internally.
That convenience also changes who controls the systems holding your data. Once customer, employee, or operational information moves to a SaaS provider, its protection depends on that provider's security practices. Your organization has delegated custody while retaining responsibility for the information and the consequences of an exposure.
Strong Internal Security Has a Supplier Boundary
Endpoint hardening, network segmentation, security monitoring, and backups remain important within your own environment. They cannot directly secure records stored in a supplier's systems. Customers generally do not operate a SaaS vendor's development pipeline, patching process, cloud configuration, monitoring, or incident response.
Contracts and due diligence can influence those practices, but customers cannot routinely inspect every firewall rule or make the provider deploy an emergency fix immediately. A strong internal security program therefore cannot make up for inadequate protection at a supplier that holds sensitive information.
The Amadeus reservation-data incident illustrates this risk. Unauthorized access occurred in the supplier's reservation environment using credentials associated with an Amadeus system account, rather than through a compromise of Cathay Pacific's own airline systems. Multiple airline customers were affected or investigated possible exposure. The example shows how one provider's security incident can reach many organizations at the same time.
Six Areas to Review With SaaS Providers
The aim is to understand the risk, limit the amount of exposure, and identify problems sooner. Eliminating every third-party risk is not a realistic goal.
1. Assess Security Before Selecting the Service
Evaluate the provider's security assurance, including ISO 27001 certification or SOC 2 reporting, penetration testing, vulnerability management, encryption, logging, backup and recovery, and commitments to notify customers of breaches. Where payment-card information is involved, require and document the applicable PCI compliance.
Ask how the service separates customer data and how privileged identities and service accounts are controlled. Procurement should establish how the provider protects the information it will receive.
2. Check Encryption and Key Management
Require encryption for stored data and for data moving between systems. Encryption does not prevent every breach, but it can reduce the usefulness of a stolen database and limit some exposures.
Understand who holds the keys, how those keys are protected, and whether customer-managed keys are available. Particularly sensitive fields may warrant field-level encryption or tokenization.
3. Know Where Data Goes and Send Only What Is Needed
Establish where information is stored, processed, backed up, and accessed. These locations affect regulatory obligations, cross-border transfers, and the response to an incident.
Limit the information supplied to what the application requires. A reservation service may need a passenger's name and itinerary, for example, while a full passport number should have a clear operational reason before it is included.
4. Secure Your Organization's Access
Enforce multifactor authentication for user accounts, favoring phishing-resistant options such as FIDO2 security keys or passkeys where supported. Limit administrative access through trusted IP ranges, corporate VPNs, or a zero-trust access service.
Give users only the permissions they need, keep administrative accounts separate from everyday accounts, remove unused access promptly, and monitor sign-ins and administrative actions.
5. Keep Reviewing Supplier Assurance
A questionnaire completed during procurement becomes less useful as systems and circumstances change. Obtain periodic audit reports and maintain a supplier register that identifies data classifications and responsible owners. Review high-risk providers at least annually.
Include SaaS suppliers in risk registers, business-impact assessments, and incident-response plans. Establish which information would be affected by a supplier breach, who would need notification, and how quickly the provider could respond.
6. Prepare for Continuity and Exit
Before adopting a service, determine how to export information, revoke access, and move to another provider. Dependence on a single platform can prolong exposure after a security incident as well as create commercial constraints.
Keep the Benefits While Managing Shared Risk
SaaS can offer availability, specialist expertise, faster development, and lower infrastructure overhead that many organizations would struggle to reproduce internally. Large providers such as Amadeus also operate at a scale that individual customers could find difficult to match.
The same concentration means a single supplier incident can affect many customers. SaaS remains a useful business model, and its providers belong within the security boundary: choose carefully, minimize the data shared, strengthen access, request evidence of safeguards, and maintain a workable exit plan. The security of information depends on every system entrusted with it.