Skip to content
The Insight Journal Business & Operations

Business Technology & SaaS · Definitions

What is SaaS, measured against the standard rather than the marketing

Software as a service has an official definition, published by the US National Institute of Standards and Technology in 2011 and running to seven pages. Not one of the ten pages ranking for this question cites it. Here it is, alongside the boundaries it draws and the ones it refuses to draw.

Reviewed August 2026 · The Insight Journal Editorial Team

In short

SaaS, or software as a service, is a cloud service model in which the provider runs a finished application on its own infrastructure and you use it through a browser or a program interface. You do not manage the servers, the operating system, the storage, or the application itself beyond limited user-level settings. Nothing in that definition mentions price.
What SaaS runs on: a cold aisle between server racks, patch cabling and status lights in a data centre with no people present.

The definition

The definition almost nobody quotes

In short

Software as a service is one of three cloud service models named in NIST Special Publication 800-145. The document is seven pages long, was published in September 2011 by Peter Mell and Timothy Grance, and is the reference the rest of the cloud vocabulary is built on.

Here is the definition in full, because paraphrasing it is where most of the confusion starts.

"The capability provided to the consumer is to use the provider's applications running on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings."

Read it twice and the last clause does most of the work. You get user-level settings, and nothing underneath them. That is the whole bargain, stated in a single sentence by a federal standards body, and it sits at the base of the wider business software landscape that most companies now buy.

The omission

What the standard leaves out, and why it matters

In short

The definition contains no reference to subscription, price or payment of any kind. Almost every explainer on the first page of results puts subscription pricing inside the definition. It is the dominant commercial convention, not the boundary of the category.

This is not a pedantic point. If subscription were definitional, a tool billed per transaction would fall outside SaaS, and plainly it does not. The billing model is a commercial decision layered on top of an architectural one.

NIST's own companion document is specific about how the money actually works. Fees are charged, it says, "based on the number of users, the time in use, per-execution, per-record-processed, network bandwidth consumed, and quantity/duration of data stored".

Six fee bases, one category

  1. 1. Number of users
  2. 2. Time in use
  3. 3. Per execution
  4. 4. Per record processed
  5. 5. Network bandwidth consumed
  6. 6. Quantity or duration of data stored

Source: NIST SP 800-146, section 5.

The test

The five-part test hiding inside the definition

In short

NIST names five essential characteristics that a service must have to be cloud computing at all. Everyone reproduces them as a list. Almost nobody uses them as a pass or fail, which is the only thing they are actually good for.
The five essential characteristics of cloud computing, what each one means in NIST's words, and the sign that a product fails it
Characteristic What NIST says it means The sign it fails
On-demand self-service You can provision it yourself, "without requiring human interaction with each service provider" You had to email an account manager to add a user
Broad network access Reachable over the network by "heterogeneous thin or thick client platforms" It only runs on one managed desktop image
Resource pooling Provider resources "are pooled to serve multiple consumers using a multi-tenant model" A dedicated box was racked for you alone
Rapid elasticity Capacity scales "rapidly outward and inward commensurate with demand" Growth means a migration project
Measured service Usage is metered, "monitored, controlled, and reported" Nobody can tell you what you consumed last month

A product that fails two or three of these is a hosted application. That is not an insult, and for some workloads it is the better arrangement. It is simply a different thing from what the standard calls SaaS, and knowing which one you are buying changes what you ask the vendor.

The three service models

SaaS, PaaS and IaaS, drawn on who controls what

In short

The line between the three service models is scope of control, not a stack picture. With IaaS you run arbitrary software including the operating system. With PaaS you deploy your own applications onto somebody else's platform. With SaaS you get the finished product and its settings screen.
IaaS You run the OS upward Application yours Runtime yours Operating system yours Servers and network provider PaaS You deploy your own apps Application yours Runtime provider Operating system provider Servers and network provider SaaS You change settings only Application provider Runtime provider Operating system provider Servers and network provider the layers you control shrink from left to right; the layers you are responsible for shrink with them
Drawn from the three service-model definitions in NIST SP 800-145. The runtime row is shaded as partly yours under PaaS, where the standard grants "possibly configuration settings for the application-hosting environment".
Who controls each layer of the stack under infrastructure as a service, platform as a service and software as a service
Layer IaaS PaaS SaaS
Physical servers and network Provider Provider Provider
Operating system You Provider Provider
Runtime and hosting environment You Partly you Provider
The application itself You You Provider
What you get to change Anything you install Your own deployed apps User-level settings

The older bargain

How this differs from software you used to buy outright

In short

A perpetual licence for installed software gave you a copy and the problems that came with it: patching, servers, backups, and a migration project every few years. The SaaS delivery model removes all four and takes something in exchange that buyers rarely price properly, which is authority over the software.

What you stop carrying

  • No install, no patch cycle, no hardware to size.
  • New capability arrives without an IT rollout.
  • Adding a person is an administrative act, not a project.

What you hand over

  • Limited user-specific settings, and no control beneath them.
  • The vendor's roadmap becomes your roadmap, including removals.
  • Stop paying and access typically stops with it.

There is a fourth item most guides omit, and NIST files it under network dependence. Availability rests on a network neither side owns: in the public case, reliability "cannot be guaranteed either by the cloud consumer or by the cloud provider because the Internet is not under the control of either one".

An operator feels the difference twice. On day one it feels like relief. Somewhere in year three it feels like the morning a feature you built a process around is retired in a release note.

The architecture you are buying

Multi-tenancy, and what it actually costs you

In short

Multi-tenancy is not a feature. It sits inside NIST's resource pooling characteristic, which says provider resources are pooled "to serve multiple consumers using a multi-tenant model". NIST calls the choice of multi-tenant architecture isolation versus efficiency, and it has a consequence for you.

Favouring isolation

A separate copy for each client

The provider runs a separate application instance per client, with a separate database behind it, and the operating system provides the tenant isolation. NIST is blunt about the economics: the overhead of a separate copy and a separate database is incurred for every active client.

Favouring efficiency

One application, one combined database

The provider reengineers the application to serve many clients at once and stores everything in a combined database. NIST's verdict on the trade is a single parenthesis: this approach "lowers costs for the provider (but at an increased security risk to consumers)".

Where your data sits

The same characteristic settles the residency question. Under resource pooling, the customer "generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter)".

Country-level choice is often available. Street-level certainty is not, so data residency is a contractual question rather than a technical one.

Why leaving is harder than arriving

NIST lists portability between SaaS clouds as a named concern. Export and import formats "may not be fully compatible", and customised workflow, business rules, interface settings, support scripts, data extensions and add-ons "can also be provider specific and not easily transferable".

The records usually come out. Three years of accumulated configuration usually does not, and that gap is what vendor lock-in means in practice.

Named examples

What SaaS looks like across four categories

The SaaS examples people reach for span consumer and business tools, and the delivery model is the common thread rather than the industry. We name these as recognisable members of a category and make no claim about any product's pricing, features or architecture.

Collaboration and email

Google Workspace and Slack sit closest to the definition NIST wrote: hosted centrally, reached through a browser, provisioned by an administrator in minutes.

The customer record

Salesforce and HubSpot are the business-facing archetype. The record lives on the provider side, which is exactly the shift the standard is describing.

Finance and commerce

QuickBooks Online, Xero and Shopify moved categories that were once shipped on disks into the same delivery model, one company at a time.

Consumer services

Netflix and Dropbox are the examples people reach for first, and they are fair ones. The delivery model is what makes them SaaS, not the industry.

Two questions usually follow this list, and both have their own home. If you want the argument about whether large language models displace any of it, read our analysis of whether AI is actually replacing SaaS. If you are already running a handful of these and need the vocabulary that comes with them, start there instead.

Boundary problems

Where the word gets used loosely

In short

Four misuses account for most of the confusion, and each one has a correction sitting in the standard. None of them is a scandal. They are just category errors that make a buying conversation harder than it needs to be.

  1. A login page is not a service model

    Any web application with accounts now gets called SaaS. The standard asks a harder question: are the provider’s resources pooled, is capacity elastic, is usage metered. Fail those and you have a hosted application, which is a perfectly good thing to be.

  2. Private cloud is a deployment model, not a rival to SaaS

    NIST defines four deployment models, private cloud, community cloud, public cloud and hybrid cloud, and they sit at right angles to the three service models. A private-cloud SaaS product is coherent. "We are private cloud, not SaaS" is a category error.

  3. One company can sell you both SaaS and PaaS

    The same underlying technology often ships twice: as a finished application you log into, and as an interface developers build on. The first behaves like SaaS and the second like PaaS. The vendor name tells you nothing.

  4. "Cloud" used where "hosted" is meant

    NIST SP 800-146 quotes the loose working definition, "Software deployed as a hosted service and accessed over the Internet", and notes in the same paragraph that only the most advanced SaaS architectures appear to satisfy the NIST cloud definition. The gap is acknowledged inside the primary source.

None of this decides what you should buy. That question starts one level up, with the job the software is meant to do, which is where our guide to choosing business software picks the thread up.

The evidence for writing this at all

A settled term that people still cannot pin down

Search-demand and SERP measurements taken on 18 August 2026. They describe how many people ask the question and what they are shown. They are not market size.

27,100

US monthly searches for "what is SaaS", a term the industry treats as settled

DataForSEO, August 2026

0 of 10

Page-one results that cite NIST, or any standards body, for the definition they give

Live SERP analysis by The Insight Journal, 18 August 2026

7

Pages in SP 800-145, the document the whole cloud vocabulary rests on

NIST, 2011

Method

How we checked this

Read, not remembered

Both NIST publications were downloaded and read as text in full on 18 August 2026. Every quotation on this page was copied from those documents, not from a summary of them.

Measured, not assumed

The search volume and the page-one analysis come from a live SERP pull on the same date, United States, desktop. Four of the ten results are published by companies that sell cloud services.

What we leave out

No market size, growth rate or adoption percentage appears here, because none could be traced to a primary source we could check. No vendor price appears either. Our research and sourcing policy explains the rule.

Questions

Common questions about SaaS

What is SaaS in simple terms?
SaaS is software you use without owning or running it. The provider keeps the application on its own servers, you reach it through a browser or an app, and you change nothing beneath the settings screen. NIST puts it more precisely: the consumer does not manage or control the underlying network, servers, operating systems, storage, or even individual application capabilities.
Is Netflix a SaaS?
By the letter of the NIST definition, yes. Netflix is an application running on a provider’s cloud infrastructure, reached from a thin client, with no consumer control over anything beneath the interface. It is a consumer service rather than a business tool, but the definition is about the delivery model and says nothing about who the customer is.
Is SaaS always sold by subscription?
No, and this is the most common error in the popular definition. The NIST definition of SaaS contains no reference to subscription, price or payment at all. NIST SP 800-146 lists the fee bases actually used in practice: number of users, time in use, per execution, per record processed, network bandwidth consumed, and quantity or duration of data stored.
What is the opposite of SaaS?
The nearest opposite is a perpetual licence for software you install and run on hardware you control, usually called on-premise. You own the copy, you decide when it changes, and you carry the patching, the backups and the servers. SaaS trades all of that away in both directions at once.
Is ChatGPT considered SaaS, or is it PaaS?
Both, depending which product you mean. The chat interface behaves as SaaS: a finished application, hosted centrally, with user-level settings only. The developer API behaves more like PaaS, because you deploy your own application on top of it. One company routinely sells the same technology under two service models.
Is a hosted app with a login automatically SaaS?
Not necessarily. If the provider racks a dedicated server for you, sizes it once a year and cannot report your usage, it fails resource pooling, rapid elasticity and measured service. That is single-tenant hosting. It can be an excellent arrangement, and it is worth knowing that you are buying it rather than assuming otherwise.
Where does my data physically sit when I use SaaS?
Usually you do not know exactly, and the standard says so. NIST’s resource pooling characteristic states that the customer generally has no control or knowledge over the exact location of the provided resources, but may be able to specify location at a higher level of abstraction such as country, state or datacenter. Residency is a question to ask before signing, not after.
What are the top 5 SaaS companies?
No verified ranking exists to cite, and we will not invent one. Sorted by revenue, by seats, or by valuation, the list comes out differently each time, and most published rankings do not say which measure they used. The useful observation is that SaaS spans everything from productivity suites to accounting to streaming, so no single ranking describes the category.