Technology
Data security in SaaS apps: the basics
Sellora Group team
· 1 min read
When you move data to the cloud, you hand part of the responsibility to the vendor. It is worth knowing which safeguards it should have and what still depends on you.
Encrypted connections
The app's address should start with https and the browser should show a padlock. It means data between your device and the server is encrypted (TLS) and nobody in between can read it.
Backups
The vendor should back up data regularly and keep the copies somewhere other than the servers the app runs on. Ask how often backups are made, how long they are kept and how long it takes to restore data after a failure.
Access control
Every employee should have their own account with only the permissions they need. A shared password for the whole team makes it hard to tell who made a refund or changed a price. When someone leaves, disable their account the same day. If the app offers two-factor sign-in, turn it on at least for the accounts with the most permissions.
Monitoring
The vendor should watch its services around the clock and respond to alerts before customers notice a problem.
GDPR and the data processing agreement
If the app holds personal data about customers or employees, the vendor processes it on your behalf. The GDPR then requires a data processing agreement (Article 28). Also check where the data is stored, ideally on servers in the European Economic Area.
Questions for vendors
- Are connections to the app encrypted?
- How often do you make backups, and how long does a restore take?
- Are your services monitored around the clock?
- Where is the data stored?
- Will you sign a data processing agreement?
- How do I export my data if I leave the service?
How we do it at Sellora Group
In our apps connections are encrypted, we monitor our services 24/7, back up data regularly and process data in line with the GDPR.
Frequently asked questions
Is data in a SaaS app secure?
It is when the vendor encrypts connections, makes backups, monitors its services and processes data in line with the GDPR, and when everyone in your business has their own account and a strong password.
Do I need a data processing agreement with a SaaS vendor?
Yes, if the vendor processes personal data on your behalf, such as customer or employee data. Article 28 of the GDPR requires it.
Author
Sellora Group team
Sellora Group is a Polish technology company from Mława. We build SaaS apps for businesses: Sellora, a cloud POS system, and Halokurs, software for taxi companies.
Related posts
All posts- Guides
How to choose a POS system: a guide for hospitality, retail and services
What to look at when choosing a sales system: the fiscal printer, payments, reports, integrations and SaaS costs. Plus a list of questions for vendors.
- Sales & POS
5 signs your business needs SaaS software
Spreadsheets, manual reports, a technician for every update and the fear of a computer failure. Five situations where a cloud app saves time and stress.
- Technology
Cloud or an office server? How to compare the costs
An office server costs more than the hardware. Here is which costs to add and how to compare them with a SaaS subscription over three years.
Stay up to date.
Once a month: news from Sellora Group and practical tips on sales and running a business.
By subscribing, you accept the Privacy Policy. We track newsletter opens and link clicks to improve it. You can unsubscribe at any time.