---
title: "Data security in SaaS: the basics"
description: "Encryption, backups, access control, monitoring and the GDPR in SaaS apps. What they mean in practice and which questions to ask a cloud vendor."
canonical_url: "https://sellora.group/en/blog/data-security-in-saas-applications-the-basics"
last_updated: "2026-10-31T02:14:09.355Z"
locale: en
meta:
  author: "Sellora Group sp. z o.o."
  "og:description": "Encryption, backups, access control, monitoring and the GDPR in SaaS apps. What they mean in practice and which questions to ask a cloud vendor."
  "og:image": "https://sellora.group/_og/d/c_Sellora%2Ctitle_~RGF0YSBzZWN1cml0eSBpbiBTYWFTOiB0aGUgYmFzaWNz%2Cdescription_~RW5jcnlwdGlvbiwgYmFja3VwcywgYWNjZXNzIGNvbnRyb2wsIG1vbml0b3JpbmcgYW5kIHRoZSBHRFBSIGluIFNhYVMgYXBwcy4gV2hhdCB0aGV5IG1lYW4gaW4gcHJhY3RpY2UgYW5kIHdoaWNoIHF1ZXN0aW9ucyB0byBhc2sgYSBjbG91ZCB2ZW5kb3Iu%2Ceyebrow_Technology%2Cp_Ii9lbi9ibG9nL2RhdGEtc2VjdXJpdHktaW4tc2Fhcy1hcHBsaWNhdGlvbnMtdGhlLWJhc2ljcyI%2Cs_5TTrj4VjoGNQAGse.png"
  "og:image:height": "630"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "Data security in SaaS: the basics"
  "twitter:description": "Encryption, backups, access control, monitoring and the GDPR in SaaS apps. What they mean in practice and which questions to ask a cloud vendor."
  "twitter:image": "https://sellora.group/_og/d/c_Sellora%2Ctitle_~RGF0YSBzZWN1cml0eSBpbiBTYWFTOiB0aGUgYmFzaWNz%2Cdescription_~RW5jcnlwdGlvbiwgYmFja3VwcywgYWNjZXNzIGNvbnRyb2wsIG1vbml0b3JpbmcgYW5kIHRoZSBHRFBSIGluIFNhYVMgYXBwcy4gV2hhdCB0aGV5IG1lYW4gaW4gcHJhY3RpY2UgYW5kIHdoaWNoIHF1ZXN0aW9ucyB0byBhc2sgYSBjbG91ZCB2ZW5kb3Iu%2Ceyebrow_Technology%2Cp_Ii9lbi9ibG9nL2RhdGEtc2VjdXJpdHktaW4tc2Fhcy1hcHBsaWNhdGlvbnMtdGhlLWJhc2ljcyI%2Cs_5TTrj4VjoGNQAGse.png"
  "twitter:title": "Data security in SaaS: the basics"
---

> Index of every page on this site: [llms.txt](https://sellora.group/llms.txt)

**Technology**

# **Data security in SaaS apps: the basics**

**Sellora Group team**

October 25, 2026 · 1 min read

**When you move data to the cloud, you hand part of the responsibility to the vendor. It is worth knowing which safeguards it should have and what still depends on you.**

## **Encrypted connections**

The app's address should start with https and the browser should show a padlock. It means data between your device and the server is encrypted (TLS) and nobody in between can read it.

## **Backups**

The vendor should back up data regularly and keep the copies somewhere other than the servers the app runs on. Ask how often backups are made, how long they are kept and how long it takes to restore data after a failure.

## **Access control**

Every employee should have their own account with only the permissions they need. A shared password for the whole team makes it hard to tell who made a refund or changed a price. When someone leaves, disable their account the same day. If the app offers two-factor sign-in, turn it on at least for the accounts with the most permissions.

## **Monitoring**

The vendor should watch its services around the clock and respond to alerts before customers notice a problem.

## **GDPR and the data processing agreement**

If the app holds personal data about customers or employees, the vendor processes it on your behalf. The GDPR then requires a data processing agreement (Article 28). Also check where the data is stored, ideally on servers in the European Economic Area.

## **Questions for vendors**

1. Are connections to the app encrypted?
2. How often do you make backups, and how long does a restore take?
3. Are your services monitored around the clock?
4. Where is the data stored?
5. Will you sign a data processing agreement?
6. How do I export my data if I leave the service?

## **How we do it at Sellora Group**

In our apps connections are encrypted, we monitor our services 24/7, back up data regularly and process data in line with the GDPR.

## **Frequently asked questions**

<details>

<summary>

### **Is data in a SaaS app secure?**

</summary>

It is when the vendor encrypts connections, makes backups, monitors its services and processes data in line with the GDPR, and when everyone in your business has their own account and a strong password.

</details>

<details>

<summary>

### **Do I need a data processing agreement with a SaaS vendor?**

</summary>

Yes, if the vendor processes personal data on your behalf, such as customer or employee data. Article 28 of the GDPR requires it.

</details>

**Author**

**Sellora Group team**

Sellora Group is a Polish technology company from Mława. We build SaaS apps for businesses: Sellora, a cloud POS system, and Halokurs, software for taxi companies.

## **Related posts**

[**All posts**](https://sellora.group/en/blog)

- **Guides**Oct 28, 2026 · 4 min read ### [How to choose a POS system: a guide for hospitality, retail and services](https://sellora.group/en/blog/how-to-choose-a-pos-system)

  What to look at when choosing a sales system: the fiscal printer, payments, reports, integrations and SaaS costs. Plus a list of questions for vendors.**Read more **
- **Sales & POS**Oct 26, 2026 · 2 min read ### [5 signs your business needs SaaS software](https://sellora.group/en/blog/5-signs-your-business-needs-saas)

  Spreadsheets, manual reports, a technician for every update and the fear of a computer failure. Five situations where a cloud app saves time and stress.**Read more **
- **Technology**Oct 24, 2026 · 2 min read ### [Cloud or an office server? How to compare the costs](https://sellora.group/en/blog/cloud-or-an-office-server-a-cost-comparison)

  An office server costs more than the hardware. Here is which costs to add and how to compare them with a SaaS subscription over three years.**Read more **

## **Stay up to date.**

Once a month: news from Sellora Group and practical tips on sales and running a business.

By subscribing, you accept the Privacy Policy. We track newsletter opens and link clicks to improve it. You can unsubscribe at any time.

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://sellora.group/#website","@type":"WebSite","description":"Sellora Group is a Polish technology company from Mława. We build SaaS apps for businesses: Sellora, a cloud POS system, and Halokurs, software for taxi companies.","inLanguage":"en-US","name":"Sellora Group","url":"https://sellora.group/","publisher":{"@id":"https://sellora.group/#identity"},"translationOfWork":{"@id":"https://sellora.group/#website"}},{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#webpage","dateModified":"2026-10-31T02:14:09.355Z","datePublished":"2026-10-25","description":"Encryption, backups, access control, monitoring and the GDPR in SaaS apps. What they mean in practice and which questions to ask a cloud vendor.","name":"Data security in SaaS: the basics","url":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics","@type":["WebPage","FAQPage"],"breadcrumb":{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#breadcrumb"},"isPartOf":{"@id":"https://sellora.group/en#website"},"mainEntity":[{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#/schema/question/1"},{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#/schema/question/2"}],"potentialAction":[{"@type":"ReadAction","target":["https://sellora.group/en/blog/data-security-in-saas-applications-the-basics"]}],"primaryImageOfPage":{"@id":"https://sellora.group/#logo"}},{"@id":"https://sellora.group/#identity","@type":"Organization","description":"Sellora Group is a Polish technology company from Mława. We build SaaS apps for businesses: Sellora, a cloud POS system, and Halokurs, software for taxi companies.","email":"kontakt@sellora.group","foundingDate":"2026-10-21","legalName":"Sellora Group sp. z o.o.","name":"Sellora Group","slogan":"Code that pays off.","taxID":"5691918110","url":"https://sellora.group","vatID":"PL5691918110","address":{"@type":"PostalAddress","streetAddress":"ul. Wójtostwo 59/22","postalCode":"06-500","addressLocality":"Mława","addressRegion":"mazowieckie","addressCountry":"PL"},"contactPoint":{"@type":"ContactPoint","contactType":"customer service","email":"kontakt@sellora.group","availableLanguage":["pl","en"]},"identifier":[{"@type":"PropertyValue","propertyID":"KRS","value":"0001274057"},{"@type":"PropertyValue","propertyID":"REGON","value":"546000454"},{"@type":"PropertyValue","propertyID":"NIP","value":"5691918110"}],"knowsAbout":["SaaS","business software","POS systems","cloud computing","API integrations"],"logo":{"@id":"https://sellora.group/#logo"},"sameAs":["https://www.linkedin.com/company/sellora-group"]},{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Home","item":"https://sellora.group/en","position":1},{"@type":"ListItem","name":"Blog","item":"https://sellora.group/en/blog","position":2},{"@type":"ListItem","name":"Technology","item":"https://sellora.group/en/blog/category/technology","position":3},{"@type":"ListItem","name":"Data security in SaaS apps: the basics","position":4}]},{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#article","dateModified":"2026-10-31T02:14:09.355Z","datePublished":"2026-10-25T00:00:00.000Z","description":"Encryption, backups, access control, monitoring and the GDPR. What they mean in practice and what to ask a cloud app vendor.","headline":"Data security in SaaS apps: the basics","inLanguage":"en-US","thumbnailUrl":"https://sellora.group/_og/d/c_Sellora%2Ctitle_~RGF0YSBzZWN1cml0eSBpbiBTYWFTOiB0aGUgYmFzaWNz%2Cdescription_~RW5jcnlwdGlvbiwgYmFja3VwcywgYWNjZXNzIGNvbnRyb2wsIG1vbml0b3JpbmcgYW5kIHRoZSBHRFBSIGluIFNhYVMgYXBwcy4gV2hhdCB0aGV5IG1lYW4gaW4gcHJhY3RpY2UgYW5kIHdoaWNoIHF1ZXN0aW9ucyB0byBhc2sgYSBjbG91ZCB2ZW5kb3Iu%2Ceyebrow_Technology%2Cp_Ii9lbi9ibG9nL2RhdGEtc2VjdXJpdHktaW4tc2Fhcy1hcHBsaWNhdGlvbnMtdGhlLWJhc2ljcyI%2Cs_5TTrj4VjoGNQAGse.png","timeRequired":"PT1M","wordCount":326,"@type":["Article","BlogPosting"],"articleSection":["Technology"],"author":{"@id":"https://sellora.group/#identity"},"image":{"@id":"https://sellora.group/#/schema/image/1"},"isPartOf":{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#webpage"},"keywords":[],"mainEntityOfPage":{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#webpage"},"publisher":{"@id":"https://sellora.group/#identity"}},{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#/schema/question/1","@type":"Question","inLanguage":"en-US","name":"Is data in a SaaS app secure?","acceptedAnswer":{"@type":"Answer","text":"It is when the vendor encrypts connections, makes backups, monitors its services and processes data in line with the GDPR, and when everyone in your business has their own account and a strong password."}},{"@id":"https://sellora.group/en/blog/data-security-in-saas-applications-the-basics#/schema/question/2","@type":"Question","inLanguage":"en-US","name":"Do I need a data processing agreement with a SaaS vendor?","acceptedAnswer":{"@type":"Answer","text":"Yes, if the vendor processes personal data on your behalf, such as customer or employee data. Article 28 of the GDPR requires it."}},{"@id":"https://sellora.group/#logo","@type":"ImageObject","caption":"Sellora Group","contentUrl":"https://sellora.group/brand/sellora-group-logo.png","inLanguage":"en-US","url":"https://sellora.group/brand/sellora-group-logo.png"},{"@id":"https://sellora.group/#/schema/image/1","@type":"ImageObject","contentUrl":"https://sellora.group/_og/d/c_Sellora%2Ctitle_~RGF0YSBzZWN1cml0eSBpbiBTYWFTOiB0aGUgYmFzaWNz%2Cdescription_~RW5jcnlwdGlvbiwgYmFja3VwcywgYWNjZXNzIGNvbnRyb2wsIG1vbml0b3JpbmcgYW5kIHRoZSBHRFBSIGluIFNhYVMgYXBwcy4gV2hhdCB0aGV5IG1lYW4gaW4gcHJhY3RpY2UgYW5kIHdoaWNoIHF1ZXN0aW9ucyB0byBhc2sgYSBjbG91ZCB2ZW5kb3Iu%2Ceyebrow_Technology%2Cp_Ii9lbi9ibG9nL2RhdGEtc2VjdXJpdHktaW4tc2Fhcy1hcHBsaWNhdGlvbnMtdGhlLWJhc2ljcyI%2Cs_5TTrj4VjoGNQAGse.png","inLanguage":"en-US","url":"https://sellora.group/_og/d/c_Sellora%2Ctitle_~RGF0YSBzZWN1cml0eSBpbiBTYWFTOiB0aGUgYmFzaWNz%2Cdescription_~RW5jcnlwdGlvbiwgYmFja3VwcywgYWNjZXNzIGNvbnRyb2wsIG1vbml0b3JpbmcgYW5kIHRoZSBHRFBSIGluIFNhYVMgYXBwcy4gV2hhdCB0aGV5IG1lYW4gaW4gcHJhY3RpY2UgYW5kIHdoaWNoIHF1ZXN0aW9ucyB0byBhc2sgYSBjbG91ZCB2ZW5kb3Iu%2Ceyebrow_Technology%2Cp_Ii9lbi9ibG9nL2RhdGEtc2VjdXJpdHktaW4tc2Fhcy1hcHBsaWNhdGlvbnMtdGhlLWJhc2ljcyI%2Cs_5TTrj4VjoGNQAGse.png"}]}
```

## Sitemap

See the full [sitemap](https://sellora.group/sitemap.md) for all pages.