Buying SaaS reduces the technology the customer designs and operates. It still leaves a system spanning organisations: the user channel, identity, data, integration and business continuity.

1. Review behaviour and ownership

The useful question is which boundaries and risks the customer owns or depends on. A provider's implementation language and internal component names may be irrelevant when the customer neither operates them nor relies on a particular implementation. The service contract and its evidence matter whenever a change can affect the customer.

2. Connect a requirement to evidence

For each material requirement, name the responsible party, service scope, observable result and acceptance evidence. The customer and provider may share a task; explicitly divide it rather than writing “IT is responsible”. A declaration is an input to review, not a completed test.

3. Seven areas of SaaS review

Area Establish Example evidence
Responsibility Who operates each component and responds to failure Responsibility matrix with named owners
Data Processing location, retention, isolation, backup and export Data flow, policy and export test
IAM Federation, roles, privileged and support access Sign-in and access-revocation test
Integration APIs, versioning, limits and errors Contract and failure/negative test
Quality requirements Availability, latency, capacity, RTO/RPO SLA/SLO scope, measurement and recovery drill
Operations Telemetry, status, incidents and changes Runbook, correlation and escalation path
Exit Data portability and service termination Export format and exit rehearsal

4. Availability and recovery need a boundary

An SLA has limited value when the measured function and perspective are unspecified. RTO and RPO need a defined scope of data and functions. A customer-owned channel can give the complete user journey a different recovery time from the provider service alone. Specify maintenance and exclusions as well as the target.

5. Observability belongs in the operating contract

The customer need not see every internal log. It needs enough information to understand service and integration health: status, relevant metrics, error codes, correlation identifiers, incident communication and escalation. A successful HTTP request alone does not demonstrate a completed business process.

6. Customer-hosted components change the review

An agent, terminal, connector, gateway or data plane in the customer environment adds architecture the customer must operate. Establish version compatibility, supported OS/runtime, upgrade ownership, network requirements, telemetry and rollback. Assess the actual deployment model rather than treating it as a remote website.

7. Exit is an architectural requirement

Managed services can remain a sound choice while some dependencies are hard to move. Establish export format, completeness, delivery time, deletion handling and integration/identity shutdown. Test an export before the process becomes dependent on the provider.

From a question to evidence

Fictional example: a business-agreed four-hour RTO covers the customer channel, IAM, SaaS and integration. A vendor database-recovery declaration alone does not prove that objective. Agree owners, drill conditions and measurement start/end points. Four hours is not a universal target.

For data, test export and readability outside the service. For access, check role revocation, existing sessions and privileged support access. For integration, examine missing responses, limits and contract versions. Record the result, service version and unknowns. Scale evidence to process criticality and assign acceptance of remaining risk.

Decision rule: Do we know every boundary, risk and behaviour we own or depend on, and do we have evidence for it?

Sources and method

Primary sources checked 11 October 2026: Azure SaaS design principles and design methodology. They explain responsibility and service-design principles; they do not prove any particular vendor's capabilities. The seven-area checklist and responsibility → requirement → evidence matrix are ArchitectMentor editorial synthesis. Prepared with AI assistance.

Practise the decision · Anti-pattern · Complete edition