Fictional educational scenario
An organisation is considering an external SaaS service for an important transactional process. The provider operates the application, database and infrastructure in its own environment. The customer must still build its own user channel, integrate enterprise identity, exchange business data and provide first-line incident handling.
The provider has supplied API documentation, an SLA and a high-level security statement. Asked for architecture details, it replies: “It is SaaS; internal implementation is our responsibility.” The customer still lacks a clear responsibility boundary, data location and retention model, tenant-isolation explanation, critical dependencies, failure procedure, RTO/RPO, customer-visible telemetry and exit/export process.
Business stakeholders want a quick decision. The technical team splits into two camps: “No approval without the vendor’s full HLD” and “It is SaaS, so the vendor architecture is irrelevant to us.”
What decision would you make now? In 2–3 sentences, identify the information you need, the internals you can leave with the provider and evidence required before acceptance.
Guiding questions
- What does the customer control: the channel, identity, data or vendor infrastructure?
- How would you verify the complete journey if the API responds but the business function fails?
- Which unknowns can a contract, recovery drill or export test resolve?