SaaS in cloud computing: how software reaches you over the internet
What happens between your click and the vendor's data center: hosting, multi-tenancy, browser and API access, and what 99.9% uptime means in minutes.
Your cloud computing course lists SaaS as one of three service models, next to IaaS and PaaS, and you can recite the acronyms but cannot picture what actually happens when you use one. Here is the picture: SaaS is the top layer of the cloud, the layer where a finished application runs on the provider’s machines and reaches you over the internet, so that you never touch the servers underneath it.
This guide follows one click from your browser to the vendor’s database and back, explains why one system can serve thousands of companies without mixing their data, and turns an uptime promise like “99.9%” into minutes you can plan around. The definition of SaaS itself is in What is SaaS?.
The cloud in plain terms
Think of electricity. A century ago a factory that wanted power built a generator in the basement, bought the fuel and hired someone to keep it running. Today the factory plugs into the grid, pays per kilowatt-hour and never thinks about the power station. The grid is shared by everyone, metered for each customer, and still delivers power to one building without affecting the next.
Cloud computing is the grid for computing. The US National Institute of Standards and Technology defined it in SP 800-145 (September 2011) as “a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources” that “can be rapidly provisioned and released with minimal management effort or service provider interaction.” The same document names three service models, which differ only in how much of the stack you rent:
- IaaS (infrastructure as a service): you rent “processing, storage, networks, and other fundamental computing resources” and run your own software on them. The generator is theirs; the wiring is yours.
- PaaS (platform as a service): you deploy your own applications onto a platform the provider runs, “using programming languages, libraries, services, and tools supported by the provider.”
- SaaS (software as a service): you use “the provider’s applications running on a cloud infrastructure.” You do not manage “network, servers, operating systems, storage, or even individual application capabilities.”
SaaS is the only one of the three where the thing you rent is the finished product. That is why it is the model your non-technical colleagues use every day without knowing the word.
What happens when you click Save
Example: you edit a customer record in a web-based CRM and click Save. In the half second before the green tick appears, five things happen. The table shows where each step runs and who is responsible for it. Specific product names are left out because the shape is the same for almost every SaaS product.
| Step | What happens | Where it runs | Who owns it |
|---|---|---|---|
| 1 | Your browser packages the change into an HTTPS request | Your device | You (device, browser, network) |
| 2 | The request reaches the vendor’s edge: DNS, TLS, a content delivery network, a firewall | A data center near you, run by the vendor or its CDN provider | Vendor |
| 3 | An application server checks your session, your permissions and the rules of the product | The vendor’s application tier, usually on rented IaaS or PaaS | Vendor |
| 4 | The database writes the change to the rows that belong to your company, and only yours | The vendor’s database tier | Vendor (the engine), you (the content) |
| 5 | A response travels back and the page updates | Your device | You |
Two things in that table matter for a buyer. The application and the database (steps 3 and 4) usually run on a cloud provider the vendor rents from, so “SaaS” is often built on top of “IaaS” or “PaaS”: the layers stack. And the only part you control is the two ends. If step 1 fails because your office Wi-Fi dropped, the vendor’s status page will show green, and it will be right.
How one system serves thousands of companies
Most SaaS products are multi-tenant: one running copy of the software, one set of servers, many customers. Each customer is a tenant. The product tags every row of data with the tenant it belongs to, and every query carries that tag, so your company’s records never appear in another company’s screen. It is the apartment building again: shared structure, separate keys.
Multi-tenancy is the economic engine of SaaS. The vendor patches one system instead of a thousand, rolls out a feature once, and spreads the cost of hardware and engineers across every customer. That is how a product can cost $7 per user per month. The trade-off is that you share capacity and release schedules with everyone else, which is why large customers sometimes pay for single-tenant or dedicated versions.
Access is the other half. A browser is the usual client, but most products also expose an API (application programming interface) so that other software can read and write the same data. The NIST definition covers both: “a thin client interface, such as a web browser (e.g., web-based email), or a program interface.” When your CRM shows up inside your email tool, that is the API at work.
What 99.9% uptime means in minutes
SaaS vendors publish an uptime commitment in a service level agreement (SLA): the share of time the service promises to be available, measured per calendar month, with service credits if it misses. Google Workspace commits to a monthly uptime of 99.9% and credits 3, 7 or 15 days of service when uptime falls below 99.9%, 99.0% or 95.0% respectively (Google Workspace SLA, checked October 2026). Atlassian commits to 99.9% for its Premium cloud plans and 99.95% for Enterprise (Atlassian SLA, effective April 30, 2026).
Percentages hide the size of the promise. Minutes do not.
Example: a 30-day month has 30 x 24 x 60 = 43,200 minutes. A year has 365 x 24 x 60 = 525,600 minutes. The allowed downtime is the remaining percentage of those minutes: at 99.9%, it is 0.1% of 43,200 = 43.2 minutes a month.
| Uptime commitment | Allowed downtime per 30-day month | Allowed downtime per year |
|---|---|---|
| 99% | 432 minutes (7.2 hours) | 5,256 minutes (3.65 days) |
| 99.9% | 43.2 minutes | 525.6 minutes (8.76 hours) |
| 99.95% | 21.6 minutes | 262.8 minutes (4.38 hours) |
| 99.99% | 4.3 minutes | 52.6 minutes |
Each extra nine cuts the allowed downtime by ten. The difference between 99.9% and 99.99% is the difference between a 43-minute outage during your month-end close and a 4-minute one. Read the SLA for how uptime is measured (scheduled maintenance is often excluded) and what the credit is: in Google’s case, days of service added to your subscription, not cash.
Common mistakes
- Thinking “the cloud” is one server somewhere. A SaaS product is dozens of components across several data centers: edge, application tier, database, backups, each with its own failure modes. Why it happens: the word suggests one place. Instead: when a vendor says “hosted in the cloud”, ask which provider, which regions, and what the recovery plan is if one region fails.
- Thinking multi-tenant means other customers can see your data. Tenants share the system, not the data; isolation is enforced in the software and tested in the vendor’s security audits. Why it happens: “shared” sounds like “visible”. Instead: ask for the vendor’s SOC 2 report or ISO 27001 certificate, which cover exactly this control, and check how the product handles your own sharing settings, which are the far more common leak.
- Blaming the vendor for your own outage. If step 1 of the Save table fails, nothing the vendor does will help. Why it happens: the symptom is identical, the app does not load. Instead: check the vendor’s status page and a second website before opening a ticket, and keep a mobile hotspot for the day the office line goes down.
- Reading 99.9% as “almost never down”. It is 43 minutes a month, and the SLA only pays out when the vendor misses it. Why it happens: three nines sound like a rounding error. Instead: convert to minutes, compare with the cost of an hour without the tool, and decide whether the Enterprise tier’s extra nine is worth its price.
Sources
- NIST, SP 800-145, The NIST Definition of Cloud Computing, September 2011.
- Google, Google Workspace Service Level Agreement, checked October 2026.
- Atlassian, Service Level Agreement for Atlassian cloud products, version effective April 30, 2026.
In three sentences
SaaS is the top layer of cloud computing: the provider runs a finished application on shared infrastructure and you reach it through a browser or an API without touching servers, operating systems or storage. One running system serves many companies as separate tenants, which is what makes a few dollars per user per month possible. An uptime promise of 99.9% allows 43 minutes of downtime in a 30-day month, so convert every SLA to minutes before you decide what it is worth.
