In today’s world, the multitude of Software and applications one needs to use for business continuity is enormous. It is no longer possible to install every piece of Software on one’s Desktop or Server, customize and configure it. Therefore, SaaS offerings provide a ready-made framework available on the Cloud, which we can start utilizing after configuring the parameters, coding programs, or designing databases – tailored to our needs. Licenses enable us to start using the Software on demand – the variables being the number of users, the features we wish to use, etc.
This article will discuss Data Security and Compliance for SaaS Businesses and all details around it. Read on!
Table of Contents
What are the Apprehensions?
One of the main apprehensions is whether the programming that we do and the data we store are safe and secure. Does it conform to standards? Could my intellectual property (the programs, the data structures, etc.) and data be prone to hacking by a 3rd party? The trust still needs to be fully established, and it has been more than ten years since the phenomenon first appeared.
The major apprehension is regarding pre-programmed modules that are provided for statutory purposes. For example, many SaaS applications are available today to complete GST formalities and other statutory compliances across the globe.
Compliance is Mandatory and Provides a Competitive Edge
Several regulations are in place today that the service providers are liable to follow to the last comma. SaaS compliance implies conforming to the cumulative sum of all these regulations defined by the statutory authorities. The ultimate aim, of course, is to go beyond the regulations to provide a competitive edge to the organization. When we store our jewelry in a bank locker, we usually do so in reputed banks because we trust them. We trust them to follow compliance regulations regarding fire protection, proper locking systems, non-access of my lockers to their staff, etc. In SaaS, compliance is also increasingly emerging as the competitive edge for the service provider and the companies utilizing their services. No wonder for a highly competitive SaaS market, 41% of companies offering SaaS services have reported “Management of compliance” as a high-priority business goal – during a recent survey.
The Key Factors Influencing the Need for Compliance
- Secure Protection: Secure Protection is necessary for both companies’ data and data pertaining to their customers.
- Compliance with Laws: There are certifications available, though some are optional. It all depends on the country the organization is located in and the company it is providing service to. A Singapore-based SaaS agency serving a customer in Bangalore must comply with Singaporean and Indian regulations. The compulsory certifications include – for example – GDPR if doing business with European customers.
- Data Security: Leakage of customer data can lead to a global uproar. For example, Marriott lost data of about 38 crore customers globally in 2018 due to a data breach.
- Financial Compliance: Every jurisdiction has laws in place for accounting standards. With increasing reliance on SaaS providers, it is imperative to ensure that these standards are followed. For example – recognition of revenue, computation of taxes, etc.
- Recognition of revenue is the most complicated piece due to discounts, promotions, combination bundling, and differential pricing.
- Following proper book-keeping standards like calculating depreciation, stock valuations, Debtors, allocation of revenue heads, capitalization, balancing assets and liabilities, P & L accounts, month-end reconciliations, and computation of taxes are also potentially contentious.
- Data Integrity. Enforcing proper controls to prevent manipulation or erasure of data stored within databases.
- Processes for storing, retrieving, and maintaining data integrity must be clearly defined.
- Any data-related issue reported by internal users or external customers must be recorded, stored, rectified, and a Root Cause Analysis must be performed to ensure no recurrence.
- No data should get erased – whether accidentally or intentionally. If it happened due to machine malfunctions, accurate data should be restored from backup devices.
- Data integrity must be inspected periodically by individuals not responsible for maintaining the data through well-established monitoring procedures.
- Policies have to be set up.
- Service Level Agreements or SLAs must be signed with the service provider to compel him to follow the above.
- Data Security: Prevention of unauthorized access. Controlled access through IDs and passwords – preferably a combination of passwords and OTP to registered mobile numbers – only to authorized persons. For example, sensitive customer data like age, income, and credit card numbers should not be accessible to anyone within an e-commerce company.
- Data has to be encrypted appropriately so that hacked data is unreadable.
- Automation: plays a vital role in enabling Data Security. Controls can easily be checked with the help of automated systems.
- Data encryption plays an important role.
- Hash totals will raise the alarm if a portion of the data has been compromised since the overall totals for a data block will not match.
- The company could devise other methods to check the data periodically, like comparing the actual data with acceptable ranges. If a diagnostic center is storing the Blood Haemoglobin concentration of a patient, it should fall within a well-defined range. Data outside the range would imply that the data was either tampered with or accidentally corrupted due to machine malfunctions. Or, there could be internal checks to ensure that the revenue has been recorded accurately or that the total of Debits and Credits match.
- Backup of Data: Storage at remote sites and restoration drills should be regularly conducted to ensure that accurate data is restored without loss in the event of data damage from a fire or other natural causes.
- Disaster Recovery Sites should be activated in another city in case life is disrupted or the building is damaged due to earthquakes, floods, etc.
- Enforce (define policies and standards, appoint individuals accountable for compliance), monitor compliances, incorporate compliance in the development lifecycle, handle incidents efficiently, train the staff, and conduct regular reviews by top management. These are key determinants to ensure SaaS compliance.
- Storage of Data. Certain countries like India have legislations in place for the data to be stored within their geographical limits. These laws have to comply with Regulations.
GDPR
The General Data Protection Regulation (GDPR) defines the methodology and processes to store the personal data of European Union citizens. It also applies to companies doing business with countries inside the EU. It comprehensively covers viewing data, erasing data, audit trails, and declaring certain data entities as confidential and owned by the users.
California Consumer Privacy Act (CCPA)
A statute, the California Consumer Privacy Act (CCPA), applies to the State of California that amplifies the protection of data and data privacy for residents of the State. Similar to the GDPR, a citizen is within his rights to demand to know the nature of data pertaining to him as an individual that is being stored, the right to insist that certain elements of data are deleted within a stipulated time, demand that a particular piece of data not be sold (even if he had earlier agreed). It applies to all residents irrespective of color, race, or ethnic identity.
GAAP
GAAP (Generally Accepted Accounting Principles) is a framework of accounting rules and practices set by the Financial Accounting Standards Board (FASB). The US mandates strict compliance with these standards, and GAAP defines criteria to ensure accounting statement consistency, transparency, and comprehensibility.
IFRS
The International Financial Reporting Standards (IFRS) are similar guidelines to the EU. It includes guidelines for P & L, Balance Sheets, Revenue recognition, Cash flows, legal compliances, and Data Security norms. The purpose is to enforce global consistency and transparency and is followed by many countries, including South Korea, Brazil, and India, besides the European Union.
SOC 2 is certification followed by the Systems and Organization Controls to report on individual companies’ compliance.
The PCI-DSS (The Payment Card Industry Data Security Standard) certification ensures that credit card details are stored confidentially and safely.
ISO 27001 certification provides an optional framework to certify proper tools and automated systems usage.
ASC 606 defines the criteria for declaring the revenue. It has been jointly developed by the FASB (Financial Accounting Standards Board) with the International Accounting Standards Board (IASB). It provides a 5-step process for recognizing revenue accurately.
Conclusion
It is high time that all SaaS providers shift to a discipline of Data protection, and users insist on the same because laws are increasingly getting more stringent. Failure to comply would invite lawsuits and penalties, but, more importantly, both the service provider and the data owner will suffer a loss of reputation and credibility. The case of Enron or Satyam in India is too recent to forget. Moreover, companies who follow these regulations stringently will positively be expected to hold a competitive edge.
