Home › SaaS Resources

B2B SaaS Software: The Work the Vendor Does and the Work You Keep

B2B SaaS software is business software that the vendor operates and your staff use through a browser. That single fact shapes how you buy it, how you secure it, and how you eventually retire it. This page focuses on the division of work between you and the vendor.

What changes when the software is not yours

You do not patch it, and you do not choose when it changes. Updates arrive on the vendor's schedule, and sometimes they move a button you had finally learned to find.

In return you skip the servers, the backups and almost all of the upgrade work. That trade suits most small teams, because none of that work was making money. It does mean your only real influence sits in the contract rather than in the software itself. Read the change notes when they arrive, since a quiet update can move a setting that your team relies on every day.

The admin work that is still yours

A tool that nobody administers stops being useful within a year or so. These five habits prevent that. An hour each quarter is usually enough to keep the list accurate.

• Accounts. Add people on their first day and remove them on their last one.
• Roles. Give the smallest access that still lets somebody do the job.
• Sign-in. Turn on the extra verification step everywhere that it is offered.
• Records. Keep a list of every tool, its internal owner and its renewal date.
• Exports. Pull a copy of your own data on a schedule that you set.

Who is responsible for what

Security in a hosted product is shared. A rough division helps you ask the right question of the right party:

1. The vendor is responsible for the servers, the application's own security, backups and recovering from failures.
2. You are responsible for who has accounts, how strong their sign-in is, what data you put in, and what your staff do with it.
3. Both are responsible for noticing problems: the vendor watches the service, and you watch your own accounts for strange activity.

Most real incidents involving hosted software come from the second group: shared passwords, old accounts left open, and data exported to places it should not go.

Questions to ask about security

Ask where the data physically sits and who inside the vendor can reach it. Then ask what happens to your copy of that data after you leave.

Ask for plain answers rather than a badge. A page of logos is not a security review; a named person and a written process are. Ask how they tell customers about an incident, and how quickly they do it. Then ask who owns your account if the vendor is acquired, because that question is much simpler to ask early.

Retiring a product cleanly

Plan the exit while you are happy with the product. Know how to export, in what format, and how long the vendor keeps your data afterward. When the day comes, export first, confirm the file opens in something you own, tell the staff, close the accounts, and write down the date you closed them.

When hosted software is not the right fit

Some organizations are bound by rules that require data to stay on equipment they control. Others depend on software that must work without a network connection. In those cases, hosted software may be unsuitable, or only suitable for some functions. Check the requirement before you look at features.

A short checklist for the first week

• Set up an administrator account, plus a backup administrator.
• Turn on extra sign-in verification for everyone.
• Create roles before inviting users.
• Add the renewal date to the shared calendar.
• Run a test export and open the file.
• Read the vendor's status page and subscribe to alerts.
• Record the vendor's support address and hours.

Each takes minutes and prevents problems that are tedious to fix later.

Questions about availability

Ask the vendor how it measures availability, what counts as downtime, how maintenance is scheduled and announced, and where you will be told of problems. Ask what you should do if the service is unavailable during an important deadline: Is there a backup way to export or view key records? Planning for the occasional outage is part of using hosted software, and it costs little compared with improvising when it happens.

Next steps

Compare this with the business-platform view, read about shared team access, see how a CRM connection is handled in one product, or return to the definition of software as a service.

How Microsite Generator handles this

You can invite teammates into one shared account with the same sites, leads and plan, and you can sign in with Google. Connecting a CRM needs no sign-in screen at all.

You paste one credential that you generate yourself, and a Send test lead button proves the connection before any real lead flows. Every delivery is signed.

Sites are capped at up to 25, 50 or 100 pages each, and the compliance gate runs before anything publishes. Every page is checked by checks that draw on Google Search Essentials and other public standards and on our own quality rules.

Deliveries to HubSpot, Zoho and Pipedrive update an existing contact by email, instead of creating a second record for the same person.

Updated October 2026