Trust in SaaS (Online Subscription Software)

These days, there are tens of thousands of SaaS services you could potentially use for your business.

What to choose?

Well, normally people look for features, integration capabilities & usability. But let me share why you may want to look beyond features and into areas typically only considered by 'enterprise' companies.

* Backup vs Disaster Recovery *

Did you know that when most providers refer to "backup", what they really mean is "disaster recovery"? Let me explain.

When you think of backup, you think of being able to go back to any point in time, e.g. due to you or your staff accidentally doing something like deleting all your mail, overwriting the wrong records etc.

Well, when a provider thinks of backup, they are thinking, in 99% of cases, how they do that for mistakes THEY make, not you.

Often, there is actually no "end user" backup on these systems at all, even if you ask their support company to do it. Basically, you're Short of Luck. So check that.

* Provider-Independent Backup: *

OK let's assume you do have backup sorted with this provider. Can you actually back up OUTSIDE of that provider?

And if so, in what format?

And is it complete?

Can it be done automatically?

Again, in 99% of cases, you are not going to have automated, complete, provider-independent backup.

This is especially the case for anything that resembles a 'database' (think CRM, accounting system etc.). Unless a specific import tool has been built by another provider (and even then, it's usually incomplete) - e.g. going from Xero to MYOB - you're, at best, going to be able to export a limited amount of data.

Let's take the CRM example. CRM involves /relationships/ - that relationship data is usually not exported? Why? Because doing that requires exporting a relational database structure. That's easy when you own your own database, but when you're using someone else's? They're just not going to give you access that way, and if they do, it won't be usable in any other software anyway. They're going to give you CSVs.

So they'll export your leads, your contacts, your accounts, your deals. But the 'links' between them will disappear. Or might be written as text only, which means you'll have to go through, record by record, manually lining them all up again in another system.

History is usually lost. Prior purchases, lost. Prior tracking data, lost.

Now some systems are better than others - accounting systems are pretty good, project management systems aren't bad (many include import tools for specific competitors). CRMs are really tricky.

(Yes, you can often write custom export/import tools, but this is usually a 5-figure investment for any complex system).

But that doesn't mean you shouldn't try - and also consider your worst case.

What if your email provider shuts you down? Or your CRM just deletes your data with no notice, backup or apology (like happened to me with Pipeliner CRM in 2016 - no joke, a month of data just disappeared. The provider fucked up, but didn't own it.) Or they go out of business. So many things could happen.

Do you even have those CSV files (which you usually need to export, manually, ahead of time)? And if you do, how quickly can you get up and running?

I have manual recurring processes (weekly or monthly) to export data from all my cloud systems, wherever possible. In some cases, I maintain active synchronisations to other systems (PieSync is useful for this) just for backup. It depends how critical the data is (usually very) and especially how critical getting back up to speed after an outage is (usually more critical the larger you are)

* Support Response *

I just got an email back from OntraPort regarding a support request I emailed them on the 11th April, AND followed up with. That's no reply for over 2 weeks. For a provider that apparently provides themselves on having "great support" (trust me, Clickfunnels is worse, and 99% of software providers are worse than this).

What support is promised? What support is actually delivered? What is actually contracted in terms of response and resolution times? Usually nothing. Providers usually boast about their uptime - but that's whole of system uptime. It doesn't mean the system isn't up, but your account has an issue.

* Security *

One of the great things about the cloud is being able to delegate maintenance, support & security concerns to the cloud provider. But how good are they at doing this?

Do they use SMS for 2-factor authentication? If so, you may be subject to a SIM swap attack (increasingly common).

Do their customer support bypass 2FA, or ask weak guessable/findable questions if you call or live chat them? Usually yes. What about SMS or phone calls? Did you know your caller ID is trivially forgeable?

Is your email account a single point of weakness for authentication (especially password resets) into other systems?

It's usually the case that their "hard" security (all the technical bits) is way better than yours if you DIY. But their "soft" security (the human factors) are usually worse.

There's not much you can do about this, but picking providers that have an 'Enterprise' plan, even if you're not on it, is often a good proxy for them thinking seriously about the types of concerns their CIO customers are going to be asking for.

Rackspace was incredibly difficult to get account reset support out of, for instance. This is a good thing.

At the end of the day, usually all you can do is have good backup (see above)

* Going out of business aka Vendor Risk *

Yes, there are a plethora of SaaS businesses, but the vast majority of them are below $1M in revenue. That may sound OK, until you understand the SaaS business model and all the acquisition, R&D and support costs involved with it and realise that $1M is often barely profitable. And then take into account multi-10s-of-percent annual churn many of. them experience, and you're potentially building your business on a house of cards that may not exist tomorrow.

Even being large doesn't guarantee you're immune from this. Look at this site for an example: https://killedbygoogle.com

A good proxy for long-term stability is to check CrunchBase and examine their funding, team size, founding year and revenue figures, if available (or google similar information if you don't want to pay for enhanced Crunchbase info).

Once companies are above $1M/year, they're far more likely to stick around. Above $10M/year it's virtually guaranteed.

There's a lot more to this, but these are the biggies. Hope this helps!

I am David from Automate Your Business. If you need help implementing this - the combination of people, process & technology required to support streamlined communication SYSTEMS - then give me a call on  0404 027 748 or or email me at  [email protected].