Glossary · simply explained

IaaS, PaaS & SaaS

The three cloud service models differ in who operates what — and where responsibility, cost and control sit.

IaaS, PaaS and SaaS are the three classic cloud service models: infrastructure as a service delivers virtual infrastructure (compute, storage, network), platform as a service a managed development and runtime platform, software as a service finished applications by subscription — from CRM to collaboration suites.

The models differ mainly in the division of responsibility: the higher the model, the more the provider operates — and the less control, but also the less operational effort, remains with the customer. Security stays a shared task in all three models.

The three models compared

With IaaS you rent building blocks: virtual machines, block storage, networks. Operating system, middleware, patches and applications remain your task — maximum flexibility, maximum operational responsibility. PaaS abstracts one level further: the provider runs runtime, databases and scaling; the team delivers only code and data. SaaS finally delivers the finished application — operation, updates and availability sit entirely with the provider.

The shared responsibility model draws the line: the provider secures the cloud itself (data centers, hypervisor, platform), the customer everything in the cloud — identities, access rights, data classification, configuration. Most cloud incidents arise on the customer side of this line: open storage buckets, overprivileged accounts, missing MFA.

Selection criteria in practice

Assess operational depth honestly: without a platform team, PaaS/SaaS is usually safer than raw IaaS.
Check exit and portability: data export, open standards, contract terms.
Plan connectivity along: private interconnects instead of internet for critical workloads.
Identity and access concept first — it is the customer’s task in all three models.

Frequently asked questions about IaaS, PaaS & SaaS

Where does the responsibility boundary run in IaaS, PaaS and SaaS?

Along the shared responsibility model: the provider is responsible for the security of the platform, the customer for secure use — identities, permissions, data, configuration. IaaS adds operating system and patches; with SaaS, mainly access and data control remain.

What is FaaS or serverless?

A continuation of PaaS: functions as a service executes individual functions event-driven, billed per invocation, scaling included. Servers still exist but are fully abstracted away — ideal for event-driven workloads, unsuitable for long-running processes.

Which model is most economical?

That depends on utilisation and team: SaaS almost always wins for standard processes, PaaS for self-developed applications without a platform team, IaaS for special requirements or migration interim steps. The hidden costs sit in operations for IaaS, in licences and data dependency for SaaS.

How secure is data in SaaS applications?

The platform security of large providers is usually high — the real risks lie in usage: weak access control, missing MFA, overly wide shares, uncontrolled integrations. Add privacy questions: processing location, DPA and transfer safeguards need checking.

What role does the network play in cloud service models?

Connectivity decides user experience and data security: critical IaaS/PaaS workloads benefit from private interconnects with guaranteed bandwidth instead of internet paths; SaaS traffic belongs on local breakouts with SASE controls instead of being hauled through the central data center.