Recently, a client asked the question “If I were to deploy a software product as a SaaS service, what would be things I would need to consider?” I thought about our experiences here and sent him the following list:
- Are you running your hosts or is someone else running them?
- How many and what operating system?
- How big are they? Processors, memory, disk?
- Where is power coming from and how is it protected?
- What physical security? Who has physical access to machines?
- How are they connected to the Internet? Through whom?
- What if the connection dies?
- What happens when a host has an issue?
- Where is the data stored?
- How is it backed up and what are the backups stored?
- How does a fresh system get built and a backup restored?
- Where is the DNS hosted?
- What domains are being used?
- How are you protecting your IP?
- What about outgoing email services?
- What about certificates?
- Who has logical access?
- What types of access do they have?
- Firewalls?
- Logging and auditing?
- Compliance with anything? PIPEDA? EU?
- Support encryption-at-rest?
- How are the systems patched? How often and by whom?
- Who decides on which threats to address?
- How do changes to software get tested?
- How do changes to software get deployed to the servers?
- How are different users separated from each other? Logical? Physical?
- What service level agreements can you support?
- What are your plans for achieving these service levels?
- What happens when there’s a failure?
- How do people contact your support?
- Do you have support levels?
- Do you have an FAQ that can easily be searched and updated?
- Allow customers to help each other, or contact only through you?
- What set of browsers are supported? Apps or responsive?
- Who decides which to add/remove from long-term support?
- How is development done? Agile? Waterfall?
- How often is software deployed?
- How is team managed to ensure long-term support for codebase?
- How to deal with custom, one-off requests from customers?
- How to deal with improvement suggestions from customers?
- How are customers billed? What are the terms of their agreements?
- What process is followed to upgrade software to newer versions of language/libraries?
- What processes are in place to avoid regressions?
- How are accounts integrated with billing?
- What process is used to onboard? Are trial accounts offered?
- Do accounts have limits which “level the playing field” operationally?
- Is multilingual supported? If so, how?
- What metrics are collected for managing short- and long-term system performance?
- What mechanisms are in place to identify and solve catastrophic system issues?
- What are rules around customer non-payment?
- How are credit cards charged?
- How are customer contacts managed and updated?
- How is old data purged?
- What about customers who have cancelled and want proof of data destruction?
- What about customers wanting a data dump?
- Does support have a ticketing mechanism?
- How does support maintain connections with customers?
- How is the product sold?
- How are demos done? With what data?
- How are potential customers identified and managed?
- What third party systems and APIs are needed to support operations?
Let us know if you are interested in a discussion of any of these. Also, we’d love to hear your thoughts about omissions from the list.