As companies wrestle with data privacy and compliance in the cloud era, hybrid SaaS deployments are emerging as a compelling solution. ModeOne CIO Jason Purviance examines the advantages and potential drawbacks of this approach, offering insights into what lies ahead for corporate data management.
The decline of traditional on-premises data centers continues, with companies migrating to cloud infrastructures offered by providers like Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform (GCP). The Covid-19 pandemic further accelerated this trend, as remote work necessitated scalable and accessible cloud solutions.
This migration is often driven by the desire for scalability, cost efficiency and the agility that cloud environments offer. The cloud offers flexible resource allocation, global accessibility and a pay-as-you-go model that aligns costs with actual usage.
The transition to cloud services has also funneled enterprises toward vendor-managed Software as a Service (SaaS) solutions. SaaS deployments offer ease of enrollment, reduced need for internal IT management and the promise of continuous updates without the overhead of manual installations.
However, the shift to vendor-managed SaaS applications also raises a critical question: How can enterprises maintain control over their data? When they adopt vendor-managed SaaS applications, they may entrust sensitive data — including customer information, proprietary business data and regulated data like electronic protected health information (ePHI) — to third-party providers.
This reliance raises concerns about data privacy, compliance with evolving regulations and exposure to potential security breaches. A hybrid approach is a potential solution for many companies, though it, too, isn’t without its drawbacks.
Reimagining SaaS deployment: A middle ground
Hybrid SaaS isn’t a new term or concept. Cloud providers offer marketplaces where software creators can publish their applications as deployable packages. These packages include all necessary components — compute resources, databases, networking configurations and security policies — required to run modern applications. Enterprises can deploy these applications within their own cloud environments, maintaining control over the underlying infrastructure and data.
Imagine, for example, deploying your company’s cloud CRM in your own corporate cloud, running the servers, with databases all set up from a single deployable package from a cloud marketplace, and with updates and enhancements arriving seamlessly from the marketplace on your schedule. All of your client records are stored in a database that you control and manage; you know who has access to it, but it’s in your cloud infrastructure. You still enjoy the benefits of not managing physical hardware or doing database updates, but you retain control, ensuring your data isn’t co-mingled with other tenants.
The Digital Playground: Children’s Online Safety & Privacy Compliance
Laws increasingly call on companies to specially protect kids’ data
Read moreDetailsAdvantages of deploying hybrid SaaS in corporate cloud infrastructure
Enhanced data privacy and compliance
Data privacy has become a paramount concern for enterprises navigating the increasing complexity of data privacy regulations. With the proliferation of data breaches and the tightening of global data protection regulations like GDPR and CCPA, organizations are under immense pressure to safeguard sensitive information. Traditional SaaS models, while convenient, often require companies to relinquish control over their data to third-party vendors, potentially exposing them to compliance risks and unauthorized access. By adopting a hybrid approach and deploying SaaS applications within their own cloud infrastructure, enterprises can reclaim authority over their data. This not only ensures adherence to stringent data privacy laws and residency requirements but also reinforces customer trust by demonstrating a committed stance on data protection.
Improved security posture
Managing the application infrastructure allows organizations to implement their security protocols, monitor for threats and quickly respond to incidents. It reduces reliance on third-party security measures, which may not align with the enterprise’s risk management strategies. While it may seem like a step back toward managing infrastructure, it’s highly likely that you are still doing that to some extent today.
Updates and maintenance
SaaS companies perform updates when it’s convenient for them, not always for the customer. Under the hybrid approach, enterprises can tailor the application’s update schedule to meet their needs, in alignment with their own maintenance windows and their training and release schedules.
Potential drawbacks of hybrid deployments
While the advantages of hybrid cloud implementations are many, decision-makers must consider downsides. Managing a hybrid cloud environment can be complex, requiring specific skillsets and roles suitable to managing a corporate cloud with both private and public cloud resources.
Security also remains a critical concern. Although keeping data in the customer-managed cloud while the application runs in a public cloud may solve many security concerns and issues, it may also introduce new security concerns. For example, hybrid models allow for greater control by keeping sensitive data in customer-controlled environments, but integration points like APIs and gateways can introduce vulnerabilities, and misconfigurations or inadequate monitoring can expose systems to breaches.
Hybrid clouds also require organizations to incur both the cost of the SaaS application itself (on-demand or other licensing/user fees) and the cost of maintaining their own cloud or on-premises environment to store the scoped data. For resource-constrained IT teams, maintaining a cloud or on-premises environment to host the scoped data may stretch resources or require additional hires. However, larger companies may already have an on-premises or cloud environment and would be able to absorb the overhead; for that reason, these organizations may be a better fit for the hybrid model.
In some circumstances, hybrid deployments simply aren’t appropriate. Some legacy applications, for instance, may require significant refactoring to function across multiple platforms. Industries with low sensitivity to data sovereignty or regulatory requirements may not benefit from the added complexity of a hybrid cloud; for them, simpler public cloud solutions might suffice.
Companies should look at their risk tolerance and their regulatory and compliance requirements to determine if a hybrid model provides enough benefits by mitigating risks, while at the same time considering any new risks that may be introduced. Hybrid clouds provide a compelling balance of control and scalability, but their suitability depends on specific organizational needs, workloads and capabilities.
Predictions for 2025 & beyond
Will more software vendors adapt by offering their applications through cloud marketplaces, providing deployment packages that enterprises can manage within their environments? Can we anticipate an increase in enterprises adopting this hybrid SaaS model? In spite of the potential drawbacks for at least some organizations, I think we can.
The evolution of the hybrid model blurs the lines between traditional SaaS and on-premises applications, fostering a new paradigm where control and convenience coexist and offering the distinct advantage of a symbiotic relationship. Vendors benefit from broader distribution and simplified update processes, while enterprises regain control over their data and compliance posture.
Embracing a balanced future
The journey from on-premises data centers to vendor-managed SaaS applications has been marked by trade-offs between control and convenience. The emergence of marketplaces and the hybrid cloud offers a middle ground between the hassles and costs of managing a physical data center and the risks of trusting a SaaS software company with your data. While traditional SaaS solutions are here to stay, companies that choose the hybrid option can enjoy all of the benefits of modern applications while maintaining sovereignty over their data.
In a world where data is their most critical asset and regulatory landscapes are constantly changing, organizations must prioritize control and security without hindering innovation. For many, the hybrid SaaS model represents a step toward a future in which enterprises are no longer forced to choose between agility and governance — why not have both?
Jason Purviance is chief information officer of ModeOne, a smartphone data discovery firm. He is a seasoned litigation professional who has spent the past 20 years in a variety of litigation technology roles, including litigation project management, evidence collections, processing, hosting, productions, IT and information security. 
