At the end of October 2005, in an internal Microsoft memo entitled "Internet Software Services", Bill Gates remarked that "The next sea change is upon us" and exhorted his colleagues to take the opportunity "to utilize the Internet to make software far more powerful by incorporating a services model."..
We are now starting to see the effects of that predicted sea change, with the recent launches of offerings including Google Apps and Microsoft Office Live. This article briefly examines new software concepts such as "software as a service" and some of the legal and commercial issues surrounding them.
What Is "Software As A Service"?
Software as a service ("SaaS") is an internet-based delivery model for software applications. The relevant software application is hosted, maintained and made available by a vendor to end-users over the internet via a browser or other "thin client". SaaS is typically priced on a per user subscription basis, frequently with tiered pricing for increasing functionality (which may include additional software applications or enhanced support), such as is the case with Microsoft Office Live and Google Apps.
SaaS is generally considered to be a new term for the application services provider ("ASP") delivery model, although some commentators distinguish between SaaS and ASP on two main grounds: (i) the ASP model evolved by adding a thin client front-end (e.g. a browser interface) to existing software, whereas SaaS was designed from the outset to be deployed over a network; and (ii) an ASP provider typically hosts a separate copy of a software application for each customer (which therefore may be customised in different ways). In contrast, SaaS deploys one copy of the application, albeit with different customer's data on different virtual areas of the same server, with the result of upgrades being simultaneous.
Utility Computing
Utility computing, also known as on-demand computing, is a delivery model for providing commoditised computing resources (i.e. storage and computation) as a metered utility in much the same way as the traditional utilities of electricity, gas, water and telecommunications. Utility computing offers a high degree of flexibility for the customer – the resources are available on demand and the customer is only charged for the resources it actually uses.
Frequently, the provider of utility computing services will utilise a cloud computing architecture. An example of this is Amazon Web Services' "Elastic Compute Cloud", a utility computing service which provides computational capacity for developers at hourly rates according to three processing capacity bands and which is provided on Amazon's cloud computing infrastructure.
Cloud Computing
Cloud computing is a systems architecture model whereby computing services are provided and applications are run not on a user's computer, but on infrastructure located within the "cloud" (i.e. within an external network, generally considered to be the internet). To provide adequate redundancy and performance, this infrastructure is comprised of a huge network of machines in one or more data centres.
Amazon's Elastic Compute Cloud resource and IBM's forthcoming "Blue Cloud" service both offer an outsourced cloud computing environment for developers and businesses. Such services allow customers to minimise expenditure on hardware and associated maintenance, instead renting further resources from the provider as and when required.
Google's SaaS offerings Google Maps and Google Apps are provided using cloud computing (utilising the huge network of servers which Google created in order to deliver fast search results).
What Legal And Commercial Issues Should You Be Aware Of?
- Software licensors should check that their licensing
terms permit or prohibit (as required) use via cloud
computing (i.e. use on a network of connected processors) and
SaaS delivery methods. Similarly, businesses hosting third
party software applications on cloud computing resources must
ensure they do not breach licence terms which restrict use to
a single server or processor and must be aware of per-server
or per-processor charges.
- In contrast to a licence and support structure for
traditional CD-based software, the SaaS (including ASP)
delivery model may expose a provider to additional risks in
the form of availability service levels and service credits
(where given) and the warranty of reasonable care and skill
implied in the provision of services.
- The costs for SaaS differs from "traditional"
software and maintenance, usually being structured as a
pay-as-you-go model with customers being able to turn off the
service or upgrade or downgrade to different
price-functionality plans at relatively short notice.
Customers should be aware that the flipside of the modest
costs of SaaS is that the provider's limitation of
liability (usually a multiple of charges paid in a set
period) will be correspondingly lower.
- Entities using SaaS and utility/cloud computing services
need to be aware of the risks inherent in storing data and
documents with a service provider: Does the provider offer
suitable confidentiality undertakings? Does the service
enable the user to discharge its compliance obligations
(particularly in the context of disaster recovery)? Are the
user's data protection notification and
customer/employee privacy policies adequate to cover the
exchange of personal data with the service provider? Does the
provider mirror data to a back-up data centre to mitigate the
problems of data loss or system failure.
- The reliability of SaaS and cloud computing services
remains an issue, particularly for business critical
applications. For example, Amazon's Simple Storage
Service (a cloud computing-based data storage service)
recently suffered a two hour outage. Although providers may
offer service level agreements and service credits, such
regimes will never adequately compensate customers for loss
of business or reputation, emphasising the need to consider
failover or redundant systems.
- Whilst the three delivery models described above have
been made possible by the increase in connection speeds to
the internet, they depend on an internet connection. This
again raises business continuity concerns but also means, on
a practical level, that different solutions need to be used
in areas of poor internet connectivity.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.