Skip to content

Software basicsExplainer

What Is a SaaS? Explained for Vadodara Business Owners

SaaS (software as a service) is software you use through a browser or app while the vendor runs it on their own servers. You pay a subscription instead of buying a licence, and the vendor handles hosting, updates and backups. In India, three rules shape every SaaS subscription you take: RBI’s auto-debit limits, GST on foreign software, and your duty for customer data under the DPDP Act.

Written by
Patel Software Editorial Team
Published
Last updated
Reading time
10 min

What does SaaS actually mean?

The standard definition comes from the US National Institute of Standards and Technology (NIST). It describes SaaS as using “the provider’s applications running on a cloud infrastructure”, reached from a web browser or an app, where you do not manage the network, servers, operating system or storage.[1] You only change settings that apply to your own account.

In everyday terms: the software lives on the vendor’s computers, not yours. You log in, you use it, and you pay for as long as you need it. Online accounting, email, CRM, payroll, video calls and most modern billing apps work this way.

NIST names two other “as a service” models that you will hear about. Platform as a service (PaaS) gives developers a ready platform to run their own code. Infrastructure as a service (IaaS) rents raw servers and storage.[1] As a business owner buying tools for your team, SaaS is the one you will meet most often. The other two matter mainly to whoever builds your custom software.

How is SaaS different from software installed on your own computer?

The difference is who runs the software and how you pay for it. Installed (or “on-premise”) software is usually bought once with a licence and runs on a computer or server in your office. SaaS runs on the vendor’s servers and is paid by subscription.

SaaS vs installed software at a glance
QuestionSaaSInstalled software
Where does it run?Vendor’s servers, reached over the internetYour own PC or server
How do you pay?Monthly or yearly subscription, often per userOne-time licence, plus paid upgrades or a yearly support fee
Who updates it?Vendor, automaticallyYou or your IT person
Who backs up the data?Vendor backs up their systems; check what that coversYou
Works without internet?Usually not, or only partlyYes, inside the office network
Access from outside the officeBuilt inNeeds extra set-up
If you stop payingAccess stops; you need an export planThe licensed version usually keeps working

Neither is “better” in general. A trading firm whose partners approve orders from their phones gets a lot from SaaS. A unit with weak internet on the shop floor may prefer some tools installed locally. Many businesses run a mix, for example installed accounting software alongside a SaaS CRM.

How do SaaS subscriptions get paid in India, and what are the auto-debit rules?

Most SaaS tools want to charge your card or UPI automatically every month or year. In India, those automatic debits run on an “e-mandate”, and the Reserve Bank of India (RBI) sets the rules. On 21 April 2026, RBI issued the Digital Payments – E-mandate Framework, 2026, which brings the older circulars on recurring card, UPI and prepaid-wallet payments into one set of directions.[2]

The parts that matter to a business owner:

  • The ₹15,000 line. After you set up a mandate once (with an OTP or similar check), recurring debits of up to ₹15,000 each can go through without a fresh check. Anything above ₹15,000 needs you to authenticate that debit.[2]
  • A warning before every debit. Your bank or card issuer must notify you at least 24 hours before each recurring debit, with the merchant name, amount, date, mandate reference and reason.[2]
  • You can stop it yourself. You can opt out of a single debit or cancel the whole mandate at any time, through your bank or UPI app, after authentication. Setting up a mandate must be free for you.[2]

Here is why this matters in practice. If your annual plan costs more than ₹15,000, the renewal will not go through silently. Someone has to approve it. If that person is travelling or the OTP goes to an old number, the renewal fails and the tool may lock. Put renewal dates in a calendar and make sure the card or UPI account is in the name of someone who will see the alert.

Do you pay GST on SaaS, including foreign tools?

Yes. For Indian SaaS vendors, GST is on the invoice like any other service. Software and IT services, including SaaS, are commonly taxed at 18%, a rate that tax commentators report was unchanged by the September 2025 GST rate changes.[4] Confirm the rate on your vendor’s invoice and with your CA.

Foreign tools are where many small businesses slip. When a supplier outside India provides a service to a GST-registered business in India, the Indian business usually pays the tax itself under “reverse charge”. This comes from section 5(3) of the IGST Act and Notification 10/2017-Integrated Tax (Rate).[3] So if you enter your GSTIN at checkout and the foreign vendor stops adding GST, the tax has not disappeared. It has moved to you.

GST also reaches into how you bill your own customers. Once your turnover crosses ₹5 crore, your B2B invoices must be registered on a government portal before you issue them. Our guide to GST e-invoicing for Vadodara MSMEs explains who is covered and the deadlines that catch businesses out.

Who is responsible for customer data stored in a SaaS tool?

You are. India’s Digital Personal Data Protection Act, 2023 (DPDP Act) calls the business that decides why and how personal data is used the “Data Fiduciary”. A SaaS vendor that stores or processes that data for you is a “Data Processor”. Section 8(1) says the Data Fiduciary is responsible for complying with the Act “irrespective of any agreement to the contrary”, including for processing done by its processor.[5] Section 8(2) adds that you may use a processor only under a valid contract.[5]

The DPDP Rules, 2025 were notified in November 2025 with an 18-month phased start, so most business duties apply from May 2027.[6] A proposal reported in January 2026 to shorten that window had not been notified as of October 2026, so check the latest position before you plan around a date. Either way, the practical habit starts now: when you choose a SaaS tool that will hold customer names, phone numbers or addresses, ask the vendor where data is stored, who can access it, how they report breaches, and how they delete it when you leave.

Separately, CERT-In’s 2022 directions require service providers, data centres and companies to report specified cyber incidents within 6 hours and to keep system logs for 180 days.[7] A serious vendor will be able to tell you how they meet this.

When is SaaS a good fit for a small business, and when is it not?

SaaS tends to suit work that many businesses do in roughly the same way. Accounting, payroll, email, video calls, appointment booking and basic CRM are good examples. The vendor spreads the cost of building and securing the software across many customers, and you get updates without lifting a finger.

It fits less well when:

  • Your process is genuinely unusual and the tool forces workarounds every day.
  • Your team works where internet is unreliable and the tool has no offline mode.
  • Per-user pricing grows faster than the value as you add staff.
  • You need two or three tools to talk to each other and they don’t.

The last point is common. A business can end up with one SaaS for billing, another for stock and a third for orders, with someone copying data between them. At that stage, connecting the tools or building one small custom piece is often cheaper than adding a fourth subscription. Our guide on when to move off spreadsheets to custom software covers the warning signs.

What should you check before you sign up for a SaaS tool?

Use this as a five-minute checklist on any tool that will hold business or customer data:

  1. Exit first. Can you export all your data in a usable format (CSV, Excel, PDF) at any time, without paying extra? What happens to your data after you cancel, and for how long?
  2. Price at your size in two years. Multiply the per-user price by the team you expect, not the team you have. Add 18% GST.
  3. Renewal and payment. Monthly or annual? If one debit is above ₹15,000, who will approve it?[2]
  4. GST on the invoice. Indian vendor with GSTIN on the bill, or a foreign vendor where you handle reverse charge?[3]
  5. Data and access. Where is data stored, who at the vendor can see it, is two-factor login available, and how will they tell you about a breach?[5][7]
  6. Offline and outages. What happens when your internet or theirs is down? Can you keep working on a mobile hotspot?
  7. Connections. Does it connect to the tools you already use, such as your accounting software or WhatsApp?

Is SaaS the same as custom software?

No. A SaaS product is built once and rented to many customers, so it follows the vendor’s idea of how the work should go. Custom software is built for one business’s process and is usually owned or licensed by that business. Some custom systems are themselves delivered over the internet, so they look like SaaS to the people using them, but only one company uses them.

The sensible order for most small businesses is: use good SaaS for the standard jobs, and consider custom only for the one or two steps where the products don’t fit or where tools need to be joined up. Our explainer on accounting software vs ERP vs custom finance tools applies the same thinking to finance.

Frequently asked questions

Is SaaS safe for a small business?

It can be safer than a single office PC, because good vendors run backups, security updates and monitoring. But you still control passwords, user access and what data you put in. Turn on two-factor login and remove ex-employees quickly.

Can I cancel a SaaS auto-debit myself?

Yes. Under RBI’s 2026 e-mandate framework you can opt out of a single debit or withdraw the whole mandate at any time through your bank or UPI app, after authentication. Check the vendor’s own cancellation terms too.

Why did my SaaS renewal fail even though my card works?

If the renewal is above ₹15,000, RBI rules need you to authenticate that debit. If nobody approved it, it will not go through. Debits up to ₹15,000 on a registered mandate do not need a fresh check.

Do I pay GST on a foreign software subscription?

If your business is GST-registered and the foreign vendor does not charge Indian GST, you usually pay 18% IGST yourself under reverse charge and can usually claim it back as input tax credit. Ask your CA to handle it in your returns.

What happens to my data if I stop paying for a SaaS tool?

Access usually stops, and the vendor deletes data after a period set in its terms. Export your data before cancelling and read the retention clause before you sign.

Is my accounting software SaaS?

It depends on how you use it. Accounting software installed on your own computer is not software as a service. If you log in through a browser to a version the vendor hosts and bills by subscription, it is. Some vendors offer both versions.

Sources and further reading

  1. National Institute of Standards and Technology. SP 800-145: The NIST Definition of Cloud Computing (September 2011). Defines SaaS, PaaS and IaaS. Older document, still the standard reference.
  2. Reserve Bank of India. Digital Payments – E-mandate Framework, 2026 (Master Direction). Paras 4, 6, 8 and 10: registration, pre-debit notice, ₹15,000 limit, no charge.
  3. GST Council. Notification 10/2017-Integrated Tax (Rate), consolidated copy. Reverse charge on services from a supplier outside India. Consolidated to April 2019; the Gazette text is authoritative.
  4. India Briefing (Dezan Shira & Associates). GST compliance for SaaS and cloud computing in India. Secondary source on the 18% rate and input tax credit. Confirm with your CA.
  5. Digital Personal Data Protection Act, 2023. Section 8: General obligations of Data Fiduciary (text). Unofficial reproduction of the Act; see MeitY for the official framework page.
  6. Press Information Bureau. DPDP Rules, 2025 Notified (backgrounder, 17 November 2025). Notes the 18-month phased compliance period.
  7. CERT-In. Directions under section 70B(6) of the IT Act, 28 April 2022. 6-hour incident reporting and 180-day log retention.
  8. Ministry of Electronics and IT. Data protection framework. Official page for the DPDP Act and Rules.

Running too many tools that don’t talk to each other?

If your team copies data between SaaS apps every day, we can look at whether connecting them or building one small piece would save more than another subscription. See how we approach custom software in Vadodara.