The Truth About Hosted Software Packages
Should you consider hosted or Software As a Service software applications for your nonprofit? There are a lot of conflicting and often inaccurate messages out there: They're not secure! Use them – they'll replace your IT staff! Perhaps they'll change your life… or perhaps they're evil. What's the truth? We investigate.
Once upon a time, you could pretty much assume that when you bought a software application, it would come in a box and you would install it onto your computer.
Times have changed. Now there are a huge number of options. Software packages might still be simply installed onto a single computer, but they might also be installed onto a server and multiple staff desktop computers so that a number of people can use the software. Or, the programs might even be installed on your own Web server to be accessed by your staff over the Internet.
And there’s a whole other possibility these days: hosted software packages. Under this model, you pay the software vendor to provide online access to software. The software, and all your data, is stored on the vendor’s servers. You don’t have to purchase any hardware, the vendor handles software updates and data backups and your staff can access the system from anywhere there’s an Internet connection. All sorts of software are available as hosted packages, from straightforward tools, like file-sharing applications or online payment processors, to enterprise-wide software tools, like constituent databases or accounting packages.
There are a lot of conflicting and often inaccurate messages out there about hosted software: They're not secure! Use them, and you won't need to worry about IT anymore! Everyone should use them! No one should use them!
In truth, hosted software can be a convenient option that’s a particularly good fit with the needs of many nonprofits. However, they're not for everyone. A fairly complicated set of considerations is involved. How do you decide if a hosted package is right for you or if a more traditional installed package is likely to be a better fit? In this article, we walk through the factors you should consider.
Hosted Software Alphabet Soup
Before we dive in, let’s talk about two abbreviations you may run across that apply to hosted packages: SaaS, an abbreviation for "Software as a Service," and ASP, short for Application Service Provider. There are some subtle technical differences in these terms in some people's minds, but they blur together to be indistinguishable in common usage. For most practical purposes, “SaaS,” “ASP” and “hosted software” all mean the same thing: The software package and your data are stored on the vendor’s servers, and your staff accesses it over the Internet.
Core Differences Between Hosted and Installed
Hosted software packages have some fundamental differences when compared to installed ones.
Some hosted software — for instance, Google Docs or Microsoft Office Live — is free. But beyond those, hosted packages nearly always require a monthly or yearly fee as “rent” for the system. This fee is often scaled to usage, and is likely to be based on some combination of number of system users and how much data you store in the system. In comparison, software packages that are installed on your own computers are likely to be priced as a single, up-front licensing cost, with yearly “maintenance” fees to cover support and software updates. This means that you typically pay less for a hosted package up-front than you would for a comparable installed package, but more over time in ongoing vendor fees
Easy remote access.
Hosted applications can, by definition, be accessed by your staff from anywhere they have access to the Internet and a browser. This can be convenient, and can facilitate collaborative work between geographically disbursed teams, office locations or partners. It’s possible to provide remote access to an installed application — for instance, some are installed to your own Web server, or you could set up remote access to your network using a virtual private network (VPN) — but these solutions will generally require someone technically savvy to set up and maintain.
Hosted applications provide a Web-based user interface. Historically, Web interfaces have been much more limited than software that’s installed on your desktop. Web interfaces are improving rapidly with the adoption of new technologies, but they are still often less efficient to use, especially for complex tasks like ad-hoc reporting or extensive data entry.
Configuration and customization.
With a hosted application, you’re limited to the configuration tools that the vendor has created for you. These could be extensive and allow you a huge range of possibilities — for instance, Salesforce.com is well known for being highly configurable to meet many different needs. But if the vendor hasn’t already planned for flexibility that can cover your needs, it’s likely to simply be impossible to meet your needs with a hosted application. There’s no guarantee that an installed application can meet them either, but some offer more options than others. For instance, if you install your own open-source application, you can hire a developer to update an application to suit your needs.
What happens if the vendor goes out of business? Hosted software puts you at more risk in this area than installed software. If the software is installed on your servers, you can continue to use it indefinitely, even if the company goes under (although without maintenance and support), allowing you to find and move to a new solution at your own pace. While a hosted application is unlikely to disappear overnight, regardless of what happens with the vendor, you may have a much smaller window before you lose the use of the hosted software.
Will a hosted software package fit well with your current IT processes and the other software packages that you’re using?
System maintenance and backup.
With an installed system, you need to do your own backups, maintain your own hardware and install any software updates. You’ll also need to plan for the possibility of catastrophe — if your office were to burn down, would there be an off-site copy of your data? In a hosted environment, the vendor will take on all the routine maintenance activities, taking a load of responsibility from you and saving a notable amount of staff time. However, make sure you're comfortable with their plans — for instance, how often will the data be backed up and where will it be stored — and always create your own backup as well in case something were to happen to the vendor or the software application.
Reliability and uptime.
In order to use a hosted application, your staff needs to have reliable high-speed access to the Internet (at least a DSL or cable modem connection); otherwise, this option simply won’t make sense. Beyond that, you are counting on the vendor to keep the software package up and running. While it’s certainly worth checking with other customers to see if the software has been reliably up and functional in the past, there’s generally no reason to suspect that it will be less reliable than a package installed on your servers. In fact, unless you have a substantial IT team who ensures that your network and internal applications are continuously available and functional, an established hosted application may be more reliable than an installed one.
Control over your environment.
For many organizations, it's a big benefit to have a vendor doing all the work to maintain the software and keep it up and running. However, this means that you lose some control. For instance, most software packages have to go down occasionally for scheduled maintenance, and you may not be able to control when this is for a hosted application. While these scheduled downtimes are typically at low-use times, it could be the one 3 a.m. on a Sunday that you were planning to do all your data entry. Similarly, in a hosted environment, you're likely to get all the software upgrades whether you want them or not — which usually works out fine, but occasionally could change functionality in a key area at a sensitive time.
Data access and integration.
As with any application, check how you’ll be able to access the data. Most hosted solutions allow you to import and export data in common formats, such as a Microsoft Excel spreadsheet, or some provide application programming interfaces (APIs) or other functionalities that allow a programmer to create integration programs. As with any package, it's important to check specifically which data fields you can access. When you use a hosted application, you’re completely at the mercy of the vendor as what data you can export or import. If you need to do tight integration with one or more systems that are already installed on your network, it may be easier to integrate them with another installed package.
Privacy and Security Considerations
When you ask people about hosted software, they often mention concerns about privacy and security issues. Hosted applications are generally quite secure — much more so than many perceive — but there are certainly important considerations in this area, particularly when it comes to data privacy.
Hosted software packages generally provide as much or more security against unauthorized access to the data as installed applications. The vendors who provide hosted solutions can typically afford a much higher level of security — with secure servers and in secure facilities — than any single nonprofit can provide for their own installed system. And in truth, much of the data that nonprofits store is actually not particularly sensitive, compared to things like credit card transactions and credit checks, which constantly take place over the Internet. If you have critically sensitive data (or especially if you need to be in compliance with particular regulations, like HIPAA), take care to investigate the vendor’s security measures and weigh the risk of a breach. However, take care to weigh it against the security that you could provide for an installed application in-house and your own risk of a breach.
No reputable vendor will use your data in blatantly unauthorized ways — for instance, by sending solicitation emails to your clients. However, they do have your data, and it’s important to be clear on what they might do with it. For instance, Google specifically creates a vast data store from the hosted applications they offer that allows them to understand and track Internet activity. Does that hurt you? Not directly, but some people find the large amount of data Google collects to be unsettling and are concerned as to what they might do with it in the future. Depending on your mission and your comfort level, you might opt to use only vendors who pledge, in writing, not to use your data in any way.
Protection against subpoenas.
If you need to ensure that the government can’t see your data, then that’s another story. No vendor will defend your data against a court order to turn it over. If your mission puts you at risk of a subpoena — for instance, if you provide legal aid to Iraqi refugees — and you’re willing to go to court to defend your data, then a hosted application is absolutely not the right fit for you. You’ll need software that allows you to store the data on-site on your own servers, and you’ll need to build in your own
How to Decide
Will a hosted solution work for you? As always, it depends on your needs and situation. It rarely makes sense to dismiss the entire idea of hosted packages as inappropriate for your organization. Weigh user interfaces, security, features, customization and integration needs, and the amount of control your organization needs. Hosted applications have come a long way over the last few years.
If your organization is small and without much technical support, a hosted package may be a good fit — if it provides the functionality you need. Hosted software tends to also fit particularly well for less mission-critical applications, like a time tracking tool, or for processes that are fairly common across organizations, like payroll.
For a customized, mission-critical application for a large organization, the decision becomes more complicated. Whether an application is hosted or installed becomes just one of many considerations as you define your needs and take a broad look at the software packages that might support them. It's important to weigh your technology strategy as well: Is a goal of your organization to lighten your technology burden, or are you trying to get to a point where you can strategically invest in infrastructure that's tailored to your organization? Outsourcing software hosting doesn't eliminate your need for in-house technical expertise, but it moves it out of the infrastructure role and into the strategic.
So what’s the truth about hosted software packages? As is so often true, the whole truth becomes complicated. This type of software certainly shouldn’t be dismissed out of hand, but it’s also not quite as optimal as many vendors would have you believe. At the end of the day, only you can decide what’s true for your organization.
Thanks to Peter Campbell of Earth Justice, Jenny Council of NetCorps and Keith Heller of Heller Consulting, who also contributed to this article.