Insights / Cloud & Connected Systems
Cloud Model for Your IoT Project: SaaS, PaaS or IaaS
What SaaS, PaaS and IaaS mean for an IoT product, who secures what under each, and a practical rule for choosing between them.
The short answer
SaaS gives you a ready IoT application by subscription: fastest to market, least control. PaaS gives you managed building blocks such as device connectivity, databases and runtimes, so your team writes only the product's own logic; it suits most IoT products. IaaS gives you virtual machines, storage and networks to run any software you like: most control and portability, most work. Choose by what makes your product different, how fast you must launch, and how much operations and security work your team can own.
Why IoT projects need a cloud model decision
IoT pays off when data from many sensors, or over long periods, is gathered and processed in one place. A closed site such as a factory or farm can use a local server. Everything else needs remote infrastructure. Owning servers means paying to run and upgrade capacity that is often idle, which makes little sense for a startup with an unknown market, and is often not cost-effective for large deployments either.
Cloud services are usually described as three layers. The higher the layer, the more the provider runs for you.
IaaS, PaaS and SaaS in an IoT context
IaaS: infrastructure as a service
The provider allocates computing, storage and network resources, built on virtualisation, and you use them as you see fit. Unlike fixed hosting, IaaS lets you run any software and scale resources up and down with load. All the large cloud providers offer it, and open-source stacks such as OpenStack let you build the same model on your own servers. For IoT, IaaS is where you run your own broker, device services and databases.
PaaS: platform as a service
On top of resources, the provider supplies configured operating systems, databases, runtimes and development and testing tools. Developers focus on the product's own logic, not deployment and configuration. The major clouds' managed IoT services, for device connectivity, registries and message routing, sit at this level. Pricing often depends on features used as well as on resources consumed.
SaaS: software as a service
Ready software for a specific task, by subscription. In IoT that includes device connection software adapted to a manufacturer, data storage and processing services including AI, customer-facing apps and dashboards, and cloud tools for configuring, developing and testing devices. Hardware vendors also offer pre-configured software for their own products.
- IoT PaaS
- Managed cloud services that provide the building blocks of an IoT back end, such as device connectivity, identity, message routing, storage and runtimes, so a team builds only the product-specific logic on top.
Which model fits which IoT project
| Model | Choose it when | Example | Watch out for |
|---|---|---|---|
| SaaS | Time to market matters most and standard software covers the need | A startup launching a monitoring MVP to win early users | Extra functionality costs more, and limits appear as the product grows |
| PaaS | The product's value is its own data processing or logic, and standard services can do the rest | Custom video analytics on top of ready hardware, data transfer and storage | Feature-based pricing and the provider's service lifecycle |
| IaaS | Existing software must move to the cloud with little change, or you need specialised software or full control | Moving a locally run system into virtual machines; a closed production or warehouse system | More capital, development time and operations work |
IaaS is the most flexible and the easiest to move between providers, because the solution does not depend on provider-specific services. SaaS solves the problem here and now, often at lower cost, but within fixed limits. PaaS sits between them: for teams that find SaaS too limiting but do not want to build everything themselves, it suits most IoT solutions. For a closed system used only on site, a local server or a private cloud may be the better answer.
Who secures what under each model
IoT and cloud share the same security problem: many entry points and a complex system. Under every model, the provider, the developer and the user each own part of the security. Authentication, authorisation, encryption and access rights are the foundation.
| Area | IaaS | PaaS | SaaS |
|---|---|---|---|
| Physical infrastructure and virtual machine isolation | Provider | Provider | Provider |
| Operating system, runtime and patching | Customer | Provider | Provider |
| Application code and service-to-service permissions | Customer | Shared: provider platform, customer configuration | Provider |
| Authentication, password protection and encryption settings | Customer | Customer | Mostly provider; customer sets policies |
| Data, users and who has access | Customer | Customer | Customer |
| Device identity, firmware and keys on the device | Customer | Customer | Customer |
PaaS is the hardest case, because responsibility is split. Platform services often run as containers or microservices that talk to each other, and wrongly scoped permissions between them can cause task failures or weak protection. The customer still owns secure authentication, password protection and data encryption.
The engineering implication: the devices are always yours
No cloud model takes responsibility for the devices in the field. Device identity, key storage, firmware updates and what a device does when it loses the cloud stay with your team whichever model you choose. Most security problems trace back to people and configuration, so decide early and in writing which parts of security you will own and which you trust to the provider.
How to choose a cloud model for your IoT project
Work through these before choosing
- Name what makes the product different: the part you must build and own.
- Set the launch deadline and how much uncertainty there is about the market.
- Check whether existing software must move to the cloud largely unchanged.
- Map one end-to-end flow, such as an operator checking equipment status, and record who configures, investigates and recovers each part.
- Write down which security responsibilities your team takes on under each model.
- Estimate the cost and effort of moving to another provider later.
Questions engineers ask
Which cloud service model places the most security responsibility on the customer?
IaaS. The provider secures the physical infrastructure and isolates virtual machines; the customer installs, configures and secures everything above that, including the operating system, applications and data.
Which model fits a team that wants to run applications without managing servers or operating systems, but still control the application logic and data?
PaaS. The provider runs the operating system, runtime and platform services; the team writes and controls its own code and data.
Was this useful?
Where this shows up in our work
ExpertiseCloud engineering for the systems behind connected productsChoosing the service model, designing the managed and custom services around it and owning the security split with the provider is the cloud engineering work our teams do for connected products.Apply this to your product